Data Processing Agreement

Effective 18 October 2026

The short version

This agreement under Art. 28 GDPR applies automatically to every Turm account. There is nothing to sign.
For personal data in your VMs you are the controller; we are the processor and act only on your instructions.
VM disks stay on the servers in Falkenstein. Payments, email and DNS go to the sub-processors, and some of those are outside Germany. We tell you 30 days before adding a sub-processor, and you can object.
We notify you of a personal data breach without undue delay and delete your data when you delete it or leave.

1. Parties and scope

This Data Processing Agreement ("DPA") is between you, the customer ("controller"), and [legal name], [registered address] ("processor", "we"). It forms part of the Terms of Service and applies whenever we process personal data on your behalf while providing Turm. Where this DPA and the Terms conflict on data protection, this DPA prevails.

2. Subject matter, duration, nature and purpose

We provide virtual machines, their storage and network connectivity, and an optional model gateway. We store, replicate, transmit and delete the data you and your agents place on the service, for the purpose of providing it to you. This DPA lasts as long as we process personal data for you under the Terms. The details are in Annex 1.

3. Your instructions

We process personal data only on your documented instructions, including for transfers to third countries, unless EU or member state law requires otherwise; in that case we tell you first unless the law forbids it. The Terms, this DPA, and the commands you run through the CLI, API, MCP endpoint or dashboard are your instructions. We tell you if we believe an instruction breaks data protection law.

4. Confidentiality

Everyone we authorise to process your personal data is bound to confidentiality by contract or by law, and has access only as far as their task needs.

5. Security

We implement the technical and organisational measures in Annex 2, appropriate to the risk under Art. 32 GDPR. We may improve them over time, but we will not lower the overall level of protection. You are responsible for securing what runs inside your VMs, for example the software you install, its configuration and its access keys.

6. Sub-processors

You authorise us to use the sub-processors on our sub-processor list. We bind each by contract to data protection obligations equivalent to this DPA and remain responsible for them. We tell you by email at least 30 days before we add or replace a sub-processor. You may object on reasonable data protection grounds within that period. If we cannot address the objection, you may terminate the affected service before the change takes effect, and we refund fees paid in advance for the time after termination.

7. Transfers outside the EU

Your VMs and their disks stay in Germany. Where a sub-processor may process personal data outside the European Economic Area, we make sure an adequacy decision or the European Commission's Standard Contractual Clauses cover the transfer.

8. Assistance

Taking into account the nature of the processing, we help you respond to requests from data subjects and meet your obligations under Art. 32 to 36 GDPR (security, breach notification, impact assessments, prior consultation). Most requests about data in your VMs you can handle yourself, because you have full control of them. If a data subject contacts us directly about your data, we refer them to you.

9. Personal data breaches

We notify you without undue delay after becoming aware of a personal data breach affecting your data. The notice describes, as far as we know at the time, what happened, the categories and approximate number of data subjects and records concerned, the likely consequences, and what we have done or propose to do. We add information as we learn it.

10. Deletion and return

You can copy your data off your VMs at any time with standard tools such as scp or rsync. Do that before access ends. After the terms end you cannot reach the VMs. When you delete a VM, we delete its disk, its replica and its console log. When the terms end, we delete the remaining VMs and the personal data in the account, unless the law requires us to keep it. Weekday database dumps that still contain it are overwritten within 7 days.

11. Audits

We make available the information needed to demonstrate compliance with Art. 28 GDPR. You may audit us, or have an independent auditor bound to confidentiality do so, once a year or after a personal data breach, with 30 days' notice, during business hours and without disrupting other customers. Each party bears its own costs. Where an independent audit report covers the question, such as a SOC 2 report once available, we may provide it instead.

12. Liability and term

Liability under this DPA follows the liability section of the Terms; Art. 82 GDPR is unaffected. This DPA ends when we no longer process personal data for you. Clauses on deletion and confidentiality survive.

Annex 1: Details of the processing

Controller: The customer named in the account.
Processor: [legal name], [registered address], hi@turm.dev.
Data subjects: Determined by you; typically your users, customers, employees and contacts whose data you or your agents store or process on your VMs.
Categories of personal data: Determined by you; any personal data in files, databases, prompts and traffic on your VMs. You should not store special categories of data (Art. 9 GDPR) unless you have assessed that the measures in Annex 2 are adequate for them.
Nature of processing: Storage, replication, transmission over the network, forwarding of model requests through the gateway if you use it, and deletion.
Frequency: Continuous, for as long as you use the service.
Location: Hetzner data centre in Falkenstein, Germany.

Annex 2: Technical and organisational measures

Isolation. Every VM is a separate KVM virtual machine with its own kernel and disk. Network rules on the host stop VMs from reaching each other and from sending traffic with another VM's address.
Encryption in transit. Web traffic uses TLS 1.2 or later with certificates from Let's Encrypt, and plain HTTP is redirected to HTTPS. Shell access uses SSH.
Encryption of secrets. Credentials you store for integrations are encrypted with AES-256-GCM before they reach the database.
Access control for customers. Sign-in with SSH keys or email links. Session IDs and login links are stored only as SHA-256 hashes. Session cookies are host-only, HttpOnly, Secure and SameSite, and are removed before requests reach your VM. VM web addresses are private to the owner unless you share them.
Administrative access. Servers accept administrator logins only by SSH key, on a non-standard port, behind a host firewall and with brute-force blocking. Host packages receive automatic security updates.
Availability. Disks are mirrored across two NVMe drives. Each VM disk is replicated to a point-in-time copy every few seconds, and the database is dumped daily.
Abuse prevention. Outbound mail ports are blocked for all VMs. Crypto-mining detection throttles the CPU of the whole pool, not one VM.
Incident response. Monitoring alerts, a written incident runbook and a public status page.
Deletion. Deleting a VM removes its disk, replica and console log.

Disks are not encrypted at rest by us. If you need that, encrypt data inside your VM.

Annex 3: Sub-processors

See the sub-processor list.