Data processing agreement

Who is who

This agreement applies where Passbeam Ltd (company number 17485165) (“Passbeam”) processes personal data on your behalf. If you use Passbeam to run networks for your own customers, you are the controller of those people’s personal data and Passbeam is your processor.

For your own account, including the people you invite, your billing details and how you use the product, Passbeam is the controller. The privacy policy covers that.

This agreement is written to meet Article 28 of the UK GDPR. Terms defined there have the same meaning here.

What is processed, and why

Subject matter and purpose. Deciding whether a device or person may join a network you control, issuing and revoking the certificates used for that, and keeping a record of each decision.

Duration. For as long as your account is open, and then as set out under “When it ends” below.

Categories of data subject. Your staff and the people you invite into your account. Where you manage networks for others, also the users and device owners in those organisations’ directories.

Types of personal data. Directory identifiers, such as a user principal name or Entra object ID. Device identifiers, such as a device ID, hostname or MAC address. Certificate subjects and their status. Authentication and enrolment records: who or what tried to connect, when, at which site, the result and the reason. The audit trail of administrative actions. Support conversations and their attachments. Account details for the people you invite.

No special category data is needed by the service or asked for. Passbeam does not keep a copy of your directory; it reads it when a decision is needed. It never holds a device’s private key.

Our obligations

We process personal data only on your documented instructions, unless the law requires otherwise. The settings you choose in the product form part of those instructions. If the law requires us to act differently, we will tell you first unless the law forbids that.

Everyone with access is bound by a duty of confidentiality. We do not use your data, or your customers’ data, to train any model, and we do not sell it or share it for advertising.

We will help you, taking into account the nature of the processing, to respond to people exercising their rights, and to meet your obligations on security, breach notification and data protection impact assessments.

Breach notification. If we become aware of a personal data breach affecting your data, we will tell you without undue delay. We will give you what we know: what happened, which data and roughly how many people are affected, the likely consequences, and what we are doing about it.

Security

We protect the data we process with these measures:

• Tenant isolation is enforced in the data layer. The tenant filter is applied automatically to every read of customer data, and is covered by its own tests.
• Credentials are encrypted at rest, with the key held separately from the database.
• Certificate authority keys are encrypted in the same way. Device private keys are never sent to Passbeam.
• Sign-in to your account supports multi-factor authentication by authenticator app or passkey, and Microsoft sign-in. Permissions are role-based. Sessions expire after twelve hours of inactivity and can be revoked.
• An audit trail records administrative actions, such as revoking a certificate, rotating a credential, or inviting or removing a person. It is designed to resist alteration.
• Backups are encrypted and kept in the United Kingdom. Restores are tested on a schedule.
• Web traffic is encrypted in transit. RadSec connections between your network equipment and Passbeam use mutual TLS.

Sub-processors

You give general authorisation for the sub-processors below. We will give you notice before adding or replacing one, and you may object on reasonable data protection grounds. If you object, you may stop using the service and delete your account, which deletes the data it holds.

• Cloudflare: delivery and protection of the website and application, spam protection on the contact form, and routing of inbound support email. Request metadata, including IP addresses, passes through it.
• IONOS: server hosting in the United Kingdom.
• Amazon Web Services: hosting and email delivery in the United Kingdom.

Microsoft is not a sub-processor. When Passbeam reads your directory or checks a device, it does so in your tenant, with permissions you granted and can withdraw. That is your relationship with Microsoft.

Nor is GoCardless, which collects Passbeam’s Direct Debits. The billing data it handles is about you as our customer. We hold that data as controller under the privacy policy.

Where the data is

All processing and storage, including backups, is in the United Kingdom. We do not transfer personal data outside the UK. If that changes, we will tell you in advance and put an appropriate transfer mechanism in place before any transfer.

Audits and information

We will make available the information reasonably needed to show compliance with this agreement, and will contribute to audits carried out by you or an auditor you appoint. To ask, open a support ticket. We may ask you to cover the reasonable cost of an on-site audit.

Passbeam is registered with the Information Commissioner’s Office under registration number ZC262269.

When it ends

You can delete your account at any time. Doing so deletes the personal data it holds, including clients, certificate authorities and their keys, sites, logs and support history, and we keep no copy. Encrypted backups already taken are deleted within fourteen days.

If you want a copy of your data, ask before you delete your account. Once it is deleted, we cannot recover it.

Liability and law

Our liability under this agreement is subject to the limits in the terms of service, except where the UK GDPR provides otherwise. This agreement is governed by the law of England and Wales.