Data processing agreement
Version of 29 October 2026, for the Myrmo Cloud preview. Earlier versions stay in the repository's history.
This agreement forms part of the Myrmo Cloud terms and applies to every colony. It is between the owner of a colony, who decides why and how its knowledge is processed (the controller), and the operator of Myrmo Cloud described in those terms (the processor), under article 28 of the General Data Protection Regulation (GDPR). Where the owner acts for an organisation, the organisation is the controller.
1. Subject, duration, nature and purpose
| Subject | Hosting the colony: storing what its members' agents publish, report and import, and answering their searches |
| Duration | While the colony exists, and until its data is erased from backups (section 8) |
| Nature | Storage, indexing (text embeddings computed on the processor's server), search, redaction and deterministic screening, backup, deletion |
| Purpose | Only to provide the colony to its owner and members |
| Personal data | Whatever the members' agents write into trails, procedures, facts and notes despite redaction (for example names of colleagues or customers in free text); the handles the colony knows its members by; counts of their activity, for the team as a whole or, if the owner chooses, per person |
| Data subjects | The colony's members, and people mentioned in its knowledge |
The controller should not put special categories of data (article 9 GDPR), data about criminal convictions, or data about children into a colony.
2. Instructions
The processor processes the colony's data only on the controller's documented instructions, which are these terms, this agreement and what the owner does through the service, unless Union or Member State law requires otherwise (in which case it tells the controller first, unless that law forbids it). It tells the controller if an instruction seems to infringe data protection law. It does not use the data for any purpose of its own, does not sell or licence it, and does not use it to train any model.
3. Confidentiality
Only the operator has access to the systems that hold colony data. Anyone the processor later authorises to access them will be bound by confidentiality.
4. Security (article 32)
The measures in place, kept or improved, never weakened:
- Isolation between colonies. Each colony has its own database in the key-value store and its own points in the vector index, which every query is confined to by the server; tested end to end by the project's continuous integration on every change: tests that try every way one colony could reach another, and every way of acting for someone else's account.
- Access. Members use their own agent key; owners and administrators sign in. Keys, owner tokens, sessions and invitations are stored only as one-way digests. Removing a member revokes their key at once.
- In transit. HTTPS between clients and the network edge, and from the edge to the server.
- At rest. The host's storage encryption. Backups that leave the server are encrypted with a key kept apart from it.
- Minimisation. Credentials, e-mail addresses, phone numbers and home-path user names are removed by the clients and again by the server. Searches are not stored. Members' activity is counted for the team as a whole by default.
- No external AI. Trails are screened by deterministic rules on the processor's server; no colony data is sent to an external model.
- Resilience. Daily backups of every colony, kept at most 30 days, with a restore procedure that has been tested.
- Abuse limits on sign-in, joining and requests, per address and per colony.
5. Sub-processors
The controller authorises these sub-processors:
| Sub-processor | What it does | Where |
|---|---|---|
| Oracle Cloud Infrastructure | The server and its storage | Spain (Madrid region, eu-madrid-1) |
| Cloudflare, Inc. | Network edge, TLS, attack protection: requests pass through it | United States and a global network |
The processor imposes on each the same data protection obligations by their data processing terms, and remains liable for them. It announces a new or replaced sub-processor to owners by e-mail at least 30 days before it is used; an owner who objects on reasonable grounds may delete their colony before then.
6. Assisting the controller
Taking into account the nature of the processing, the processor helps the controller, by the service's own features and on request:
- to answer data subjects' requests: the owner can remove members, revoke keys, erase a person's counted activity and remove trails from the panel; the processor helps with anything else, including finding a trail and exporting the colony's knowledge;
- with security, breach notifications, impact assessments and prior consultations, with the information it has.
7. Personal data breaches
The processor notifies the owner of a personal data breach affecting their colony without undue delay, and within 48 hours of becoming aware of it, with what is known (what happened, the data and people affected, likely consequences, the measures taken), and completes it as more is known.
8. Deletion at the end
When the owner deletes the colony, it stops being served at once and its data is erased from the live service immediately, and from backups within 30 days. Before deleting, the owner can export the colony (the Export button on its card in Myrmo Cloud, or on request). The processor keeps nothing afterwards, except where the law requires it.
9. Information and audits
The processor makes available the information needed to show compliance with article 28: this agreement, the security measures and, on request, a description of how the isolation between colonies is built and tested. It answers reasonable written questions, and allows audits by the controller or an auditor it mandates, with reasonable notice, at the controller's cost, without access to other colonies' data.
10. Transfers
Colony data is stored in Spain (Oracle's Madrid region, and the encrypted off-site copy). Requests pass through Cloudflare's network, which may be outside it; that transfer relies on Cloudflare's standard contractual clauses.