Enterprise Data Processing

An agreement specific to your environment

Enterprise repository access and data processing require a separate written agreement. This page explains the matters that need to be settled; it is not a signed Data Processing Agreement (DPA), a subprocessor list or a promise of a particular deployment configuration.

Website inquiries are covered by our Privacy Policy. Where bridgework processes personal data on a customer’s behalf, the applicable agreement must define each party’s role and instructions.

Execution and data boundaries

The proposed workflow discovers API dependencies, analyses changes, prepares patches, runs verification and opens pull requests. For each engagement, the scope must identify which operations run in customer-controlled CI/CD and which involve bridgework or a third party.

Customer-controlled runners do not by themselves mean local model inference or zero data egress. Before repository access is enabled, the agreed configuration must identify orchestration endpoints, any model provider, the information sent to each endpoint, credential handling and the locations where results are stored.

What the data-processing agreement must cover

• The subject matter, purpose and duration of processing, data categories, affected individuals and the customer’s documented instructions.
• Authorised access, confidentiality and agreed technical and organisational security measures.
• Approved subprocessors, processing locations and any required international-transfer safeguards.
• Assistance with data-subject requests, security incidents and applicable data-protection obligations.
• Retention, return or deletion of customer data, including the handling of logs and backups when an engagement ends.
• Information and audit arrangements needed to demonstrate compliance with the agreed obligations.

Review before access

Source-code payloads, model-provider retention, data reuse, runner permissions and supported transformations need explicit agreement for the proposed deployment. This website does not establish certifications, air-gapped operation or a full on-premises deployment. Contact Reveal privacy email for data-processing questions or Reveal legal email to discuss contractual terms.