1.Scope and parties
This data processing agreement ("DPA") forms part of the agreement between BitMask LLP, which operates Fixedmark ([Operator fills: registration number], [Operator fills: registered address]), and the customer that accepted the terms of service. It applies whenever Fixedmark processes personal data on the customer's behalf to run the service.
The customer is the controller of that personal data and Fixedmark is its processor. Fixedmark processes it only to provide the service the customer configures, on the customer's documented instructions, which are the agreement, this DPA, and the settings the customer chooses in the dashboard or the API.
2.What Fixedmark processes
Fixedmark is an egress proxy. It processes:
- Account data: the names and email addresses of the customer's team members, their roles, sign-in and second-factor records, single sign-on groups, API key names, and the audit log of what each member did.
- Billing data: the billing contact, country, and tax details, and invoices. Card and bank details go to the payment provider directly and never reach Fixedmark.
- Connection metadata: for each connection through a Fixedmark IP, the time, the client IP address it came from, the destination host and port, the TLS server name, the bytes sent and received, the egress IP, the credential used, and the result. These are the connection logs the dashboard shows. Fixedmark's own operational logs record the same metadata for each connection.
- Usage counts: bytes and connections per IP per hour, used to meter and bill bandwidth.
Fixedmark never stores the content of your traffic. TLS traffic passes through the proxy as an encrypted tunnel that the proxy does not decrypt. Plain HTTP requests sent to the HTTP proxy are forwarded as they are. In both cases no request, response, header, or body is written to a log, a database, or a backup on any plan.
3.How long data is kept
Connection logs are kept for the number of days the customer's plan includes, then deleted:
| Plan | Connection logs kept |
|---|---|
| Starter | 1 day |
| Pro | 7 days |
| Business | 30 days |
| Scale | 30 days |
| 7-day trial | 1 day |
| Other data | Kept for |
|---|---|
| Traffic content | Never stored or logged. TLS traffic passes through without being decrypted, and plain HTTP requests are forwarded as they are. |
| Operational logs and metrics | 30 days in Grafana Cloud, then deleted. They include a line for each connection with the metadata above, on every plan, whatever the plan's connection-log period. |
| Database backups | 30 days in Oracle Cloud Object Storage, then deleted by the bucket's lifecycle rule. |
| Account, usage, and audit records | While the account exists, and as described under deletion below. |
| Invoices and tax records | [Counsel fills: the period tax law requires] |
4.Sub-processors
Fixedmark uses these sub-processors. Each receives only the data listed beside it.
| Sub-processor | What it does for Fixedmark | Data it receives |
|---|---|---|
| Oracle Cloud Infrastructure (OCI) | Hosts the control plane and its Postgres database, keeps database backups in Object Storage, and runs egress nodes in the regions you choose. | Account, billing, and usage records; connection log rows; your traffic passing through an egress node, never stored. Fixedmark does not decrypt TLS to your destinations. |
| Vultr | Runs egress nodes in the regions you choose. | Your traffic passing through an egress node, never stored. Fixedmark does not decrypt TLS to your destinations. |
| Linode (Akamai) | Runs egress nodes in the regions you choose. | Your traffic passing through an egress node, never stored. Fixedmark does not decrypt TLS to your destinations. |
| Cloudflare | Hosts the website, the dashboard, and the status page, serves DNS, stores GST invoice files, and checks the early-access form with Turnstile. | Requests to our websites, including IP address and browser details; invoice files; early-access signups. |
| WorkOS | Sign-in, single sign-on, and second factors for the dashboard. | Names and email addresses of your team members, SSO directory groups, and second-factor records. |
| Paddle | Takes payment as merchant of record for customers billed through Paddle. | Billing contact, country, and payment details, which Paddle collects directly. |
| Razorpay | Takes payment for customers billed in India. | Billing contact, GSTIN where given, and payment details, which Razorpay collects directly. |
| Vercel | Bills customers who install the Fixedmark integration from the Vercel Marketplace, and holds the proxy settings the integration writes into the projects they link. | Installation and project identifiers, overage usage for billing, and the proxy URLs with their credentials written as environment variables into linked projects. |
| Resend | Sends account, billing, usage, and webhook mail. | Recipient email addresses and the mail we send them. |
| Grafana Cloud | Stores FixedMark's operational logs and metrics for 30 days and runs the external egress probes behind the status page. | Service logs and metrics that carry account and app identifiers, FixedMark's own IP addresses, and a line for each proxied connection with its client IP address, destination host and port, bytes, and result. Never traffic content or credentials. |
| Telegram | Delivers operational alerts to the FixedMark operator. | Account and app identifiers and IP addresses named in an alert, and the email address of each early-access signup. Never traffic content or credentials. |
Fixedmark will tell customers about a new sub-processor at least [Counsel fills: notice period] before it receives customer personal data, by email to the account owner and by updating this page. A customer may object in that period by writing to support@fixedmark.com.
5.Where data is stored
Account data, usage records, and connection logs are stored in the Postgres database on Fixedmark's control-plane host on Oracle Cloud in [Operator fills: control-plane region], with backups in Oracle Cloud Object Storage. Traffic passes through egress nodes in the regions the customer chooses (see regions).
Transfers outside the customer's country rely on [Counsel fills: transfer mechanism].
6.Security measures
Fixedmark keeps the measures described on the security page, including:
- TLS passthrough: the proxy does not decrypt TLS traffic, so it cannot read its content.
- API keys and proxy tokens stored only as hashes; webhook signing secrets sealed with AES-256-GCM.
- Role-based access for team members, with an audit log of every change, and second-factor sign-in.
- The database reachable only from its own host, and operator access to the host only over SSH keys and a private WireGuard network.
- Per-credential destination allowlists that limit what a leaked token can reach.
7.Personal data breaches
Fixedmark will tell the customer's account owner without undue delay, and within [Counsel fills: hours] hours, after it becomes aware of a breach affecting the customer's personal data, with what is known of its scope and the steps taken.
8.Deletion at the end of the service
When an owner deletes the organization, Fixedmark at once revokes its API keys and proxy credentials, ends its plan, and cancels its billing, and its IP addresses are detached on the next lifecycle run with no grace period. Thirty days later it purges the organization's data, keeping only the invoice, billing, usage, tax, audit, and IP address records that law and the never-reuse promise for addresses require, with the organization anonymized.
Connection logs are deleted on the plan's schedule above, and backups age out after 30 days.
9.Assistance and audits
Fixedmark will help the customer answer requests from the people whose data it processes, and provide the information needed to show compliance with this DPA, on request to support@fixedmark.com. [Counsel fills: audit terms and their cost]
10.Governing law and liability
This DPA is governed by [Counsel fills: governing law], and the liability terms of the agreement apply to it: [Counsel fills: liability cap].
Related: terms of service, security, website privacy policy.