Data processing agreement

Status of this document

Draft. Pending items are marked below. Operator details are not final: ServerStats.CC has no registered legal entity or postal address yet. When it does, they will be inserted here and the page date will change. Until then this page describes the terms we work to, and a customer that needs a countersigned copy for a vendor review can ask at [email protected].

Scope

This agreement forms part of the Terms of service between you (the “Customer”) and ServerStats. It applies when ServerStats processes personal data on the Customer's behalf and the GDPR, the UK GDPR, the Swiss FADP or a similar law applies to that data. It follows Article 28 of the GDPR. If it conflicts with the Terms on the handling of personal data, this agreement wins; on everything else the Terms win.

ServerStats is a processor for the data about the Customer's players that the Customer's game servers send to us. ServerStats is a controller for the Customer's own account data (login email, team members, billing), which the privacy policy covers instead.

Details of the processing

Instructions

• We process player data only to provide ServerStats and only on the Customer's documented instructions: the Terms, this agreement and the Customer's use of the dashboard, agents and API settings.
• We tell the Customer if we think an instruction breaks data protection law.
• We do not sell player data, use it for advertising, or combine it across customers. Any benchmark would use aggregates of at least 20 servers.
• People who can reach player data at ServerStats are bound by confidentiality.

Security measures

These are measures in place today. They are described in more detail on the security page.

• Everything is sent over TLS. Agents connect out only, enrol once with a single-use claim code and sign each batch with their own key; we hold only the public key.
• Player identifiers, names, notes and team emails are encrypted at rest with AES-256-GCM using a key unique to each organisation. That key is wrapped by a master key held outside the database. Deleting an organisation destroys its key first.
• Backups are encrypted with a separate key.
• Passwords are stored as Argon2id hashes. Two-factor sign-in (TOTP) with recovery codes is available, sessions can be listed and revoked, and API tokens have scopes and expiry.
• Access is role-based inside each organisation. Reads of stored punishment reasons are recorded in the audit log.
• The application services listen on the server's loopback interface only; only the web server faces the network. Our web server access logs do not record visitor or game-server IP addresses.
• Rate limits apply to sign-in, the API and agent ingest. Dependencies are checked with npm audit, and agent releases are signed.

These are not a certification. ServerStats does not hold SOC 2 or ISO 27001 reports. A summary of our latest internal security review is available on request.

Subprocessors

The Customer gives general authorisation for the subprocessors below. Each is bound by terms that give the same level of data protection as this agreement, and we remain responsible for them.

Google (Gmail, for messages sent to our support addresses; and Sign in with Google), Discord (Sign in with Discord) and Valve (Steam sign-in) appear on the privacy policy because they handle account data. They do not receive player data from us.

We will email the Customer's account owners at least 30 days before adding or replacing a subprocessor that handles player data. The Customer may object on reasonable data-protection grounds within that time; if we cannot accommodate the objection, the Customer may end the service and receive a refund for the unused period of a prepaid plan.

International transfers

We run on a server in Canada and use providers in the United States. Where personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, the parties rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), which are incorporated here by reference, with the UK International Data Transfer Addendum for UK data. The options in the SCCs are: Clause 7 (docking) included; Clause 9(a) general authorisation with 30 days' notice; Clause 11 optional language omitted; Clause 17 and Clause 18 the law and courts of Ireland; the annexes are the details, security measures and subprocessors on this page. Canada has an EU adequacy decision for commercial organisations subject to its privacy law. Our subprocessors in the United States are bound by their own transfer terms and certifications, which we will share on request. Pending: the exporter and importer address fields in the SCC annexes stay blank until the legal entity exists.

Helping with requests

• The Customer can erase a player from the player's profile. This also unlinks the player from other players' payments, trades and punishments, deletes stored punishment reasons about them and removes them from abuse flags; it completes within minutes.
• Owners and admins can export the organisation's data, and each user can export their own account data, from Settings. Export of a single player's data is available on request at [email protected].
• If a player contacts us directly, we pass the request to the Customer and do not answer it ourselves unless the law requires.
• We help with data protection impact assessments and regulator enquiries about the processing, on reasonable request.

Personal data breach

We tell the Customer's account owner by email without undue delay, and in any case within 72 hours of becoming aware of a breach affecting the Customer's personal data. The notice says what happened, what data and roughly how many people are affected, the likely consequences, and what we are doing about it, and we add details as we learn them. Because player identifiers and names are encrypted per organisation and we hold no player IP addresses, many incidents will not expose usable player data, and the notice will say so.

Deletion and return

• The Customer can delete an organisation at any time. We then destroy its encryption key and delete its servers and data. Encrypted backups that still hold the key expire within 5 weeks, and the data in them stays unreadable by anyone without the key.
• Raw events and sessions older than the plan's history window are deleted automatically every hour. Player profiles and purchase records follow only the controls above for now (see the privacy policy).
• Before the end of the service, the Customer can ask for a copy of its data at [email protected]; we send it in a common format within 30 days.
• We keep what the law requires us to keep, such as invoices.

Audits

On request we provide the information needed to show we meet this agreement, including written answers to a reasonable security questionnaire. If that is not enough, the Customer may audit us once a year on 30 days' notice, during working hours, under confidentiality, at the Customer's cost and without access to other customers' data.

Liability and law

Each party's liability under this agreement is subject to the limits in the Terms. The agreement is governed by the law that governs the Terms (the State of New York, United States), except that the SCCs are governed as stated above and data protection law applies as the law requires.

Pending before this can be signed

• Pending: the ServerStats legal entity name, registration and postal address.
• Pending: a signature block and the EU or UK representative, if one is required once the entity exists.