Data processing agreement

1. Parties and subject matter

The controller is the customer. The processor is Digitalgurus (Carsten Urbanski), Kettelerstr. 42, 76863 Herxheim (the “provider”).

The provider stores and processes for the customer the content that the customer, their staff and their agents place in COMPASS, and makes it available through the web interface, the programming interface and the tool server for agents. The provider pursues no other purposes with this data.

This agreement runs for as long as the contract for the use of COMPASS.

2. Type of data and data subjects

What the customer places in COMPASS is for the customer to decide. Experience shows this to be:

• Data: names, business contact details and roles; free text in rules, decisions, facts, lessons, messages, questions, documents (including earlier versions), processes, subjects, evidence records and contradictions, which may contain details about people; uploaded images; usage data (who accessed which area when, and with which program).
• Data subjects: the customer’s staff; people about whom the customer stores knowledge, for example their customers, clients or business partners.

Special categories under Art. 9 GDPR are expressly covered by this agreement — including health data. The customer may process them in COMPASS; they need their own legal basis for doing so (for example the consent of the data subject, or Art. 9(2)(h) GDPR) and inform the provider beforehand, so that the provider sets the level of protection accordingly.

The provider takes no additional measures for this data beyond Annex 1.

3. Instructions

The provider processes the data only on documented instructions from the customer. Using COMPASS through its interfaces counts as such an instruction. If the provider considers an instruction unlawful, it says so to the customer without delay.

4. Confidentiality

Anyone at the provider with access to the data is bound to confidentiality. Measured on 08.10.2026, one person has access to the server and therefore to the database: the owner himself. There are no further employees with access. If a further person receives access, the provider binds them to confidentiality in writing beforehand and names them here.

5. Security

The provider takes the technical and organisational measures under Art. 32 GDPR that are described in Annex 1. It may develop them further as long as the level of protection does not fall.

6. Sub-processors

The customer agrees to the sub-processors in Annex 2. The provider announces a new or replaced sub-processor at least four weeks in advance. The customer may object for an important data-protection reason; either party may then terminate the agreement.

The provider binds every sub-processor contractually to the same obligations. For a transfer to a country outside the EU it ensures a basis under Art. 44 et seq. GDPR.

7. No training of AI models

The provider does not use the customer’s data to train AI models, and does not permit any sub-processor to do so either.

8. Rights of data subjects

The provider supports the customer in answering requests from data subjects (access, rectification, erasure, restriction, portability, objection). If such a request reaches the provider, it forwards it to the customer.

The customer can export their content themselves at any time and can end or supersede statements. Erasure under Art. 17 GDPR: The provider carries out an erasure request within 30 days of receipt; where a request is particularly complex, the period is extended by up to two further months, and the provider informs the customer of this with reasons. Requests go by email to office@athron.io. COMPASS does not delete rows; it makes the details about the person unrecognisable: the entry is replaced by a pseudonym and can no longer be attributed to a person, the statement itself remains readable, and the operation is logged. A limit, stated explicitly: the running audit trail is only ever appended to and never rewritten. It holds earlier versions of changed rows and therefore also retains earlier details about people. It is readable by the provider alone — not by other customers and not through the application.

9. Support with further obligations

The provider supports the customer with security, notification of data breaches, data protection impact assessment and prior consultation (Art. 32 to 36 GDPR), so far as it is able to with the means of COMPASS.

If the provider learns of a breach of the protection of the customer’s data, it notifies the customer without delay, at the latest within 24 hours of becoming aware of it — so that the customer can meet their own 72-hour deadline under Art. 33 GDPR — with the details the customer needs for their own notification.

10. End of the processing

After the end of the contract the customer can export their data for a further 30 days. 90 days after the end of the contract the provider deletes it and confirms this in writing on request. Backups keep it longer: on the server in up to 14 daily copies, in the encrypted off-site copy, depending on age, in up to 14 daily, 8 weekly and 12 monthly states. At the latest 13 months after the deletion it is removed there as well. Any statutory retention obligation remains unaffected.

This does not happen automatically today: an account whose contract ends falls back to the Free tier. The provider carries out the deletion manually.

11. Evidence and audits

The provider makes available to the customer the information necessary to demonstrate these obligations, and allows audits by the customer or an auditor appointed by them, with at least four weeks’ notice. One audit per calendar year is free of charge for the customer; for each further audit the provider may charge for the effort. Where there is a specific cause — for example a data breach — no waiting period applies and no limit to one audit.

Annex 1 · Technical and organisational measures

• Separation of customers: every data table containing customer data carries the customer’s identifier. The database itself allows every access only to that customer’s rows (row-level security). The application works with a database role that cannot bypass this protection.
• Access: passwords of at least 12 characters, stored as PBKDF2-HMAC-SHA256 with 260,000 iterations and an individual salt. Access keys, invitation, confirmation and session identifiers only as a SHA-256 digest. Repeated failed attempts are throttled per email address and per IP address.
• Roles: owner, administrator, member, read only. Changes to memberships and interventions by the operator are logged and cannot be deleted.
• Traceability: every statement carries who, or which agent, created it. Read accesses are counted per day.
• Integrity: statements are not overwritten; every change is a new version with a reference to the old one.
• Availability: daily backup of the database, encrypted (AES-256-CBC, key derived from a passphrase), as is the additional backup before every rollout; the 14 most recent daily copies are kept on the server. Every night the most recent encrypted copy goes off-site to separate storage at Hetzner in the EU (Storage Box) and is read back there. Restoring is rehearsed monthly: loading into an empty database and checking row by row against the count.
  Measured on 28.10.2026: no unencrypted copy on the server; off-site copy last successful on 28.10.2026; last restore rehearsal on 25.10.2026, 594 of 594 checks passed.
• Transmission: the connection to the browser is encrypted (TLS). Measured on 08.10.2026: for compass.athron.io the encryption terminates on the server itself, in its own web server, with a certificate from Let’s Encrypt; HSTS is set. For the website athron.io, by contrast, it terminates at Cloudflare, which sits in front of it as an intermediary. Email is sent encrypted (STARTTLS) through Google’s service. Secrets for webhooks are stored encrypted.
• Database: not reachable from the internet.

Physical access: the server is located in the Nuremberg data centre of Hetzner Online GmbH; their evidence applies to physical access and building security.

Server logs: measured on 08.10.2026, the web server’s logs are kept in a rotation limited by size (at most five segments of 50 MB each), and are not deleted after a period; for the application’s logs no limit is set.

Regular review (Art. 32(1)(d)): A procedure with a fixed interval for this review has not been established.

Annex 2 · Sub-processors

Google is not a sub-processor for signing in: when signing in with Google, COMPASS receives from Google only the name and email address of the person signing in. Targets for webhooks are chosen by the customer; they are the customer’s recipients, not the provider’s.

Status

In force since 15.10.2026. The German version is authoritative.