Data Processing Agreement (DPA)

KeyFlint Managed · Version 1.1 · Under Art. 28 GDPR

Draft pending legal review. This page is an English draft and has not yet been reviewed by a lawyer. It does not constitute legal advice.

This agreement governs the processing of personal data on behalf of customers who subscribe to KeyFlint Managed to issue and validate licenses and meter their end users' quotas.

1. Parties and Subject Matter

Controller ("the Customer"): the individual or legal entity that subscribes to KeyFlint Managed.
Processor ("KeyFlint"): KeyFlint (ArceeDev). Contact: support@keyflint.dev.

KeyFlint provides the Customer with a hosted, managed service for cryptographic (Ed25519) license validation and a quota gateway with atomic deduction. To do so, it processes certain personal data on behalf of the Customer and under the Customer's documented instructions, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

2. Description of the Processing (Art. 28(3) GDPR)

Item	Details
Nature	Hosting, storage, cryptographic signing, verification and automated deletion.
Purpose	Issuing and renewing licenses, checking usage rights, atomic quota deduction and refund, and disaster-recovery backups.
Categories of data subjects	End users and customers of the software or MCP services sold by the Customer.
Personal data	Buyer email addresses, license identifiers, hashed node fingerprint (when machine locking is enabled), credit balance counters and quota request logs. Card numbers and special categories of data (Art. 9 GDPR) are never processed.

3. KeyFlint's Obligations as Processor

Documented instructions: process personal data only on the Customer's documented instructions and to provide the contracted service.
Confidentiality: ensure that the people and systems authorized to operate the infrastructure are bound by confidentiality.
Security measures (Art. 32 GDPR): encryption in transit (TLS 1.3), databases isolated in separate containers (Fly.io), and continuous backups encrypted at rest (Cloudflare R2, EU).
Assistance to the Controller: reasonably assist the Customer in responding to data subject requests (access, rectification, erasure, restriction, portability and objection) from its end users.
Breach notification: notify the Customer without undue delay after becoming aware of a personal data breach affecting its data.

4. Authorized Sub-processors

The Customer authorizes the following sub-processors, which are essential to the infrastructure:

Sub-processor	Function	Location
Fly.io, Inc.	Application container compute	EU region (cdg Paris / fra Frankfurt)
Cloudflare, Inc.	Continuous backups on R2	European Union jurisdiction
Resend	Transactional license emails	TLS in transit; DPF / SCCs

5. Return and Deletion at the End of the Service

When the Managed service is cancelled, the Customer has a 7-day grace period to download its data or public keys. After that period, the instance and its data volumes are securely and irreversibly destroyed in accordance with the retention policies.