Phase Data Processing Agreement

Last updated: Oct 22, 2026

This Data Processing Agreement ("DPA") forms part of the Phase Terms of Service (the "Agreement") between Phi Security Inc. ("Phase") and the customer that accepts the Agreement ("Customer"). It applies to personal data Phase processes on Customer's behalf through Phase Cloud.

It does not apply to self-hosted deployments, where Customer runs Phase on its own infrastructure and Phase does not host or access the secrets stored there.

By using Phase Cloud, Customer agrees to this DPA. Section 10 sets the order of precedence between this DPA and the Agreement.

1. Definitions and roles

For Customer Personal Data, Customer is the controller and Phase is its processor. Where Customer itself acts as a processor for its own customers, Phase is Customer's subprocessor.

Phase is an independent controller, not a processor, for the account, billing and usage data it uses to run its own business, such as billing, fraud prevention, security monitoring, product improvement, marketing and research. That processing is governed by the Phase Privacy Policy, not this DPA.

• Data Protection Laws: all laws that apply to the processing of Customer Personal Data under the Agreement, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act (CCPA).
• Customer Data: all data Customer or its users submit to the Services, including application data and account information.
• Customer Personal Data: any Customer Data that relates to an identified or identifiable natural person.
• Subprocessor: a third party Phase engages to process Customer Personal Data.
• Security Incident: a confirmed breach of Phase's security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data on systems Phase controls. It does not include unsuccessful attempts that do not compromise Customer Personal Data, such as pings, port scans, failed login attempts or denial-of-service attacks, or incidents caused by Customer or its users, such as compromised Customer credentials.

"Services" means Phase Cloud. "Clauses" means the Standard Contractual Clauses described in Section 7. Other terms not defined here have the meaning given in the Agreement or in Data Protection Laws.

Under the CCPA, Phase acts as a "service provider". Phase will not sell or share Customer Personal Data, use it for any purpose other than providing the Services, or combine it with personal data from other sources except as the CCPA allows. Phase will tell Customer if it can no longer meet these obligations, and certifies that it understands and will comply with them.

2. Processing instructions and confidentiality

Phase processes Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's use and configuration of the Services are those instructions. Phase will tell Customer immediately if it believes an instruction breaks Data Protection Laws.

If a government or court asks Phase for Customer Personal Data, Phase will redirect the request to Customer where it can. Otherwise Phase will notify Customer first unless the law forbids it, challenge requests it reasonably believes are unlawful, and disclose only the minimum required.

Everyone at Phase authorized to process Customer Personal Data is bound by confidentiality obligations. Access to production systems is limited to authorized engineers who need it.

Customer is responsible for the lawfulness of its instructions and of the Customer Personal Data it provides, for having a lawful basis to share that data with Phase, and for managing its users' access and the security of its own account credentials.

3. Security measures

Phase maintains technical and organizational measures to protect Customer Data, audited annually as part of its SOC 2 Type 2 program. These include:

• Encryption. Customer Data is encrypted in transit and at rest, with secure key management.
• Access control. Access to production systems follows least privilege, uses multi-factor authentication, requires approval, and is reviewed at least quarterly.
• Monitoring. Production systems are monitored, and security events are logged and reviewed.
• Resilience. Automated backups, and business continuity and disaster recovery plans tested at least annually.
• Testing. Independent penetration testing at least annually, with vulnerabilities tracked to remediation.
• Vendors. A security review of every Subprocessor before it is onboarded.
• People. Confidentiality commitments and security awareness training for all personnel.

Phase may update these measures over time, provided the overall level of protection does not decrease. More detail is available at phase.dev/security.

4. Subprocessors

Customer authorizes Phase to use the Subprocessors listed in the Phase Trust Center.

• Phase binds each Subprocessor by written data protection terms no less protective than this DPA, to the extent relevant to the service it provides.
• Phase stays responsible for each Subprocessor's performance of those obligations.
• Phase will give Customer at least 30 days' notice before a new or replacement Subprocessor starts processing Customer Personal Data, by email to the organization owner's email address. Removals need no notice. Phase will update the Trust Center to reflect any change. Customer can check the Trust Center for updates.
• Customer may object on reasonable data protection grounds within 7 days of a notice. The parties will discuss in good faith. If they cannot resolve it, Customer's sole remedy is to stop using the affected Services.

5. Assistance to Customer

Phase will help Customer meet its own obligations under Data Protection Laws, taking into account the nature of the processing.

• Data subject requests. Customer can access, correct, export and delete most Customer Personal Data directly in the Phase Console. Where it cannot, Phase will help Customer respond. If a data subject contacts Phase directly, Phase will redirect them to Customer and will not respond itself unless Customer instructs it to.
• Impact assessments and regulators. Phase will provide reasonable information Customer needs for data protection impact assessments and prior consultations with supervisory authorities. Phase may charge reasonable fees for assistance beyond what the Services already provide.

6. Security incidents

Phase will notify Customer without undue delay after confirming a Security Incident, as defined in Section 1.

The notice goes to the organization owner's email address, and to any security contact Customer has given Phase, and will describe, as far as Phase knows at the time:

• the nature of the incident and the data and data subjects affected;
• its likely consequences;
• the steps Phase has taken or will take to contain and remedy it;
• a contact point for more information.

Phase will update Customer as new information becomes available. Notifying Customer is not an admission of fault by Phase.

Phase need not share information that would put the security of the Services or other customers at risk, or that the law prevents it from sharing.

7. International transfers

Customer Data is hosted in the EU, in Frankfurt, Germany. Some processing still happens outside the EEA: Phi Security Inc. is a US company, and some Subprocessors process data in other countries, as shown in the subprocessor list.

Where Customer Personal Data subject to the EU GDPR is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) (the "Clauses") apply and are incorporated into this DPA:

• Module 2 (controller to processor) applies where Customer is a controller, and Module 3 (processor to processor) where Customer is a processor.
• Clause 7 (docking clause) applies. Under Clause 9, option 2 (general written authorization) applies, with at least 30 days' notice given as described in Section 4. The optional language in Clause 11 does not apply.
• Clauses 17 and 18: the law and courts of Ireland.
• Annexes I, II and III of the Clauses are completed by Annex 1, Section 3 and Annex 2 of this DPA, respectively. The competent supervisory authority is the one determined under Clause 13.

For transfers subject to the UK GDPR, the UK International Data Transfer Addendum issued by the Information Commissioner's Office applies. For transfers subject to Swiss law, the Clauses apply with references adapted to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent authority.

If the Clauses conflict with this DPA, the Clauses prevail.

8. Return and deletion

Customer can delete its data at any time from within the application, for example by deleting its organization. Deletions can also be coordinated with Phase through info@phase.dev. Application data, including backup copies, is deleted within 30 days.

• Export. Customer can export its secrets at any time before deletion.
• End of the Agreement. Phase may keep application data for up to 30 days after the Agreement ends so Customer can reinstate its account. It is deleted, including backup copies, by the end of those 30 days.
• Service data. Application logs, metrics and other usage data that Phase's systems generate from Customer's use of the Services may be kept for up to one year from when they are generated, even after Customer Data is deleted.
• Audit logs. Audit logs are kept for the retention period of Customer's subscription tier, and are deleted with the rest of Customer Data when Customer deletes its data.
• Billing information. Phase and its payment processor may keep billing information, such as customer name, billing address, tax ID, contact details and payment method, as part of standard accounting practice. This is separate from the data Customer stores in the Services.
• Legal holds. Phase may keep data where the law requires it, only for as long and for the purpose the law requires.

9. Audits

Phase demonstrates its compliance with this DPA through an annual SOC 2 Type 2 audit and annual independent penetration testing, both performed by independent third parties.

• Reports. Enterprise customers can access Phase's SOC 2 Type 2 report and penetration test summary through the Phase Trust Center.
• Other customers. On request, Phase will provide a summary of its most recent audit results and answer a reasonable written security questionnaire, once a year.
• Confidentiality. All reports, summaries and answers are Phase's confidential information.
• Scope. These reports and answers are how Phase demonstrates its compliance and meets any audit obligation under Data Protection Laws and the Clauses, to the extent the law allows.

10. General terms

• Liability. Each party's total liability under this DPA and the Agreement together is subject to the exclusions and limitations of liability in the Agreement, except to the extent Data Protection Laws or the Clauses do not allow such limits.
• Order of precedence. If documents conflict: first the Clauses (where they apply), then this DPA, then the Agreement.
• Term. This DPA lasts as long as Phase processes Customer Personal Data under the Agreement, including after the Agreement ends until deletion under Section 8.
• Changes. Phase may update this DPA from time to time to reflect changes in law, its Subprocessors, or the Services. Updates take effect when posted on this page, and the date at the top shows when it was last updated. Customer's continued use of the Services after an update means it accepts the updated DPA. Subprocessor changes follow Section 4.
• Governing law. This DPA is governed by the laws of the State of Delaware, and the state and federal courts in Delaware have exclusive jurisdiction, except where the Clauses or Data Protection Laws require otherwise.
• Contact. Questions about this DPA: info@phase.dev. Security matters: security@phase.dev.

Phi Security Inc., 8 The Green, Ste A, Dover, DE 19901, United States.

Annex 1: Details of processing

Annex 2: Subprocessors

Phase's current Subprocessors, with their purpose and location, are listed in the Phase Trust Center. That list forms this Annex 2 and is kept up to date as Subprocessors change.