Data Processing Agreement (DPA)
This document constitutes the Data Processing Agreement (DPA) within the meaning of Article 28 of the General Data Protection Regulation (GDPR - EU 2016/679) between PrivCloud and any professional client using the service.
Last updated: October 7, 2026
Article 1 - Parties to this agreement
This DPA is entered into between:
Article 2 - Purpose and nature of processing
PrivCloud processes, on behalf of the Data Controller, the data strictly necessary to provide the end-to-end encrypted file transfer service. Processing is limited to encrypted hosting of transferred files and management of associated metadata (link access, notifications, account management).
Article 3 - Categories of data processed
Email address - for user accounts and download notifications.
Transfer metadata - end-to-end encryption is enabled by default and also protects file names and paths, titles and descriptions of shares, and names of upload links. The service keeps encrypted values and neutral labels, sizes, creation dates and expiration dates. Labels of uploads without E2E remain readable. No IP address is associated with shares.
Content of transferred files - end-to-end encrypted (AES-256-GCM) in the browser, the default mode of every account. The processor then has no technical access to the plaintext content (zero-knowledge architecture). An account is required to create a standard share on the production service. If its owner turns end-to-end encryption off, the content of their uploads becomes readable by the processor.
Account data - username, preferences, transfer history (metadata only).
Team and signature data - team and folder names, members, activity log, subject and note of file requests (protected end to end with the team key), names of documents submitted for signature, signer identity, e-mail address and IP address, evidence file.
Copies issued to contractors (Team plan) - register of approved copies (administrator, contractor, hashes of the document and its pages, random identifier of the invisible mark, passkey signature, timestamp token) and hash-chained journal of openings and pages displayed. The title and content of the document stay end-to-end encrypted and are not part of it.
Passkeys - public key, identifier and counter of the users' passkeys. The private key never leaves their device.
Article 4 - Retention periods
Article 5 - Data location and transfers
All data is hosted on an infrastructure (server and object storage) located in France (European Union). No transfers to third countries (outside EU/EEA) are carried out. As file content is end-to-end encrypted, it is stored only in encrypted form, inaccessible in plaintext by the hosting providers.
Article 6 - Technical and organisational security measures
End-to-end encryption - AES-256-GCM, key randomly generated in the uploader's browser. By default, the key is not transmitted to the server. It only is when the user chooses to send it by e-mail to recipients or signers.
Zero-knowledge architecture - outside the case where the user sends the key by e-mail, described above, the processor is technically unable to decrypt transferred files.
HTTPS / TLS 1.3 - all client-server communications are encrypted in transit.
Strong authentication - two-factor authentication (2FA/TOTP) and passkey sign-in (WebAuthn, user verification required) available for all accounts.
Firewall and monitoring - iptables/ip6tables with strict rules, Wazuh security monitoring (alerts + auto-remediation), Zabbix monitoring, intrusion detection (MalwareDetect / Clamav).
Restricted access - administrator access limited, logged and protected by SSH key only with 82-character password + 2FA (SSH bastion). No unsecured remote access.
Evidence of copies issued to contractors - passkey approval with user verification, qualified RFC 3161 timestamp, hash-chained journal timestamped every hour, verifiable offline with the script shipped in every evidence bundle. The vault keeping them after a team is deleted only opens to the platform administrator, with a passkey and for 10 minutes. Every extraction is recorded in the journal of the copy concerned.
Encrypted backups - automated backups, encrypted with Restic.
Open source code - the source code is publicly auditable on GitHub.
Article 7 - Sub-processors
PrivCloud relies on infrastructure providers (hosting and storage) located exclusively in France (European Union). Due to the zero-knowledge architecture and end-to-end encryption, none of these providers has technical access to the plaintext content of transferred files: they only host encrypted data that they cannot decrypt. The technical providers involved are:
The qualified timestamping authority, used for electronic signatures and for the register of copies issued to contractors, only receives a SHA-256 hash: no personal data and no content.
Article 8 - Assistance with data subject rights
PrivCloud undertakes to assist the Data Controller in responding to requests from data subjects exercising their rights under Articles 15 to 22 of the GDPR (right of access, rectification, erasure, portability, objection, restriction).
For the register and journal of copies issued to contractors, the right to erasure may be set aside during their retention while this evidence remains necessary to establish, exercise or defend legal claims (GDPR Article 17(3)(e)).
Requests can be sent to: contact@stockageprive.net
Article 9 - Data breach notification
In the event of a personal data breach within the meaning of Article 4(12) of the GDPR, likely to engage the liability of the Data Controller, PrivCloud undertakes to notify the Data Controller within 48 hours of becoming aware of the incident, by email to the address registered on the account.
Article 10 - Transparency and audit
The complete PrivCloud source code is publicly available on GitHub, enabling any independent technical audit. The Data Controller may send any additional information request regarding security measures to contact@stockageprive.net.
Article 11 - Data return and deletion
At the end of the contractual relationship or upon request from the Data Controller, PrivCloud undertakes to delete all data from the relevant account within 30 days. Since encrypted files are inaccessible in plaintext without the decryption key held by the user, their physical deletion from the servers constitutes a final and irreversible destruction.
As an exception, by using the issuing of copies to contractors, the Data Controller chooses that their register and journal be kept three years after each record, including after the end of the contractual relationship or the deletion of the team, so that it can establish, exercise or defend legal claims (GDPR Article 28(3)(g)). During that period, they are returned to it on written request, from a vault whose opening is reserved to the platform administrator and logged. The Data Controller may at any time request their early erasure in writing. After three years, they are erased automatically.
Article 12 - Acceptance and entry into force
Use of the PrivCloud service by any professional entity (company, association, freelancer acting in the context of their professional activity) constitutes acceptance of this DPA. This DPA comes into force from the first professional use of the service and remains in force for the entire duration of the contractual relationship.
Contact & questions
For any questions regarding this DPA, to request a signed copy, or to exercise your rights, contact us:
E-mail : contact@stockageprive.net
Website: share.privcloud.fr
Security page: PrivCloud Security model
Related documents
This document has been drafted in accordance with Article 28 of the GDPR (EU Regulation 2016/679). It may be updated to reflect technical or regulatory changes. Last updated: October 7, 2026.