Data Processing Agreement

01 Parties and how to accept

This Data Processing Agreement (the DPA) is between:

• Arcnode Network, established in the Netherlands, reachable at legal@arcnode.dev (the Processor); and
• the Organization that accepts it as described below (the Controller).

To accept, send an email to legal@arcnode.dev with the subject “Arcnode Remote Data Processing Agreement”, stating the Organization’s legal name, address, registration number (if any), the name and role of the person accepting on its behalf, and a contact for privacy and breach notices. The DPA takes effect when Arcnode Network confirms receipt by email. On request, we also sign a copy.

This DPA applies to the version published on this page on the day it takes effect. It supplements the Arcnode Remote Terms of Service (together with the Terms of Use, the Agreement) for the Organization and its Helpers.

02 Definitions

Terms such as personal data, processing, controller, processor, data subject, supervisory authority and personal data breach have the meanings given in the GDPR (Regulation (EU) 2016/679). Capitalized Arcnode Remote terms, such as Helper, Person Being Helped, Session, Session Content, Session Code, Relay, Relay Id, Helper Access and Computers List, have the meanings given in the Arcnode Remote Terms of Service.

03 Scope: what is and is not covered

3.1 Processed on the Organization’s behalf

Arcnode Network processes the following as the Organization’s processor, insofar as it relates to the Organization’s Helpers and the customers they help:

• Helper account and Helper Access data used for Arcnode Remote: which of the Organization’s staff accounts may help, sign-in to Arcnode Remote, Helper Access checks and changes, operator attestations and relay tokens.
• Relay metadata: IP addresses, Session Codes, Relay Ids and connection counters of the Helpers’ and customers’ computers, held in memory to pair them and to protect against code guessing.
• Computers List data: for each customer computer that trusts a Helper for Any-time Access, its Relay Id, name and Device Key fingerprint.

3.2 Not covered by this DPA

• Session Content (screen images, input, clipboard, chat, files and camera pictures). It is encrypted end to end between the two computers. The Relay only forwards it as ciphertext, without any key, and Arcnode Network cannot read, change, keep or disclose it. The Organization is solely responsible for Session Content and for what its Helpers do with it.
• Data stored only on the Helpers’ or customers’ own computers, such as session history, trust files and diagnostics, which Arcnode Network cannot access.
• Processing for which Arcnode Network is itself controller, as described in the Privacy Policy and the Arcnode Remote Privacy Notice: the Arcnode Account itself and its security, update checks and downloads, the website remote.arcnode.dev, preventing and investigating misuse of the Platform, and compliance with legal obligations.

04 Subject matter, nature, purpose and duration

The subject matter is providing Arcnode Remote to the Organization. The processing consists of storing, consulting, using, transmitting and deleting the data in section 3.1, for the sole purpose of letting the Organization’s Helpers connect to, and give remote support on, its customers’ computers. It lasts for the term of this DPA. The details are in Annex I.

05 Instructions

• Arcnode Network processes the personal data only on the Organization’s documented instructions. The Agreement, this DPA and the Organization’s use and configuration of Arcnode Remote are those instructions. Further instructions must be in writing and consistent with how the Service works.
• Arcnode Network informs the Organization if, in its opinion, an instruction infringes the GDPR or other data protection law, and may suspend following it until it is confirmed or changed.
• Where EU or Member State law requires other processing, Arcnode Network informs the Organization before processing, unless that law prohibits it (Article 28(3)(a) GDPR).

06 Confidentiality

Arcnode Network ensures that everyone it authorizes to process the personal data is bound by confidentiality, by contract or by law, and only has access where needed for the purpose in section 4 (Article 28(3)(b) GDPR).

07 Security

Arcnode Network implements the technical and organizational measures in Annex II, appropriate to the risk as required by Article 32 GDPR. It may change these measures, provided the overall level of security is not reduced.

08 Subprocessors

• The Organization gives general authorization for the subprocessors listed in Annex III.
• Arcnode Network informs the Organization at least 30 days in advance, by email to its privacy contact, of any intended addition or replacement of a subprocessor. The Organization may object on reasonable data protection grounds within that period. The parties then discuss a solution in good faith; if none is found, the Organization may terminate this DPA and its use of Arcnode Remote, without penalty.
• Arcnode Network imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible to the Organization for their performance (Article 28(2) and (4) GDPR).

09 International transfers

Arcnode Network transfers personal data outside the European Economic Area only with an appropriate safeguard under Chapter V GDPR, such as an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the Standard Contractual Clauses with the subprocessor concerned. Session Content is never transferred to Arcnode Network.

10 Assistance

• Arcnode Network helps the Organization, by appropriate technical and organizational measures and insofar as possible, to respond to requests from data subjects exercising their rights (Chapter III GDPR), and forwards any such request it receives about the Organization’s data without undue delay, without answering it itself unless instructed.
• Arcnode Network helps the Organization meet its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to it.
• Because relay metadata exists only in memory for minutes and Session Content is never available to Arcnode Network, assistance for these categories is usually limited to explaining how the Service works.

11 Personal data breaches

Arcnode Network notifies the Organization of a personal data breach affecting the data in section 3.1 without undue delay, and in any case within 48 hours after becoming aware of it. The notice includes, as far as then known:

• the nature of the breach, the categories and approximate number of data subjects and records concerned;
• a contact point for more information;
• the likely consequences; and
• the measures taken or proposed to address it and to mitigate its effects.

Information not yet available is provided in phases as soon as it is. Arcnode Network documents every breach and does not notify supervisory authorities or data subjects on the Organization’s behalf unless instructed or required by law.

12 Deletion or return

When this DPA ends, Arcnode Network, at the Organization’s choice, returns the Computers List entries of its Helpers in a common machine-readable format and/or deletes them, within 30 days, unless EU or Member State law requires further storage. Relay metadata is not stored and is gone within minutes. Helper accounts are Arcnode Accounts and are deleted at the request of the account holder or the Organization under the Privacy Policy.

13 Information and audits

• Arcnode Network makes available all information reasonably needed to demonstrate compliance with Article 28 GDPR, including a written description of the measures in Annex II and answers to reasonable security questionnaires.
• Where that information is not sufficient, the Organization may, at its own cost and no more than once a year (or after a personal data breach, or when a supervisory authority requires it), have an audit carried out by an independent auditor bound by confidentiality, with at least 30 days’ notice, during business hours and without disrupting the Service or exposing other customers’ data.

14 The organization's obligations

• The Organization is responsible for having a lawful basis for the processing, for informing its customers (for example in its own privacy notice) that it uses Arcnode Remote, and for the lawfulness of its instructions.
• It ensures that its Helpers comply with the Arcnode Remote Terms of Service, the Acceptable Use Policy and the Helper Code of Conduct, obtain consent in every Session, and handle Session Content lawfully.
• It tells Arcnode Network promptly which accounts should have Helper Access, and when a Helper leaves, so that access can be removed.

15 Liability

Each party’s liability under this DPA is governed by the Agreement, including its limitations, except where mandatory law, in particular Article 82 GDPR towards data subjects, does not allow this.

16 Term, precedence and governing law

• This DPA lasts as long as Arcnode Network processes personal data on the Organization’s behalf. Either party may end it by giving notice by email; it then ends together with the Organization’s use of Arcnode Remote as a controller.
• On data protection matters, this DPA takes precedence over the Agreement. Standard Contractual Clauses, where they apply, take precedence over this DPA.
• Arcnode Network may update this DPA to reflect changes in law or in the Service, with at least 30 days’ notice to the Organization’s privacy contact; changes that reduce the protection of personal data require the Organization’s agreement.
• This DPA is governed by Dutch law. Disputes are subject to the competent courts of the Netherlands.

I Annex I: details of the processing

II Annex II: technical and organizational measures

1. Encryption of Session Content: end to end with the Noise protocol (Noise_XX_25519_ChaChaPoly_BLAKE2s), forward secrecy through ephemeral keys, authenticated encryption that rejects tampered, reordered or replayed messages. The Relay holds no keys.
2. Authentication of the parties: Device Keys on both sides; a six-digit Verification Code from the handshake; RS256-signed operator attestations bound to the Helper’s Device Key and valid for 10 minutes.
3. Access control: Login with Arcnode (OAuth 2.0 and OpenID Connect with PKCE); Helper Access given per account by an Arcnode owner, checked at sign-in, token refresh, attestation and by the Relay; optional mandatory two-step verification for Helpers; Computers Lists only readable by their own account.
4. Consent and transparency in the app: explicit approval of every Session, separate approval for more access, privacy mode, the camera and Any-time Access; requests time out to decline; a session banner with Disconnect now; a glow while the Helper has control; a tray icon while Any-time Access is on.
5. Abuse prevention: Session Codes from a cryptographic random source, single use, valid 10 minutes, at most 3 open per Helper; lockout after 10 wrong codes per address for 30 minutes; at most 30 connections per address; rate limits per account and per address on Backboard.
6. Encryption in transit: HTTPS for all Backboard and website traffic; TLS for the connection to the Relay at relay.remote.arcnode.dev for app versions that use it.
7. Data minimization: the Relay keeps codes, counters and ids in memory only and logs event names only, without addresses, codes, accounts, tokens or content; security events store anonymized IP addresses; attestations never contain email addresses.
8. Protection of keys and credentials: the Device Key is encrypted with Windows DPAPI; sign-in tokens are kept in Windows Credential Manager; refresh tokens and other secrets are stored by Backboard only as hashes; signing keys are kept as server-side secrets.
9. Software integrity: updates are installed only with a valid signature from Arcnode Remote’s own update key; installers are served from private storage through five-minute links; updates never install during a Session.
10. Organizational measures: access to production systems limited to authorized personnel; confidentiality obligations; a documented threat model reviewed at every milestone; a responsible disclosure policy (arcnode.dev/security); breach handling as in section 11.

III Annex III: subprocessors

The following subprocessors are authorized for the processing under this DPA:

IV Accept this DPA or ask a question

Send the details listed in section 1 to accept this DPA on behalf of your organization, or write with any question about it.