Legal

Data Processing Agreement

Version 2026-09-29 · Last updated: 29 September 2026

This agreement applies when an organization (“Customer”) uses Nesgate and Nesgate processes personal data on the Customer’s behalf. It forms part of the Terms of Service and is accepted by an administrator of the Customer when the organization account is created. It is written to meet Indonesia’s Personal Data Protection Law (UU No. 27/2022, “UU PDP”) and, where applicable, Article 28 of the GDPR.

1. Roles

The Customer is the controller (pengendali data pribadi) of personal data in its console. Nesgate is the processor (prosesor data pribadi) and processes that data only on the Customer’s documented instructions: these terms, the Customer’s console settings and its written requests.

2. What we process

• People: the Customer’s console users and the people whose browsers are protected.
• Data: names and email addresses, browser and device details, IP address and approximate location of sign-ins, and masked findings (type of data found, site, action taken, never the raw sensitive value).
• Purpose: providing the Service: protection policies, findings, alerts, reports, audit log and support.
• Duration: for as long as the Customer uses the Service, then deletion as in section 8.

3. Our obligations

• Process the data only for the purpose above; never sell it or use it to train AI models.
• Make sure everyone with access is bound to confidentiality and needs the access for their work.
• Keep the security measures in section 5 in place.
• Help the Customer answer requests from people exercising their rights, and with data protection impact assessments where needed.
• Tell the Customer if an instruction appears to break the law.

4. Sub-processors

The Customer authorizes these sub-processors: DigitalOcean (hosting, database and encrypted off-site backups, Singapore region), Cloudflare (network and protection against attacks), our email provider (account and alert emails) and, when online payment is used, our payment partner for payments only (card numbers never reach Nesgate). Each sub-processor is bound to data protection obligations at least as strict as these. New sub-processors are announced to administrators at least 30 days in advance so the Customer can object.

5. Security

Detection in the browser so raw sensitive data never leaves the device; encryption in transit (TLS 1.2+) and of secrets at rest; backups encrypted with a key that is not stored on our servers; least-privilege database access; tamper-evident audit logs; two-step verification and passkeys; no open server ports; logging and alerting of errors and security events; tested restore from backup.

6. Personal data breaches

We notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its data, with what we know about the nature of the breach, the data and people affected, and the steps taken. This lets the Customer meet its own obligation under UU PDP to notify within 3 × 24 hours.

7. Transfers outside Indonesia

Data is hosted in Singapore. Nesgate relies on the safeguards required by UU PDP Article 56 for such transfers and will move to an Indonesian region if the Customer’s regulator requires it and one is available.

8. Deletion and return

The Customer can export and delete its data from the console at any time. When the account is closed we delete its data within 30 days; encrypted backups age out within 35 days. Invoices and payment records are kept for 10 years because Indonesian tax law requires it.

9. Audits

On request we provide the information needed to show compliance with this agreement, including the Customer’s own tamper-evident audit log. On-site audits can be agreed in writing, with reasonable notice and at the Customer’s cost.

10. Contact

Nesgate · [email protected]