Data Processing Agreement

#1. Parties and scope

Controller: the organisation that opened the Ojava account (the “Customer”). Processor: Ojava, Dhanush Kalyan Guntaka, sole proprietorship (registration in progress), c/o Antonin Ayewubo, Rue de Lausanne 26, 1201 Genève, Switzerland (“Ojava”); email dhanush@ojava.ch, data protection privacy@ojava.ch; UID in progress.

This Data Processing Agreement (“Agreement”) forms part of the Ojava Terms of service and is accepted when the Customer signs up. It governs Ojava’s processing of personal data on the Customer’s behalf under, to the extent each applies to the Customer: the Swiss Federal Act on Data Protection (FADP, Art. 9), the EU/EEA General Data Protection Regulation (GDPR, Art. 28), and US state privacy laws such as the California Consumer Privacy Act (CCPA), under which Ojava acts as a “service provider” or “processor”. It applies for as long as Ojava processes Customer data.

#2. What is processed

Purpose: detecting and explaining security threats to the Customer’s connected accounts and computers (Microsoft 365, Google Workspace and, in early access, Windows PCs through the Ojava agent), producing alerts, incidents and reports, counting the active accounts for the plan’s limit, and operating the Customer’s Ojava account and billing.

Data subjects and data: users of the Customer’s connected accounts (email address, display name, sign-in events with time, IP address, approximate location, network operator and device; changes to sign-in methods without phone numbers; mailbox rules and delegations, with rule keywords kept only inside the alert; app permissions granted; administrative actions; file sharing and download events without content and without file names, except at most 20 names inside a mass-sharing alert; travel notices); and the Customer’s Ojava users and alert contacts (email, name, password hash, role, sign-ins, preferences, audit log, and the mobile numbers of owners and admins who choose SMS alerts).

Windows PCs (early access): users of the PCs where the Customer installs the Ojava agent (account names in Windows security events, names, paths and command lines of programs that start with the user folder shown as %USERPROFILE%, folder type and extension of files changed in user folders, one example path when many files change at once, network connection addresses, programs set to start automatically, Windows security settings, PC name and Windows version). Inside an alert, Ojava keeps the details it is based on, such as the command line of a program or PowerShell command (at most 500 characters, with the user folder masked) or the remote address of a connection, for as long as the alert is kept.

Email domains: for the domains the Customer has verified in Microsoft 365 or Google Workspace (at most 5), the public DNS records (SPF, DMARC, DKIM, email provider) are checked weekly through the public DNS resolver of Quad9 Foundation (Zurich). Only the latest result per domain is kept, until the account is deleted.

Not processed: the content of emails, attachments, files or chat messages. No special categories of personal data (such as health data) are intended to be processed.

#3. Ojava's obligations

• Instructions (Art. 28(3)(a) GDPR, Art. 9(1) FADP). Ojava processes Customer data only to provide the service and on the Customer’s documented instructions: these terms and the Customer’s settings. Ojava tells the Customer if it believes an instruction breaks data-protection law.
• Confidentiality (Art. 28(3)(b) GDPR). Everyone at Ojava with access to Customer data is bound to confidentiality.
• Security (Art. 28(3)(c) and 32 GDPR, Art. 8 and 9(2) FADP). Ojava applies the measures in the Annex and keeps them current.
• Sub-processors (Art. 28(2) and (4) GDPR, Art. 9(3) FADP). See section 4.
• Data-subject requests (Art. 28(3)(e) GDPR). Ojava helps the Customer, as far as reasonable, to answer requests from data subjects. Owners can export all organisation data themselves under Settings → Security.
• Breaches and impact assessments (Art. 28(3)(f) and 33(2) GDPR, Art. 24(3) FADP). Ojava notifies the Customer without undue delay, and at the latest within 48 hours of becoming aware of a breach affecting Customer data, so the Customer can meet its own obligations (to inform the Swiss FDPIC as soon as possible under Art. 24(1) FADP, or an EU supervisory authority within 72 hours under Art. 33(1) GDPR). Ojava helps, as far as reasonable, with data-protection impact assessments (Art. 35 GDPR, Art. 22 FADP).
• Deletion and return (Art. 28(3)(g) GDPR). Sign-in and activity events are deleted after 90 days (raw Windows PC events after 30 days); closed alerts and incidents after 24 months (3 months on the paid Starter plan, 5 years on the paid Business plan); audit logs after 24 months; travel notices 30 days after the trip. After cancellation, all Customer data is permanently deleted after 30 days, except invoices, which Swiss accounting law requires Ojava to keep for 10 years (Art. 958f CO). Backups are overwritten within 14 days. Until the deletion, the Customer’s owner can download all Customer data at any time (Settings → Security → export, machine-readable JSON); on request to the privacy address, Ojava sends the export.

  Data	Kept for
  Sign-in and activity events (Microsoft 365, Google Workspace)	90 days
  Raw events from Windows PCs	30 days
  Closed alerts and incidents	Starter 3 months · Professional 2 years · Business 5 years (open ones until closed)
  Audit log of your account (incl. the IP address of account actions)	24 months
  File names (at most 20, mass-sharing alerts only), inbox-rule keywords, command lines (at most 500 characters) and connection addresses that an alert is based on	only inside the alert, deleted with it
  Travel notices (“I’m travelling”)	30 days after the trip ends
  Mobile number for SMS alerts (owners and admins)	until you remove it or the account is deleted
  Log of SMS sent (date, type, cost; no number, no text)	24 months
  At ASPSMS: the number and the sending time	up to 6 months, where Swiss telecommunications surveillance law requires it
  Access requests from outside Switzerland	12 months
  Server logs (incl. IP addresses of requests)	30 days
  Email domain check results: latest result per domain	until the account is deleted
  Email domain check (website): IP address	24 hours
  List of user accounts (to count active accounts for the plan)	replaced every day; deleted with the connection or the account
  Trusted devices (two-step verification)	30 days
  Backups	up to 14 days, then overwritten
  Everything, after cancellation or a deletion request	30 days (to let you come back or export), then deleted
  Invoices	10 years (Swiss accounting law)

• Information and audits (Art. 28(3)(h) GDPR). Ojava provides the information needed to show compliance with this Agreement on request. On-site audits require 30 days’ notice and are at the Customer’s cost.
• Monitoring of your people (Customer’s obligations). The Customer is the controller of the data of the people whose accounts and computers it connects to Ojava. Before connecting a source or installing the Ojava agent, the Customer (a) informs those people of the monitoring, its security purpose and what is collected, including that Windows keeps a local audit record of which program changes files in their user folders; (b) consults, or obtains the agreement of, any works council or employee representatives where the applicable law requires it; and (c) ensures that it has a legal basis for the monitoring. Ojava provides a template notice for employees (Settings → Security). The Customer indemnifies Ojava against claims arising from a breach of this section.
• Professional secrecy. Where the Customer is bound by professional secrecy (for example under Art. 321 of the Swiss Criminal Code), Ojava acts as its auxiliary: it keeps all Customer data secret, uses it only to provide the Service, and binds its staff and sub-processors to the same secrecy.

#4. Sub-processors

The Customer authorises the sub-processors below (Art. 28(2) GDPR, Art. 9(3) FADP). Ojava gives at least 30 days’ notice by email before adding or replacing one; the Customer may object and cancel. Ojava binds each sub-processor to data-protection obligations at least as protective as this Agreement (Art. 28(4) GDPR).

• Infomaniak Network SA (Switzerland): hosting, database and backups (Geneva data centre, Swiss Backup), domain and DNS; all Customer data.
• Anthropic PBC (USA): AI alert explanations and assistant answers; alert details with names, email addresses, IP addresses and PC names replaced by placeholders; never email or file content, file names, rule keywords, travel destinations or phone numbers.
• Resend, Inc. (USA): sends Ojava’s emails (alerts, sign-in codes, invitations, invoices, reminders); recipient address and email content.
• VADIAN.NET AG (ASPSMS), St. Gallen, Switzerland: critical-alert SMS to owners and admins who added a mobile number; the number and the message text (organisation name only).
• Microsoft Ireland Operations Ltd (EU), with Microsoft Corporation (USA): Ojava’s own mailboxes; correspondence with the Customer.
• Stripe Payments Europe, Ltd. (Ireland), with Stripe, LLC (USA): card payments for customers outside Switzerland; billing data only.

#5. International transfers

Customer data is hosted in Switzerland (Geneva); the EU recognises Switzerland as providing adequate protection (Art. 45 GDPR). Disclosure abroad follows Art. 16 FADP and Art. 44–46 GDPR: the EU/EEA is recognised by Switzerland as adequate (Annex 1 of the Data Protection Ordinance); sub-processors in the USA are certified under the Swiss–U.S. and EU–U.S. Data Privacy Framework, or the transfer relies on the EU Standard Contractual Clauses in their data processing terms, with the amendments recognised by the FDPIC (Art. 16(2)(d) FADP, Art. 46(2)(c) GDPR). Resend is certified under the EU–U.S. framework only (checked 6 November 2026), so Swiss data sent to Resend relies on the Standard Contractual Clauses; Anthropic relies on the Standard Contractual Clauses.

#6. United States: service-provider commitments

Where US state privacy laws apply, Ojava: does not sell or share personal information; does not retain, use or disclose it for any purpose other than providing the service to the Customer, or outside the direct business relationship with the Customer; does not combine it with personal information from other sources except as those laws permit; complies with the obligations that apply to service providers and gives the same level of privacy protection; and tells the Customer if it can no longer meet these obligations. The Customer may take reasonable steps to stop and remediate any unauthorised use.

#7. Liability, law and precedence

Liability follows the Ojava Terms of service. This Agreement is governed by Swiss law; the courts of Geneva, Switzerland have jurisdiction. Mandatory provisions of the GDPR or other applicable data-protection laws remain unaffected. If this Agreement and the Terms conflict on data protection, this Agreement prevails. A signed copy is available on request at privacy@ojava.ch.

#Annex: technical and organisational measures

• Encryption in transit: HTTPS with TLS 1.3 only, HSTS.
• Credentials: Microsoft and Google access tokens encrypted at application level; passwords hashed with bcrypt; two-factor secrets encrypted.
• Backups: nightly database exports encrypted with AES-256 and kept at most 14 days, on the server and at Infomaniak Swiss Backup (copies in two Infomaniak data centres in Switzerland). Data at rest: the database and all server data are on an encrypted disk (LUKS2, AES-256).
• Separation: every database query is restricted to the Customer's organisation.
• Access control: roles (owner, admin, trusted employee, employee); two-step verification required for every user (owners and admins: passkey or authenticator app); sessions revoked on password reset or role change.
• Abuse protection: rate limits on login, signup, password reset and other sensitive actions.
• Network: firewall allowing only web and SSH traffic; database and internal services not reachable from the internet; SSH by key only; automatic security updates.
• Logging: audit log of logins, failed logins, two-factor changes, exports and administrative actions per organisation.
• Monitoring: automated checks every 5 minutes of the site, API, services, disk, backups and certificates, with alerts to the operator.
• Least privilege at the source: read-only Microsoft permissions for audit and directory logs and two read-only Google permissions (view audit reports; view the list of users); no permission to read email. The Windows agent sends security events, program paths and command lines with the user folder masked (%USERPROFILE%), and for changed files only folder type and extension, never document contents.
• Data minimisation: automatic deletion after the periods in section 3; no file names or paths and no phone numbers stored with events (at most 20 file names, inside a mass-sharing alert only); inbox-rule keywords kept only inside the alert; no file names, rule keywords, travel destinations or phone numbers sent to the AI provider, which receives pseudonymised data.
• Software updates: dependencies checked against known-vulnerability databases before releases.