Data Processing Agreement

1. Definitions

“Controller” means you, the yeil customer. “Processor” means yeil. “Personal data”, “processing”, “data subject”, and “sub-processor” have the meanings given them in GDPR Article 4. “Services” means the yeil products you use (mail, DNS, team, etc.).

2. Scope and purpose

yeil processes personal data only on documented instructions from the Controller, as set out in this DPA and the underlying Terms of Service. The duration of processing is the duration of your subscription. The categories of data subjects are the users, customers, employees, and contacts whose data you choose to put into yeil. The categories of personal data are those you choose to put into yeil; typically email metadata and message content, DNS records, account profile data, and anything else covered by the Privacy Policy.

3. Processor obligations

yeil will:

• process personal data only on the Controller's documented instructions, including the instruction inherent in the Controller's use of the service;
• ensure that personnel with access to personal data are bound by confidentiality obligations;
• implement appropriate technical and organizational measures to protect personal data, including those listed in Schedule A below;
• assist the Controller in fulfilling its obligations to respond to data-subject requests (access, rectification, erasure, portability);
• notify the Controller without undue delay (within 72 hours of becoming aware) of any personal-data breach affecting the Controller's data;
• upon termination, delete or return all personal data to the Controller, except where retention is required by law.

4. Sub-processors

The Controller authorizes yeil to engage sub-processors listed in /subprocessors. yeil will give at least 30 days' notice of any new sub-processor; the Controller may object on reasonable grounds related to data protection, in which case the parties will work in good faith to resolve, including by the Controller terminating the affected service with a pro-rated refund.

5. International transfers

Personal data is processed in jurisdictions listed in /subprocessors. Where personal data is transferred outside the EEA, UK, or Switzerland, the transfer is governed by the European Commission's Standard Contractual Clauses (Module Two, controller-to-processor), incorporated into this DPA by reference, with yeil as the data importer.

6. Security measures

yeil's current technical and organizational measures include: end-to-end encryption of message bodies and snippets at rest (per-message data keys sealed to recipient public keys, master keys wrapped under password-derived KEKs); TLS-only transport for the web and IMAP/SMTPS surfaces; argon2id for password verification; passkey-based two-factor on the admin surface; access logging on privileged actions; backup retention via hypervisor snapshots; documented incident-response procedures.

7. Audit and information

yeil will make available to the Controller, on request, the information necessary to demonstrate compliance with this DPA. Once per year per Controller (or more often if required by applicable law), yeil will respond to a reasonable audit request, which may be satisfied by a written security questionnaire response, a current SOC 2 report (when available), or a remote interview, depending on the size and risk profile of the Controller.

8. Liability and term

This DPA forms part of the Terms of Service. Conflicts between this DPA and the Terms are resolved in favor of this DPA insofar as the conflict concerns personal-data processing. The DPA remains in force as long as yeil processes personal data on the Controller's behalf, plus any retention period required by law.

9. How to sign

By accepting yeil's Terms of Service through the signup or admin flow, the Controller accepts this DPA. If your internal procurement requires a counter-signed copy, write to legal@yeil.org and we will provide a signed version with the same content.