Data processing terms
How we handle your data when we work in your cloud accounts. Where your agreement says otherwise, your agreement comes first.
What we do with your data
- Only the service you asked for
- We use your data to deliver the work in your agreement, and for nothing else.
- It stays in your accounts
- Your data stays in your own cloud accounts and regions. We do not sell it.
- What we keep ourselves
- Only what the work needs: reports, scoping notes and our messages with you.
How we protect it
- A role you create
- We work through a role in your account. Delete it and our access ends.
- Named engineers
- Each engineer has their own identity and signs in with multi-factor authentication.
- A record you can read
- Every action is recorded in your cloud’s audit log, in your own account.
- Leavers
- An engineer who leaves loses access the same day.
Who else handles your data
- Brain Station 23
- The company Cloud 23 is part of. Its engineers do the work.
- Ticket, chat and email tools
- Where tickets and messages about your work are kept.
- Your cloud provider
- AWS, Microsoft Azure or Google Cloud, where your data sits in your own account.
If something goes wrong
- We tell you within 24 hours
- If an incident at our end affects your data, you hear from us within 24 hours.
- Then a written summary
- Service first, then the cause, and a written summary in three business days where your level includes it.
When the service ends
- Our access ends
- We remove our access to your accounts.
- We delete what we hold
- Within 30 days, apart from records the law makes us keep.
Questions about your data
They go to an engineer who can answer them. Email us or use the contact form.
These terms are a plain summary of how we work. [Legal to approve]