Mareante
Sign in
Mareante Compliance & Legal Architecture
Document URL: https://mareante.nuuno.art/legal/dpa

Data Processing Agreement (DPA)

Data Processing Agreement pursuant to Article 28 GDPR and Article 9 of the Swiss Federal Act on Data Protection (nFADP) for business customers.

Version 0.2.0-reviewLast updated: 2026-11-10

Table of Contents

Notice: Engineering compliance draft for Mareante (not yet reviewed by an independent attorney).

This Data Processing Agreement ("DPA") supplements the Terms of Service ("Principal Agreement") entered into by and between:

  1. The Customer: The legal entity or business organization that has entered into the Principal Agreement with Mareante ("Customer" or "Data Controller"); and
  2. The Provider: Nuno Ribeiro, operating as a Swiss sole proprietorship (Einzelunternehmen) trading as "Mareante", having its seat of operations in Zürich, Switzerland, address at [To be provided by operator: {{LEGAL_ADDRESS}}], registered under [To be provided by operator: {{LEGAL_REGISTER}}] ("Mareante", "Provider", or "Data Processor").

This DPA applies whenever and to the extent that Mareante processes Personal Data on behalf of the Customer in the course of providing the Mareante autonomous software development platform at mareante.nuuno.art.

2.1. Subject Matter: The provision of the Platform services, including voice/text intake, automated technical specification drafting, task planning, sandboxed container code execution, automated verification, and deployment pipelines.

2.2. Duration: The term of this DPA corresponds to the term of the Principal Agreement, terminating automatically upon complete deletion of all Customer Personal Data pursuant to Section 9.

2.3. Categories of Data Subjects: Customer’s employees, contractors, authorized tenant users, git repository commit authors, and end-users of software developed or deployed by Customer through the Platform.

2.4. Types of Personal Data:

  • User account and contact information (names, corporate email addresses, user identifiers);
  • Communication records, prompt inputs, and spoken dialogue transcripts (FR-VC-03);
  • Git commit metadata (author names, timestamps, email addresses);
  • Cryptographic hash-chained audit logs (FR-AU-01);
  • Environment variables and configuration secrets injected via secure proxy (FR-SC-08).

3.1. The Controller is solely responsible for assessing the lawfulness of the processing and for safeguarding the rights of data subjects under applicable data protection laws.

3.2. The Controller warrants that all Personal Data transferred or made accessible to the Processor has been collected and processed in accordance with the GDPR, the Swiss nFADP, and all applicable privacy regulations.

3.3. The Controller retains full authority to issue documented instructions to the Processor regarding the processing of Personal Data.

4. Obligations of the Data Processor (Article 28(3) GDPR & Art. 9 Swiss nFADP)

The Processor covenants and undertakes to:

4.1. Processing on Documented Instructions Only: Process Personal Data solely upon documented instructions of the Controller, including with regard to transfers of Personal Data to a third country, unless required to do so by applicable Union, Member State, or Swiss law. In such case, the Processor informs the Controller of that legal requirement before processing, unless prohibited on important grounds of public interest.

4.2. Confidentiality: Ensure that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.3. Technical and Organisational Measures (TOMs): Implement and maintain appropriate technical and organisational measures pursuant to Article 32 GDPR and Article 8 Swiss nFADP to ensure a level of security appropriate to the risk, as detailed in Annex 1 to this DPA.

4.4. Sub-processors: Comply with the conditions set out in Section 5 of this DPA and GDPR Article 28(2)/(4) prior to engaging any sub-processor.

4.5. Assistance with Data Subject Rights: Taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, for the fulfilment of the Controller's obligation to respond to requests for exercising data subjects' rights laid down in Chapter III GDPR and Articles 25–29 Swiss nFADP.

4.6. Assistance with Security and Breach Notification: Assist the Controller in ensuring compliance with obligations pursuant to Articles 32 to 36 GDPR and Article 24 Swiss nFADP, taking into account the nature of processing and information available to the Processor.

4.7. Breach Notification: Notify the Controller without undue delay (and in any event within forty-eight (48) hours) upon becoming aware of a confirmed personal data breach affecting Customer Personal Data.

4.8. Return or Deletion of Data: At the choice of the Controller, delete or return all Customer Personal Data after the end of the provision of services, and delete existing copies unless statutory law (e.g., Swiss commercial retention laws, CO Art. 958f) mandates retention.

4.9. Audit Rights and Information: Make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and Article 9 Swiss nFADP, and allow for and contribute to audits, including inspections, conducted by the Controller or an independent auditor mandated by the Controller, subject to reasonable advance notice, during normal business hours.

5.1. General Authorization: The Controller grants the Processor general written authorization to engage sub-processors to assist in delivering the Platform services.

5.2. Current Sub-processors: The Controller approves the engagement of the sub-processors listed in our Sub-processors Directory.

5.3. Notification of Changes: The Processor shall inform the Controller of any intended addition or replacement of sub-processors at least fourteen (14) calendar days in advance via email or in-app notification.

5.4. Right to Object: The Controller has the right to object to the appointment of a new sub-processor on reasonable data protection grounds within fourteen (14) days of receiving notification. If the parties cannot resolve the objection, either party may terminate the affected service without penalty.

5.5. Sub-processor Guarantees: Where the Processor engages a sub-processor, it imposes upon the sub-processor data protection obligations substantially equivalent to those set out in this DPA by way of a binding contract.

6.1. Adequacy: Personal Data transfers between Switzerland and the European Economic Area (EEA) rely on reciprocal adequacy decisions adopted by the Swiss Federal Council and the European Commission.

6.2. Standard Contractual Clauses (SCCs): Where Customer Personal Data is transferred to a sub-processor outside Switzerland and the EEA without an adequacy decision, the transfer is governed by:

  • The European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 3 / Module 2);
  • The Swiss Addendum to the SCCs recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC); and
  • Certification under the EU-U.S. Data Privacy Framework and Swiss-U.S. Data Privacy Framework, where applicable.

The Processor has engineered automated self-service capabilities directly into the Platform:

  • Data Export (FR-AU-04): The Controller’s designated Owner can at any time generate and download a comprehensive structured machine-readable export of all tenant data.
  • Tenant Deletion (FR-AU-05): The Controller’s designated Owner can initiate complete tenant destruction. Execution permanently wipes database rows, encryption keys, sandboxes, and volumes.
  • Emergency Breach Rotation (FR-SC-09): In the event of suspected token or credential compromise, the Controller can execute a one-click breach rotation that immediately invalidates user tokens, terminates active sessions, halts running sandboxes, and rotates tenant encryption keys.

This DPA shall be governed by:

  • Where the Controller is established within the EEA: the law of the EU Member State in which the Controller is established;
  • Where the Controller is established in Switzerland or outside the EEA: the substantive laws of Switzerland.

The parties submit to the jurisdiction determined under the Principal Agreement (ordinary courts of Zürich, Switzerland for Swiss governing law).

Pursuant to Article 32 GDPR and Article 8 Swiss nFADP, Mareante maintains the following state-of-the-art security measures:

  • Platform infrastructure is hosted in ISO/IEC 27001, SOC 1, and SOC 2 Type II certified data centers operated by tier-1 cloud providers ([To be provided by operator: {{HOSTING_PROVIDER}}]).
  • Strict physical security includes biometric authentication, 24/7 surveillance, and perimeter access controls.
  • Cryptographic Passwords: User passwords are encrypted exclusively using Argon2id with high memory cost parameters (FR-ID-01).
  • Two-Factor Authentication (2FA): Time-Based One-Time Password (TOTP) multi-factor authentication is supported across tenant organizations (FR-ID-02).
  • Role-Based Access Control (RBAC): Permissions are verified at the backend control plane for Owner, Admin, Member, and Viewer roles (FR-ID-04–FR-ID-06).
  • Session Security: Cryptographically secure, random 256-bit session tokens stored in HTTP-only, Secure, SameSite=Lax cookies.
  • PostgreSQL Row-Level Security (RLS): Every tenant-owned database table enforces mandatory tenant_id column partitioning and PostgreSQL Row-Level Security policies (FR-ID-07). Tenant queries execute under non-superuser application credentials.
  • Isolated Sandbox Containers: Every execution run occurs inside a dedicated, ephemeral Docker container created dynamically per task (FR-EX-01). Containers have no access to host filesystem mounts, operate under strict memory/CPU limits, and terminate upon completion.
  • Egress Proxy Firewalls: Sandbox containers access the network strictly through a capability-locked proxy enforcing a domain allow-list (FR-SC-08).
  • Zero-Exposure Credential Broker: Third-party integration credentials are encrypted at rest using tenant-specific AES-256-GCM / ChaCha20-Poly1305 encryption keys (FR-SC-02).
  • Prompt Isolation: Credentials injected at the egress proxy are never returned to the API, never surfaced in agent prompts, never written to model context, and never printed in logs (FR-SC-03–FR-SC-04).
  • Emergency Breach Rotation (FR-SC-09): One-click automated revocation and rotation of all tenant encryption keys, API tokens, and running sandboxes.
  • External and internal service communications require TLS 1.3 (or TLS 1.2 minimum) with forward secrecy (ECDHE) and strong cipher suites.
  • HTTP Strict Transport Security (HSTS) with long max-age.
  • Ephemeral WebSocket streams for live voice dialogue encrypted end-to-end via WSS (FR-VC-01).
  • Cryptographic Hash-Chaining: Security-relevant events (logins, role grants, approvals, secret operations, deploys) are recorded in an append-only audit log where each record embeds the SHA-256 hash of its predecessor (FR-AU-01–FR-AU-02).
  • Approval Gates: High-risk actions (production deployments, budget cap increases, domain purchases) require explicit human UI approval by authorized roles (FR-PL-04).
  • Automated daily incremental and full logical backups, encrypted with dedicated keys and verified by automated restore tests.
  • Containerized microservices with auto-restart policies and health-check monitoring (FR-VR-04).