What changed for your account on 25 May

We wrote about preparing for the GDPR last summer. Enforcement starts on Friday, everything we said we would build is live, and this is the plain description of what that means for your account.

Your data processing agreement

There is a DPA in your account settings. You do not need to request it, negotiate it, or sign it in a PDF and email it back. It is the same terms for everyone, it names every sub-processor we use, and changes to that list are announced thirty days in advance.

If your legal team needs a signed copy on paper we will do that, but the agreement is in force either way.

Export and deletion

Any account can export everything we hold: profile, subscriptions, invoices, API keys, and request logs within the retention window. It arrives as a single JSON file, usually within a minute.

Deletion removes the account and its data from the primary store immediately and from backups as those backups age out, which takes at most thirty-five days. We tell you that number rather than claiming deletion is instant, because instant deletion from backups is not a thing anyone does honestly.

Retention

Request logs are kept for thirty days and then deleted. Previously they were kept forever, because storage was cheap and nobody had asked the question. Aggregate usage counts, which are what your invoice is built from, are kept for seven years for tax reasons and contain no request payloads.

Breaches

We have a documented process with named owners and a seventy-two hour clock that starts when we become aware, not when we finish investigating. We have not had a reportable breach. If we do, you will hear it from us before you hear it anywhere else.

What has not changed

Your integration. There is no migration, no new header, no deprecated endpoint. The point of doing this work over ten months rather than three weeks was that Friday should be uneventful for you.