Data processing agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is between the customer using Gitfence ("you", the controller) and HootCodes LTD, a company registered in Bulgaria, European Union, registered office Aleksandar Stamboliyski Blvd 55, fl. 4, 1000 Sofia, Bulgaria, UIC 208188022, VAT BG208188022 ("we", the processor).

It applies whenever we process personal data on your behalf while providing Gitfence, and it forms part of our terms of service (the "Agreement"). If this DPA and the Agreement conflict on data protection, this DPA prevails. Terms such as "personal data", "processing", "controller", "processor" and "personal data breach" have the meanings given in the EU General Data Protection Regulation (GDPR).

For a countersigned copy, email [email protected].

2. Subject matter, duration, nature and purpose

• Subject matter: providing Gitfence, the access-control layer between your GitHub repositories and the people and AI agents you give access to.
• Duration: for as long as you use Gitfence, plus the period needed to delete data after the Agreement ends (section 10).
• Nature: storing and mirroring repositories; building and serving filtered views; validating pushes and delivering them to GitHub; running tests in Fenced CI; recording signatures, access changes and audit events; sending notifications to integrations you connect.
• Purpose: to provide Gitfence as configured by you, and for no other purpose.

3. Data subjects and categories of data

Data subjects: your admins, your members (for example employees, contractors, agencies and auditors) and the people who own the AI agents they connect, and any person whose personal data appears in your repository content (for example commit authors).

Categories of personal data:

Special categories of personal data are not needed to use Gitfence. Don't store them in repositories you connect unless you have a lawful basis to do so.

4. Your instructions

We process personal data only on your documented instructions. The Agreement, this DPA and the way you configure Gitfence (repositories, access rules, members, integrations, retention settings) are your instructions. We'll tell you if we believe an instruction breaks the GDPR or other EU or member state data protection law. If the law requires us to process data in another way, we'll tell you first unless the law forbids it.

You are responsible for having a lawful basis for the processing, for the accuracy of the data you provide, and for informing your members about it.

5. Confidentiality

Everyone at HootCodes LTD authorized to process your personal data is bound by confidentiality. Access to production systems is limited to personnel who need it to operate, support or secure Gitfence.

6. Security measures

We implement appropriate technical and organizational measures under GDPR Article 32, including:

• Isolation of hidden code. Each member's view is built from filtered commits and served from a repository that never contains hidden objects. Hidden paths don't reach people who can't see them, including through shallow, partial or mirror clones.
• Push validation. Every pushed commit is checked path by path against the person's access before anything reaches GitHub.
• Sandboxed tests. Fenced CI runs tests with no network access in a temporary copy that is deleted after each run, and redacts hidden source from output.
• Credentials. Tokens, session IDs and invitation links are stored only as SHA-256 hashes. GitHub user access tokens are used once at sign-in and not stored; GitHub App tokens are short-lived and kept in memory.
• Encryption. Integration secrets (Slack, Linear, Jira and webhook secrets) are encrypted at rest with AES-256-GCM. Traffic is encrypted in transit with HTTPS.
• Access gating. Required documents, pending approvals and access end dates are enforced on git, the MCP server and Fenced CI, not only in the web interface.
• Audit. Access, pushes, test runs, tool calls and settings changes are logged, with exposure reports and audit export available to you.

The security page describes what our tests cover and the limits we know about. We may update these measures as long as the overall level of protection doesn't decrease.

7. Sub-processors

You give us general authorization to use sub-processors. The current list, with what each one does and where, is on our subprocessors page. Slack, Linear and Jira are used only if you connect them.

We will give you at least 30 days' notice before adding or replacing a sub-processor that handles your personal data, by updating that list and emailing account admins. You can object on reasonable data protection grounds within that period. If we can't resolve the objection, you may terminate the affected service and we'll refund any prepaid fees for the remaining term.

We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible to you for their performance.

8. Assistance

Data subject requests. Gitfence lets you handle most requests yourself: export audit logs, exposure reports and signature certificates, remove members, revoke tokens and disconnect repositories and integrations. If we receive a request from one of your data subjects, we'll pass it to you without undue delay and won't respond ourselves unless you ask us to. We'll help with requests you can't handle with these tools.

Other assistance. Taking into account the nature of the processing and the information available to us, we'll help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority (GDPR Articles 32 to 36).

9. Personal data breaches

We'll notify you without undue delay after becoming aware of a personal data breach affecting your data. The notice will include what we know at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We'll add more information as it becomes available and help you meet your own notification obligations.

10. Deletion or return at the end

Before the Agreement ends, you can export your data at any time: audit logs (JSONL or CSV), exposure reports, signature certificates and documents. Your repositories remain in your own GitHub account.

When the Agreement ends, we delete your personal data, including the repository mirror, views, caches and logs, unless EU or member state law requires us to keep it. Deletion timeline, including backups, to be confirmed. We'll confirm deletion in writing on request.

11. Audits

We'll make available the information necessary to demonstrate compliance with this DPA and GDPR Article 28. We'll also allow audits, including inspections, by you or an independent auditor you appoint, subject to reasonable advance notice, confidentiality, and measures that protect other customers' data and our systems. Audits take place no more than once a year unless required by a supervisory authority or following a personal data breach. Each party bears its own costs.

12. International transfers

Gitfence is hosted in the European Union: the server in Germany, database backups in Finland. Where a sub-processor processes personal data outside the European Economic Area, we rely on an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with supplementary measures where needed.

13. Liability and term

Each party's liability under this DPA is subject to the limitations in the Agreement. This DPA lasts as long as we process personal data on your behalf.

14. Contact

Data protection questions: [email protected]. Legal notices and countersigned copies: [email protected]. HootCodes LTD does not currently appoint a formal Data Protection Officer, as it does not meet the mandatory DPO appointment thresholds under GDPR Article 37. Our lead supervisory authority is the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria.

Last updated: 2026-10-10 (draft).