Legal

Data Processing Addendum

Last updated: Sep 25, 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between La Costa Services, LLC (“Skans Labs”) and a business customer (“Customer”), and applies where Skans Labs processes personal data on the Customer’s behalf in providing the Services. Where the EU or UK GDPR applies, the Customer is the “controller” and Skans Labs the “processor”; where the CCPA/CPRA applies, the Customer is the “business” and Skans Labs a “service provider.”

How little we process

The Skans appliance is designed to keep operational data on the Customer’s own premises. In the ordinary course, the personal data Skans Labs processes as a processor is limited to the Customer’s account and contact details, the identities of the people the Customer invites to its account, and licensing and check-in metadata. Skans Labs does not receive the contents of the Customer’s network, devices, or monitored systems.

Offsite Vault

If the Customer uses the Offsite Vault, Skans Labs stores backups that the Customer’s appliance has already encrypted with a key held only at the Customer’s site. Skans Labs has no access to that key and cannot read the contents of those backups; it processes them only as stored data. The appliance also encrypts each backup’s name with the site key, so Skans Labs cannot read file names, host names, database names or paths. The metadata Skans Labs holds to operate the service is limited to: each stored backup’s encrypted name (sealed together with the backup’s hash), keyed backup-set and backup-chain codes Skans Labs cannot reverse, whether it is a full, differential, log or self-contained backup, a coarse type (configuration, database, disaster recovery or device), size, SHA-256 hash of the ciphertext, timestamps and state; the site’s random storage-folder identifier, region, usage and retention settings; the appliance identifier each upload credential was issued to; the network address each request comes from, as for any connection to its services; and an audit record of downloads, retention changes, enroll-code and credential issue or revocation, subscription lapse, vault deletion and integrity failures, with who acted, when and from which address, kept for one year. The appliance sends Skans Labs no plaintext file name, host name, database name or path, and the service refuses an upload that carries one.

Location. Stored backups are held in the Cloudflare R2 region the Customer selects in the portal before the site’s first enroll — United States or European Union — fixed from that enroll. Backups of a site in the European Union region are stored only in the European Union. They are transferred only through Skans Labs services on skanslabs.com, which run on Cloudflare’s network, over TLS 1.2 minimum, TLS 1.3 negotiated; no storage address is given to any client. The metadata and audit records described above, and the Customer’s account records, are held in the United States for every site, including sites whose backups are stored in the European Union region (see International transfers).

Access. Downloads are made only from the portal, by a user whose role allows it, after a multi-factor check; a partner’s users only for the customers assigned to them. Each download is recorded in the site’s audit log and can be notified to the license owner by email. No Skans Labs credential gives read or delete access to stored backups other than the service’s own, and Skans Labs staff have no portal route to download a Customer’s backup; what is stored is encrypted under a key Skans Labs does not have.

Retention and deletion. Each backup is held under a 14-day lock, a rule on the storage bucket that Skans Labs operates and does not remove or shorten while backups are held under it, unless the law requires it. The service gives no one — the Customer, a partner acting for it, or Skans Labs staff — a way to delete a backup before its lock expires; after that, a backup is removed only under the retention set for the site, at the end of the subscription, or on the Customer’s instruction to delete the vault, and always by Skans Labs’ retention process. Retention is by calendar: full and self-contained backups are kept daily, weekly and monthly, and, for each database backup series, the most recent full backup on or before the start of the daily window and every differential and log backup after it, together with any full backup a kept differential or log backup depends on, so any point in the daily window can be restored. Only the Customer’s license owner, after a multi-factor check, can reduce retention, and a reduction takes effect only after existing locks expire. If the subscription ends (whoever pays for it cancels it, or payment fails), Skans Labs emails the license owner at once with the date the read-only period ends and a link to take the subscription over; stored backups remain downloadable for 30 days, and if the license owner starts their own subscription in that time nothing is deleted (the take-over is offered with the storage blocks that were canceled; if fewer are bought, uploads are refused until the stored backups fit, and nothing is deleted to make them fit). Otherwise Skans Labs keeps the newest backups that fit in the storage the Customer’s edition includes, in whole restorable units (a full backup with every differential and log backup of its series after it, up to the next full), never part of a unit, and deletes the others as their locks expire (all of them for the Community edition, which includes none).

Erasure (crypto-shredding). On the license owner’s instruction in the portal (“Delete my vault”, after a multi-factor check), Skans Labs immediately revokes the site’s credentials and marks every stored backup for deletion. The Customer then destroys the site key, which makes the stored backups unreadable to anyone at once. Each backup’s lock expires no more than 14 days after the instruction, and Skans Labs’ hourly deletion process then physically deletes it, normally within a day. The instruction cannot be reversed.

The Customer is the controller of what it stores. The Customer decides what its appliance backs up and is the controller (and, under the CCPA/CPRA, the business) for all personal data in those backups — including cardholder records, images and any biometric identifiers or templates held in access-control databases. The Customer is responsible for having a lawful basis, for any notice, consent, written policy and retention schedule the law requires (including under the Illinois Biometric Information Privacy Act and Article 9 of the GDPR), and for any impact assessment. Skans Labs’ position is that, because it holds such data only as ciphertext and never holds the key, it does not possess or have access to biometric identifiers or biometric information in the Customer’s backups; the Customer, as controller, is responsible for any BIPA notice, written release and consent. Skans Labs stores that data only as backups encrypted under a key it does not have; it does not sell, lease or trade it, use it for any purpose other than storing and returning it to the Customer, or disclose it except as this DPA and the Terms describe or the law requires.

Health and criminal-justice information. Skans Labs does not sign Business Associate Agreements; the Customer must not store protected health information covered by HIPAA in the Offsite Vault. Skans Labs is not a CJIS-vetted provider and has signed no CJIS Security Addendum; the Customer’s holding of the key does not make Skans Labs CJIS compliant, and whether the Offsite Vault may hold criminal justice information is the Customer’s agency’s decision.

Scope and instructions

Skans Labs processes personal data only to provide and secure the Services, and only on the Customer’s documented instructions (including these Terms), unless required by law — in which case we will inform the Customer unless the law forbids it. We will tell the Customer if, in our opinion, an instruction infringes applicable data-protection law.

CCPA/CPRA service-provider terms

Where Skans Labs is a service provider, it processes the Customer’s personal information only for the business purpose of providing the Services under the Terms. It will not sell or share that information; retain, use or disclose it for any other purpose, or outside its direct business relationship with the Customer; or combine it with personal information it receives from anyone else, except as the CCPA/CPRA permits. It will give that information the level of privacy protection the CCPA/CPRA requires, tell the Customer if it can no longer meet these obligations, and allow the Customer to take reasonable and appropriate steps to stop and remediate unauthorized use. Skans Labs certifies that it understands and will comply with these restrictions.

Confidentiality and security

Personnel authorized to process personal data are bound by confidentiality. We maintain appropriate technical and organizational measures, including encryption in transit, access controls on a least-privilege basis, hardened and access-gated infrastructure with no publicly exposed databases, and audit logging.

Sub-processors

The Customer authorizes Skans Labs to engage sub-processors to provide the Services. Each is bound by data-protection obligations no less protective than this DPA, and Skans Labs remains responsible to the Customer for their performance. The current sub-processors are:

Email from the Services — account, license and Offsite Vault notices — is sent from Skans Labs’ own mail server (mail.skanslabs.com) in the United States, which Skans Labs operates itself; it is not a third-party sub-processor.

We keep this list current on this page. We will email the account owner at least 30 days before a new sub-processor begins processing the Customer’s personal data, or as soon as we can where a change is needed at shorter notice to keep the Services secure or running. The Customer may object on reasonable data-protection grounds within that time; if we cannot resolve the objection, the Customer may cancel the affected Service before the change applies to it.

International transfers

Skans Labs is based in the United States, and account records, licensing records and Offsite Vault metadata are held there for every Customer; Offsite Vault backups of a site in the European Union region stay in the European Union. Where personal data is transferred out of the EEA, the UK or Switzerland to Skans Labs or a sub-processor, the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914) apply — Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is itself a processor — with the UK International Data Transfer Addendum and the Swiss adjustments where those laws apply, and are incorporated into this DPA by reference. For the Clauses: Annex I (the parties, the categories of data subjects and personal data, and the purposes of processing) is completed by the opening paragraph and the sections “How little we process”, “Offsite Vault” and “Scope and instructions”; Annex II (technical and organizational measures) by “Confidentiality and security” and the Offsite Vault paragraphs on location, access, retention and erasure; and Annex III (sub-processors) by “Sub-processors”. Skans Labs is not certified under the EU-U.S. Data Privacy Framework and does not rely on it. If this DPA or the Terms conflict with the Clauses, the Clauses prevail, and nothing in either limits a data subject’s rights or remedies under them.

Where Skans Labs is the controller. For portal accounts, billing, licensing records and the security and audit logs of its own services, Skans Labs processes personal data for its own purposes as an independent controller, under the Privacy Policy, not as the Customer’s processor.

Assistance

Taking into account the nature of the processing, Skans Labs will assist the Customer, by appropriate technical and organizational measures and insofar as possible, to respond to data-subject requests and to meet its obligations for security, breach notification, and data-protection impact assessments.

Personal-data breaches

Skans Labs will notify the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal-data breach affecting the Customer’s data, by email to the account owner, with the information the Customer reasonably needs to meet its own notification obligations, supplemented as more becomes known. This applies to the Offsite Vault even though the backups are encrypted under a key Skans Labs does not have; whether that encryption means the Customer need not notify anyone is the Customer’s decision.

Return and deletion

On termination, and at the Customer’s choice, Skans Labs will delete or return the personal data it processes on the Customer’s behalf, except where retention is required by law. Account holders can also export or delete their data at any time from Settings. For the Offsite Vault, return is by download from the portal, including during the 30-day read-only period after a subscription ends, and deletion is by “Delete my vault” or under the retention and end-of-subscription rules above; physical deletion follows each backup’s 14-day lock. Closing a portal account does not by itself delete a site’s Offsite Vault: the Customer cancels the Vault (it then lapses as described above) or uses Delete my vault first. Audit records are kept for one year.

Audits

Skans Labs will make available information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits on reasonable notice and subject to confidentiality.

Contact

Data-protection inquiries: [email protected] (subject “Data protection”). La Costa Services, LLC, California, USA.