Data processing terms (DPA)

Version 2026-11-03. Last updated 2 November 2026.

These terms apply when Cloud Adept Limited (company number 09216333, registered office Hazlemere, 70 Chorley New Road, Bolton, Lancashire, BL1 4BY, United Kingdom; "we", the processor) processes personal data on behalf of an organisation using Strays ("you", the controller). They're the contract required by Article 28 of the UK GDPR, and form part of our terms of service: the person who creates your organisation accepts both, and we record the version, who and when. If these terms and the terms of service conflict about personal data, these terms win.

1. What we process

• Subject matter and purpose: providing Strays: scanning your AWS accounts, finding who owns resources, reporting findings, messaging owners, leaver reports, access reviews, evidence packs, and the other features you use.
• Nature of the processing: reading (through the read-only role you install), storing, organising, analysing and showing data, and sending messages and tickets you ask for.
• Personal data: names, email addresses and IAM user names found in your AWS accounts (resource tags, CloudTrail event history, IAM, including when people last signed in or used access keys); your team members' names, emails, roles and their decisions in Strays; Slack user IDs and replies to Strays' messages; the address of a Teams channel webhook and the credentials of a Jira or Linear connection (both stored encrypted); the text of tickets you create (finding details, resource names and owner emails); directory users' email addresses and status (active, suspended or removed), if you connect a directory.
• Special category data: none is needed, and you shouldn't put any in AWS tags or names.
• Data subjects: your staff, contractors and others who work in your AWS accounts or are in a directory you connect.
• Duration: while your organisation exists in Strays, then deletion as in section 2.7.

2. Our commitments

1. We process the data only on your documented instructions (these terms, the terms of service and your use and settings of Strays), including for transfers outside the UK, unless the law requires otherwise, in which case we'll tell you first if we're allowed to. We'll tell you straight away if we think an instruction breaks data protection law.
2. Everyone we allow to process the data is bound by confidentiality.
3. We keep it secure with appropriate technical and organisational measures, described in section 5 and on our security page, and keep them up to date.
4. You give us general authorisation to use the sub-processors in section 3. Each is bound by written terms that protect the data at least as well as these, and we're responsible to you for what they do. We'll email your admins at least 30 days before adding or replacing one; you can object on reasonable data protection grounds, and if we can't resolve it, you can cancel with a pro-rata refund.
5. We'll help you respond to people exercising their rights (much of it you can do yourself: Settings → Your data downloads everything), and with security, breach notifications, data protection impact assessments and consultations with the ICO, as far as is reasonable given what we process. If someone asks us directly about data we process for you, we'll pass the request to you rather than answer it ourselves.
6. We'll tell you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data, with what we know then and more as we learn it.
7. When your organisation is deleted, by an admin in Settings or by us within 30 days of your written request, we delete the data: straight away from the live service, from file storage within 30 days and from database backups within 35, unless the law requires us to keep it. Before then you can download it from Settings → Your data.
8. We'll give you the information you reasonably need to show compliance with Article 28, and answer reasonable audit questionnaires once a year, or after a breach. If that isn't enough, we'll allow and contribute to an audit, including an inspection, by you or an independent auditor you choose who is bound by confidentiality, on 30 days' notice, during working hours, at your cost, at most once a year unless a regulator requires it or after a breach.

3. Sub-processors

Stripe processes payment details for our own billing, as our processor and an independent controller under its own terms; it doesn't receive the data in section 1.

4. Services you connect

If you connect Slack, Microsoft Teams, Microsoft 365, Jira Cloud or Linear, Strays sends data to (or reads it from) your own account with that provider, on your instruction: owner messages and button replies in Slack, channel messages in Teams, tickets in Jira or Linear, and users' status from your directory. Those providers process the data as your providers, under your agreement with them (and their own transfer safeguards), not as our sub-processors. You can disconnect any of them in Settings.

5. Security measures

• Hosting in AWS London; encryption at rest with AWS KMS and in transit with TLS 1.2 or later; Slack, Microsoft, Jira and Linear credentials encrypted again with a key bound to your organisation.
• Each organisation's data kept apart and reached only through the signed-in user's organisation; tests try to reach one organisation's data from another before each release.
• Sign-in with MFA for every user; access to production limited to named staff with MFA; changes staff make in our operator console logged.
• A web application firewall, automated tests, code and dependency scanning, and penetration testing of new features before release.
• Point-in-time database backups (35 days) and versioned file storage.

6. International transfers

We host Strays in the UK. We transfer personal data outside the UK only as set out in section 3, with the safeguards shown there; if a safeguard stops being available, we'll use another lawful one or stop the transfer.

7. Liability

The limits of liability in our terms of service apply to these terms too, except where the law doesn't allow it.

8. Contact

Privacy questions and requests: support@getstrays.com.