Data Processing Addendum

Roles

• For personal data in your managed tenants, you (the MSP) are the controller (or processor for your end-customers) and rugged.sh, operated by Rugged Technology Services, is your processor. We process that data only on your documented instructions.
• For your own MSP account data, we act as controller for the limited purpose of providing, securing, and billing the service.

Scope of processing

• Subject matter: providing the rugged.sh control plane. Duration: for the term of your agreement plus any legally required retention.
• Nature and purpose: deploying, governing, and optimizing Microsoft cloud across your customer tenants on your instruction.
• Data subjects and data types: your team members and your end-customers' directory users; identifiers, role and configuration data, and operational metadata. We do not process special-category data for these purposes.

Our commitments

• Confidentiality: personnel with access are bound by confidentiality obligations.
• Security: we apply technical and organizational measures appropriate to the risk, including hard tenant isolation, encryption of secrets in Azure Key Vault, least-privilege app-only access, and an audit trail.
• Assistance: we help you respond to data-subject requests and to meet your security, breach-notification, and impact-assessment obligations.

Sub-processors

We engage a limited set of sub-processors to deliver the service. Each is bound by data-protection terms consistent with this addendum:

• Microsoft Azure: infrastructure, managed PostgreSQL hosting and backup, secret management, and the Microsoft cloud platform your tenants run on. Control-plane data resides in Canada Central and its backups do not leave the Azure tenant.
• Stripe: payment processing and tax calculation, limited to billing contact details, billing address, and tax identifiers.
• Cloudflare: content delivery, DNS, edge security, and outbound transactional email.
• We maintain a current sub-processor list and give reasonable prior notice of additions or replacements so you can object. We do not currently use any AI or machine-learning sub-processor: the optional AI assistant features are disabled in production and send nothing to a model provider.

Audits and records

• We maintain records of the processing we carry out on your behalf and make available the information reasonably necessary to demonstrate compliance with this addendum.
• Where you require an audit beyond that documentation, we will make reasonable information available on request, no more than once every 12 months absent a legal or regulatory requirement to do so more often, under confidentiality and in a way that does not disrupt the security of other customers.

International transfers, breach, deletion

• Where personal data is transferred across borders, we rely on a lawful transfer mechanism recognized under applicable data protection law, such as Standard Contractual Clauses, which are incorporated into this addendum by reference and apply automatically where required.
• We will notify you without undue delay after becoming aware of a personal-data breach affecting your data.
• On termination, after the 90-day recovery window described in the Terms, we delete or return your personal data from live systems, subject to legally required retention. Encrypted backups are not edited in place: they expire on their own schedule, within 35 days for point-in-time backups and within three months for weekly backups held in a geo-redundant vault. Until they expire they are not used for any purpose other than disaster recovery.