Data processing agreement

Last updated: 18.10.2026

This Data Processing Agreement ("DPA") is between Vallic d.o.o., Josipa Jurja Strossmayera 341, 31000 Osijek, Croatia, registered under number 080946850, OIB 13852023036, VAT number HR13852023036 ("Vallic", the processor), and the organization that uses a team on the hosted MorphGate sync service (the "Customer", the controller). It meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

This DPA forms part of the Terms of Use (the "Agreement"). It applies from the moment a team is created, including during its free trial, for as long as Vallic processes personal data for the Customer. The Team's owner accepts it on the Customer's behalf by accepting the Terms; no signature is needed. A Customer that needs a signed copy can ask for one at sync@morphgate.com.

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given in the GDPR. In addition:

Customer Personal Data: Personal data that Vallic processes on the Customer's behalf in providing a team on the Service, as described in Annex 1.
Service: The hosted MorphGate sync service as described in the Agreement.
Sub-processor: A third party that Vallic engages to process Customer Personal Data.
Team: An organization on the Service, with its owner, admins and members.

2. Roles and scope

The Customer is the controller of Customer Personal Data, and Vallic processes it as the Customer's processor. If the Customer itself acts as a processor for another controller, Vallic acts as its sub-processor, and the Customer is responsible for passing on the relevant instructions.
Each member of a Team also has their own MorphGate account, with an email address, devices and a personal vault. Vallic processes that account data as a controller under its Privacy Policy, not under this DPA. Billing data for the Team's plan, and the website, are also covered by the Privacy Policy.

3. Subject matter, duration, nature and purpose

Subject matter: Hosting and syncing the Team's end-to-end encrypted vaults, and running the Team features: membership and invites, vault access, policies, the activity log and, on the Business plan, single sign-on, SCIM provisioning, device approval, team session logs and the audit stream.
Duration: The term of the Agreement, and afterwards until the data is deleted under section 11.
Nature: Storage, transmission, synchronization, access control, logging, delivery to endpoints the Customer configures, backup and deletion. Most of the data is ciphertext that Vallic cannot decrypt.
Purpose: Providing the Service to the Customer under the Agreement and the Customer's documented instructions.

Annex 1 lists the categories of data subjects and personal data.

4. The Customer's instructions

The Agreement, this DPA and the Customer's configuration and use of the Service are the Customer's documented instructions. This includes invites, removals, roles, vault access, policies, retention settings, single sign-on and provisioning settings, audit stream endpoints and the deletion of vaults or of the Team.
The Customer may give further instructions in writing. Vallic follows them if they are reasonable and consistent with the Agreement.
Vallic will tell the Customer without delay if it believes an instruction breaches the GDPR or other data protection law.

5. The Customer's obligations

The Customer is responsible for having a legal basis for the processing and for informing the Team's members and other data subjects.
The Customer decides what goes into its encrypted vaults and session logs, and is responsible for that content. Vallic cannot see it.
The Customer should not put special categories of personal data into fields that Vallic can read, such as the Team name or device names.
The Customer is responsible for managing access: inviting only authorized people, removing them promptly, rotating vault keys after removals (the app shows when this is due) and setting policies such as required two-step verification, single sign-on and device approval as it needs.
Identity providers, provisioning clients and audit stream endpoints are chosen and run by the Customer. Data that flows to them at the Customer's instruction is the Customer's responsibility.

6. Vallic's obligations

Vallic will:

process Customer Personal Data only on the Customer's documented instructions, including for transfers outside the EEA, unless EU or Member State law requires otherwise; in that case Vallic will tell the Customer first, unless that law forbids it;
ensure that everyone it authorizes to process Customer Personal Data is bound by confidentiality;
take the technical and organizational measures described in Annex 2 (Article 32 GDPR), and keep them at least at that level during the term;
engage sub-processors only as set out in section 7;
help the Customer respond to data subject requests (section 8);
help the Customer meet its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to Vallic;
delete or return Customer Personal Data at the end of the Service (section 11);
make available the information needed to show compliance with Article 28 GDPR and allow audits (section 12);
keep a record of processing activities as required by Article 30(2) GDPR.

7. Sub-processors

The Customer gives Vallic general authorization to engage the sub-processors listed in Annex 3.
Vallic will tell the Customer at least 30 days before it adds or replaces a sub-processor, by email to the Team's owner and by updating Annex 3 on this page.
The Customer may object on reasonable data protection grounds within 14 days of the notice. The parties will then discuss it in good faith. If they cannot resolve the objection, the Customer may terminate the affected part of the Service before the change takes effect and receive a refund of prepaid fees for the remaining period.
Vallic imposes on each sub-processor, by written contract, data protection obligations that offer at least the same protection as this DPA. Vallic remains responsible to the Customer for its sub-processors.
The hosting platform, Vallic Cloud, is operated by Vallic itself and is therefore not a sub-processor. The infrastructure providers it relies on are listed in Annex 3.
Services the Customer connects, such as its identity provider, provisioning client or audit stream endpoint, are not Vallic's sub-processors.

8. Data subject requests

The Service lets the Customer handle most requests itself. Owners and admins can see and remove members, cancel invites and download the Team's activity log (CSV or JSON Lines). Each member can download their own account data, including their Team memberships and activity, from their account page. Members with access to a vault can export its contents from the app.
Vallic cannot decrypt vault contents or session logs, so it cannot provide or correct them. The Customer obtains them through the app.
If Vallic receives a request about Customer Personal Data directly, it will pass it to the Customer without undue delay and will not answer it itself, unless the Customer asks it to or the request concerns data Vallic holds as a controller.
Where the Customer cannot handle a request with the Service's tools, Vallic will help within a reasonable time.

9. Personal data breaches

Vallic will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice goes to the Team's owner by email, and to any security contact the Customer has given Vallic in writing.
The notice will describe, as far as known at the time: the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Vallic will send further information as it becomes available.
Vallic will take reasonable steps to contain the breach and limit its effects, and will help the Customer with its own notifications to supervisory authorities and data subjects.
Because vault contents and session logs are encrypted end to end, a breach of Vallic's systems would in principle expose ciphertext and the readable data listed in Annex 1, not vault contents. Vallic will still notify every breach of Customer Personal Data.
A notification is not an admission of fault or liability.

10. Transfers outside the EEA

Vallic stores Customer Personal Data in London, United Kingdom.
Vallic transfers Customer Personal Data outside the European Economic Area only in line with Chapter V GDPR: to a country with an adequacy decision (including, for certified US companies, the EU-US Data Privacy Framework), or under the European Commission's standard contractual clauses with the recipient, with supplementary measures where needed.
The CDN answers requests from edge locations near the person making them. Requests from outside Europe are therefore usually handled outside the EEA.

11. Deletion and return

During the term, the Customer can delete vaults, items, attachments and session logs at any time. The Service deletes automatically: team session logs after the retention period the Customer sets; activity log events after 365 days (1,095 days on the Business plan); markers of deleted items after 90 days; expired invites, sign-in links and single sign-on sessions.
At the end, the Team's owner deletes the Team in the app or on the team page. This removes from the live systems at once: the Team's vaults, items, attachments, session logs, vault keys, memberships, invites, single sign-on and provisioning settings, device approvals, audit stream and activity log. Before deleting, the Customer can export the activity log and, through the app, vault contents.
If the Customer's plan ends and the Team is not deleted: the data is kept while members use the Team. If none of its members uses the Service for 12 months (24 months if the Team ever had a paid plan), Vallic deletes the Team as above, after emailing its owner 30 days and 7 days before.
Backups: deleted data remains in Vallic's encrypted backups until they expire, within 7 days, and is not restored into the live systems except as part of a full restore after an incident.
The members' own accounts and personal vaults are not part of the Team and are not deleted with it.
Vallic will confirm deletion in writing on request.

12. Information and audits

Vallic makes available on request the information needed to show compliance with this DPA, including this DPA, Annex 2 and a description of how the Service works. The source code of the app, of the reference sync server and of the sync protocol is public.
Vallic answers a reasonable security questionnaire once a year, or after a personal data breach.
If that information is not enough, the Customer may audit Vallic, itself or through an independent auditor bound by confidentiality, once a year, with at least 30 days' written notice, during business hours, without unreasonable disruption and at the Customer's cost, unless the audit reveals a material breach by Vallic.
Vallic does not currently hold third-party security certifications.

13. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where the GDPR or other law does not allow liability to be limited. Article 82 GDPR is not affected.

14. Term and precedence

This DPA lasts as long as Vallic processes Customer Personal Data.
If documents conflict, the following order applies: the standard contractual clauses (where they apply), then this DPA, then the rest of the Agreement.
This DPA is governed by the law that governs the Agreement, the law of the Republic of Croatia, unless the standard contractual clauses require otherwise.

Annex 1: Details of the processing

Categories of data subjects

The Team's owner, admins and members.
People invited to the Team, and people the Customer's identity provider provisions.
Any person whose data the Customer places in its encrypted vaults or captures in session logs, such as the Customer's staff, clients or contractors. Vallic cannot see who they are.

Personal data Vallic can read

Email addresses of members and invited people; account IDs.
The Team's name; roles; membership status; when people joined and were confirmed.
Public keys, certificates and signatures that members' apps create; vault keys sealed to each member (which Vallic cannot open); vault permissions.
Device names, operating systems and app versions, and device approval requests and decisions (who decided, when).
The activity log: what happened in the Team, by whom and to whom, with details such as the invited address, the device name or the single sign-on protocol. It holds no IP addresses.
Single sign-on: the identity provider's identifier for each member and session expiry per device. SCIM: each provisioned person's email address, external ID and active status.
The audit stream configuration (endpoint URL and delivery status). Delivered events include members' email addresses.
Counts, padded sizes, revision numbers and dates of items and attachments, and which account wrote each item.

Personal data Vallic cannot read

Vault contents: hosts, usernames, passwords, private keys, notes, snippets and attachments.
Team session logs, which may contain anything that appeared in a terminal session.

These are encrypted on members' devices with keys Vallic never receives. Vallic stores and transmits them as ciphertext only.

Special categories

The Service is not designed for special categories of personal data. If the Customer places such data in its encrypted vaults, Vallic cannot see it.

Frequency

Continuous, for as long as the Team uses the Service.

Annex 2: Technical and organizational measures

Encryption and keys

Vault items, attachments and session logs are encrypted on members' devices with XChaCha20-Poly1305 before upload, and padded so that exact sizes are hidden. Items are signed with Ed25519.
Vault keys are sealed to each member's X25519 key by an admin's app. The server never holds a key that decrypts vault data, and cannot add a member to a vault on its own.
Account keys are protected by a key derived from the master password with Argon2id (at least 64 MiB of memory) and, separately, by the recovery key.
When someone loses access, the vaults they could open are flagged for key rotation. After rotation, changes under the old key are refused.

Authentication and access

The sign-in key a client derives is stored only as an Argon2id hash. A sign-in attempt for an unknown address takes as long, and answers the same way, as one with a wrong password, so accounts cannot be discovered.
Access tokens last 15 minutes. Refresh tokens last 90 days and are replaced at each use; presenting a used one again signs that device out. Tokens, sign-in links, invite links and SCIM tokens are stored only as SHA-256 hashes; confirmation codes as keyed hashes (HMAC-SHA-256), valid 15 minutes and for 5 attempts.
Two-step verification with authenticator codes (TOTP), each code usable once. Teams can require two-step verification, single sign-on (OIDC with PKCE, or SAML 2.0 with signed responses and SHA-1 rejected) and approval of new devices.
Secrets the server must read back (authenticator secrets, single sign-on client secrets, audit stream signing secrets) are encrypted with AES-256-GCM under a key held outside the database.
Roles (owner, admin, member) and per-vault permissions (read, write, manage) are enforced on every request. Requests for vaults or Teams a person may not see are answered as if they did not exist.
Account page sessions end after 30 minutes without activity or 12 hours in total.

Network and application security

TLS for all traffic over the internet, and HTTP Strict Transport Security on the website. API responses are marked not to be stored by browsers or caches, and the CDN is configured never to cache API, account, team, provisioning, single sign-on or invite paths.
Web application firewall, bot protection and protection against denial-of-service attacks at the CDN.
Rate limits per visitor IP address on sign-in, sign-up, recovery, invites and sign-in links, per account on authenticator codes, and on SCIM requests. The visitor's address is taken from the CDN only for requests that come from the CDN's published edge servers.
Requests the server makes to URLs that Team admins enter (identity providers, metadata, audit stream endpoints) must use HTTPS, may not reach private or internal network addresses, and do not follow redirects.
Audit stream deliveries are signed (HMAC-SHA-256 with a timestamp) so the Customer can verify them.

Data minimization

The activity log stores no IP addresses. Monitoring metrics contain counts only. Operator alerts identify accounts and Teams by internal ID only. Emails contain no tracking.
Expired tokens, codes, sign-in links, invites, single sign-on sessions, deleted-item markers, activity events and session logs are deleted automatically by scheduled jobs.

Staff access

Support staff use a console that shows account and Team metadata, never vault contents. They cannot reset master passwords or turn off two-step verification. Every action in the console is logged with the staff member's name.
Access to production systems is limited to the Vallic staff who run the Service. It goes through the hosting platform, Vallic Cloud: shell access only with personal SSH keys, and every login is recorded by the platform. Staff accounts and production access require two-factor sign-in. The site's admin pages, the support console included, accept connections only from allowed IP addresses.
Staff are bound by confidentiality obligations.

Availability and resilience

Encrypted backups of the database and stored files every night, to two offsite locations with different providers, plus a database copy on the machine for the last 48 hours. Production keeps the last four daily snapshots. Backups are encrypted before they leave the machine, with a separate key for each copy.
After a restore, a tool checks every stored attachment and session log against its hash.
Health checks of the database, file storage and scheduled jobs; alerts to the operators. A deployment that fails its checks rolls back automatically.
Members' apps keep a full local copy of their vaults and keep working while the Service is unavailable.

Development

Changes reach production only through pull requests into the main branch, which cannot be merged until automated tests (including security cases), coding standards checks and static analysis pass.
The sync protocol and the app are public, so their security can be reviewed by anyone.

Physical and infrastructure security

The machines, their disks and the backups are in data centres run by the providers listed in Annex 3, under those providers' physical security and certifications. Vallic Cloud's own sub-processors are listed in Annex III of the Vallic Cloud DPA.

Incident response

Health checks and monitoring alert Vallic's operators. A suspected incident is assessed and contained by the operator who receives the alert, recorded with a timeline and its cause, and, where it affects personal data, notified as section 9 describes.

Annex 3: Sub-processors

BunnyWay d.o.o. (bunny.net), Slovenia: Content delivery network, web application firewall, bot and denial-of-service protection for all traffic to morphgate.com, including the app's sync traffic; request logs. Location: EU, with edge locations in Europe, Asia and the Americas. Vault contents pass through only as ciphertext.
UpCloud Ltd, Finland (data centre in London, United Kingdom): Machines that run the Service, its database and file storage. Location: London.
Cloudflare, Inc. (Cloudflare R2), United States; storage in Europe: Encrypted backup storage (near copy).
Scaleway SAS, France (Paris): Encrypted backup storage (cold copy).
MailerSend, Inc., USA and Switzerland: Delivery of emails: invites, removal notices, device approval requests, security notices and team trial reminders.

Not sub-processors under this DPA:

Vallic Cloud, the hosting platform, which Vallic operates itself.
Stripe, which processes billing data for the Team's plan. Vallic processes that data as a controller under its Privacy Policy.
Identity providers, provisioning clients and audit stream endpoints that the Customer chooses and configures.

Visit statistics