Data processing agreement

When Mule hosts or maintains a system for a client, the client is the controller of the personal data in it and Mule is the processor. The Data Processing Agreement (DPA) signed with every client sets out how Mule handles that data under the GDPR (Article 28) and US state privacy laws. This page is a public summary. The signed DPA governs; clients can download it from the Portal or ask at juastins@icloud.com.

1. Roles

• Client data in a system Mule runs belongs to the client. Mule processes it only on the client's documented instructions.
• Mule is an independent controller only for its own account, billing and Portal records, its marketing contacts and the security logs it needs to protect its services. The Privacy Notice covers those.

2. What Mule commits to

1. Process personal data only on the client's instructions, and say so if an instruction appears to break data protection law.
2. Bind everyone with access to confidentiality.
3. Apply the security measures listed below.
4. Use only the sub-processors on our public list, with 30 days' notice before any change and a right for the client to object.
5. Help the client answer data subject requests, carry out impact assessments and handle breaches.
6. Notify the client of a personal data breach without undue delay, and within 48 hours of becoming aware of it.
7. Answer reasonable security questions once a year at no charge, and allow an audit where that is not enough.
8. At the end, return or delete the data at the client's choice, under the Exit and Transition Plan.

3. International transfers

Mule is established in the United States, and some staff and sub-processors are outside the EEA. Transfers from the EEA use the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914, Module 2, and Module 3 where the client is itself a processor), or the EU-US Data Privacy Framework where the recipient is certified. Hosting can be set to the EU or the US per system.

4. Security measures (summary)

• Multi-factor authentication for all Mule staff, least-privilege roles, production access logged.
• TLS 1.2 or higher in transit; encryption at rest; secrets kept out of code.
• Full-disk encryption and automatic lock on staff laptops.
• Each client isolated in its own database or schema, with row-level security; separate production and staging.
• Daily encrypted backups, with a restore tested at least every 6 months.
• Code review, dependency and secret scanning; no unmasked production personal data in development.
• AI services only under commercial terms that forbid training on client data.

5. Device data and the EU Data Act

Where a system includes a connected product such as the Mule tag, the client, as the user, can access and export the product data and related service data its use generates, free of charge and in a machine-readable format. Mule uses non-personal device data only to provide, secure and improve the service, and in aggregated form that does not identify the client, its sites or its animals. On the client's request Mule shares the data with a third party the client names, as the Data Act provides.

6. Ownership and exit

On completion and full payment, the client owns the project. Exports in open formats are available at any time and are never blocked, including during a suspension for unpaid invoices.