Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between the customer (the “Controller”) and ShieldFive, operated by an individual established in Spain (the “Processor”, “we”, “us”), for the customer’s use of the ShieldFive services (the “Services”). It governs the Processor’s processing of personal data on the Controller’s behalf and implements Article 28 of Regulation (EU) 2016/679 (“GDPR”). To execute this DPA for your organisation, email [email protected]; the parties’ legal details and signatures are completed on execution and these standard terms apply unchanged.

Roles & structure

For the personal data processed through the Services, the customer acts as Controller (or as processor on behalf of its own controllers) and ShieldFive acts as Processor. Because the Services are end-to-end encrypted, the Processor stores customer file content only as ciphertext and cannot read it; the personal data the Processor can actually process is limited to account and operational data described in Annex I.

1. Definitions

“Personal data”, “processing”, “controller”, “processor”, “sub-processor”, “data subject” and “personal data breach” have the meanings given in the GDPR. “Customer Personal Data” means personal data contained in the customer content and account data that the Processor processes on the Controller’s behalf under the agreement.

2. Subject matter & duration

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I. The Processor processes Customer Personal Data for the duration of the agreement and for any additional period during which the Processor is required to retain it, after which Section 11 applies.

3. Processing on documented instructions

The Processor processes Customer Personal Data only on the Controller’s documented instructions, including the instructions set out in this DPA and the agreement, and as necessary to provide and secure the Services, unless required to do otherwise by Union or Member State law — in which case the Processor informs the Controller of that legal requirement before processing, unless the law prohibits it on important grounds of public interest. The Processor promptly informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law.

4. Confidentiality

The Processor ensures that persons authorised to process Customer Personal Data are bound by an appropriate obligation of confidentiality and process the data only as instructed. The Services’ end-to-end encryption further limits which personnel could access any personal data in the first place.

5. Security of processing

The Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing. Those measures are described in Annex II and on the security page, and centre on client-side encryption so that the Processor holds customer file content only as ciphertext.

6. Sub-processors

The Controller gives the Processor general written authorisation to engage sub-processors to support the Services. The current sub-processors are listed publicly in Annex III. The Processor imposes on each sub-processor, by contract, data protection obligations equivalent to those in this DPA, and remains fully liable to the Controller for a sub-processor’s performance. The Processor will give the Controller reasonable prior notice of the addition or replacement of a sub-processor and an opportunity to object on reasonable data protection grounds.

7. International transfers

Customer Personal Data is primarily processed in the European Economic Area: the database is hosted in Frankfurt and encrypted file objects are stored in Amsterdam. Where a sub-processor processes personal data outside the EEA, that transfer is carried out under the European Commission’s Standard Contractual Clauses (2021), Module Two (controller-to-processor), or an equivalent approved mechanism, supplemented by an adequacy decision (such as the EU–US Data Privacy Framework) where the recipient is certified. Because file content leaves the customer’s device already encrypted, any such transfer of file content is a transfer of ciphertext only.

8. Assistance to the controller

Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller’s obligations to respond to data subject requests (access, rectification, erasure, restriction, portability and objection). The Processor also assists the Controller, taking into account the information available to it, with security of processing, personal data breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR.

9. Personal data breaches

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provides the Controller with the information reasonably necessary to meet its own notification obligations under Articles 33 and 34 GDPR.

10. Audits & information

The Processor makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR and contributes to audits, including inspections, conducted by the Controller or an auditor it mandates. The Processor may satisfy this obligation by providing its security documentation and responding to reasonable written questionnaires, and by permitting an on-site audit no more than once per year (or following a personal data breach) on reasonable prior notice and subject to confidentiality.

11. Return & deletion

On termination of the Services, and at the Controller’s choice, the Processor deletes or returns Customer Personal Data and deletes existing copies, unless retention is required by Union or Member State law. The Controller can export its data before termination and can delete its account at any time. Because file content is stored only as ciphertext that the Processor cannot decrypt, deletion of the customer’s keys renders any residual ciphertext permanently unreadable.

12. Liability & order of precedence

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the agreement. In the event of a conflict between this DPA and the Terms of Service on the subject of the processing of personal data, this DPA prevails.

13. Governing law

This DPA is governed by the laws of Spain and, where applicable, the GDPR, consistent with the governing-law provisions of the Terms of Service.

Annex I — Details of processing

Annex II — Technical & organisational measures

• Client-side (end-to-end) encryption. Files are encrypted on the user’s device before upload with AES-256-GCM; the server receives and stores only ciphertext and never receives plaintext or encryption keys.
• Key derivation. Vault keys are derived from the user’s password with Argon2id; per-file content keys are unique.
• Post-quantum key exchange. Sharing uses a hybrid classical + ML-KEM key encapsulation so shared-file keys remain protected against future quantum attacks.
• Encryption in transit. All connections use TLS; encrypted objects are uploaded directly to storage via short-lived pre-signed URLs.
• EU data residency. The database is hosted in Frankfurt and encrypted file objects are stored in Amsterdam.
• Access control. Row-level security isolates each tenant’s data; administrative access is least-privilege, and multi-factor authentication is available and enforced for sensitive operations.
• Resilience & backup. Encrypted, off-account database backups are held in a separate storage account under an independent credential, with periodic restore testing.
• Monitoring. Security telemetry and anomaly monitoring on authentication and share-link flows, with abuse mitigation on sign-up and sharing.

Annex III — Sub-processors

The following sub-processors process personal data to support the Services. This list is maintained publicly so business customers can review it before signing; it was last reviewed on 21 July 2026.

Third-party services on public tool pages

These are not sub-processorsand process nothing under this DPA: they never touch customer account data, encrypted files, or metadata, and they are not engaged on ShieldFive’s instructions. They are listed here so that the enumeration of recipients is complete. The free breach checker at /tools/breach-checker is a public marketing-site tool with no sign-in; it queries these services directly from the visitor’s browser, and only after the visitor gives explicit consent on the page. ShieldFive operates no server in that path and neither receives nor stores what the visitor submits.

To request notice of sub-processor changes, or to execute this DPA for your organisation, contact [email protected].