DPA, sub-processors, and what a runner actually processes
GDPR and your CI pipeline
The data processing agreement, the published sub-processor list, and an honest account of what personal data passes through a build runner.
Most teams assume CI is out of GDPR scope because a build is not a customer database. That is usually wrong in at least two places: commit metadata contains developer names and email addresses, and test fixtures very often contain production-shaped personal data that someone copied years ago.
The roles
You are the controller. runnerhut is the processor, acting on your documented instructions under a data processing agreement concluded per Article 28. The DPA is available at signup and does not require negotiation for standard terms.
What we process
- Repository content, including whatever personal data your repository happens to contain
- Commit metadata — author names and email addresses
- Account data for your own users: name, email, identity provider subject
- Job telemetry: durations, exit codes, resource utilisation
Sub-processors
- The full list, with location and purpose, is published and versioned
- Changes come with 30 days' notice and a right to object
- On EU-pinned deployments, every sub-processor with access to build data is EU-established
Sources
- Regulation (EU) 2016/679 (GDPR), Article 28 — https://eur-lex.europa.eu/eli/reg/2016/679/oj
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.