Article 28 terms for when we process on your behalf
Data processing agreement
The processor terms governing runnerhut's handling of personal data contained in your repositories, logs and build artefacts.
Updated 2026-08-14
This DPA forms part of the agreement between you (controller) and us (processor) and applies whenever we process personal data on your behalf. It is accepted at signup; no negotiation is required for standard terms.
Subject matter and duration
We process personal data only to provide the managed runner service, for the duration of the agreement plus the retention periods stated in the Privacy Policy.
Nature of the processing
| Category | Examples | Source |
|---|---|---|
| Repository content | Whatever personal data your code or fixtures contain | Your repository |
| Commit metadata | Author names and email addresses | Git history |
| Job output | Anything your build prints to logs | Your workflow |
| Account data | Names, emails, identity provider subjects | You |
Our obligations
- Process only on your documented instructions
- Bind personnel with access to confidentiality obligations
- Implement the technical and organisational measures listed below
- Engage sub-processors only under equivalent terms, with 30 days' notice of change and a right to object
- Assist with data subject requests, DPIAs and regulator engagement
- Notify you without undue delay of a personal data breach
- Delete or return personal data at the end of the agreement
- Make available the information needed to demonstrate compliance, and permit audits
Technical and organisational measures
- One job, one microVM with its own kernel; destroyed and cryptographically wiped at job end
- Encryption in transit and at rest; cache objects scoped per repository
- SSO with SCIM, least-privilege internal access, append-only audit logging
- SOC 2 Type 2 audited annually; annual third-party penetration test
- Regional pinning covering compute, cache, logs, metrics and support access
International transfers
On EU-pinned deployments there is no third-country transfer. Otherwise transfers rely on Standard Contractual Clauses with a documented transfer impact assessment.
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.