Data Processing Agreement
Template for team and enterprise customers
Roles
Customer is the data controller. Dennon Developments (“Tap Terminal”) is the data processor.
Subprocessors
- Apple — authentication (Sign in with Apple), push notifications, CloudKit sync
- Cloudflare — backend compute, database, CDN, Companion binary hosting
- Vercel — website hosting
- Resend — transactional email (magic link auth)
Standard Contractual Clauses
EU/UK Standard Contractual Clauses (SCCs) apply to any transfer of personal data outside the EEA. Cloudflare provides SCCs as part of their DPA.
Security measures
- Encryption in transit (TLS 1.3) and at rest (Cloudflare D1)
- Access controls (Sign in with Apple, role-based team access)
- Audit logging (append-only, configurable retention)
- Terminal contents never collected or stored server-side
Data breach notification
Within 72 hours of confirmed breach per GDPR requirements. Notification to affected users without undue delay.
Request a signed DPA
Contact legal@tapterminal.dev with your company name and team size.