Legal
Data Processing Agreement
1. Parties, roles and definitions
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Parity Development LLC (“Processor”, “we”), operating the Service under the brand HostedBI, and the Customer (“Controller”, “you”).
1.1 Roles. You decide why and how personal data in Customer Data is processed, and are the controller (or “business” under US state privacy laws). We process it only on your behalf to provide the Service, and are the processor (or “service provider”). For our own account administration, billing and security records about your organization’s contacts, we act as an independent controller under our Privacy Policy.
1.2 Definitions.
| Term | Meaning |
|---|---|
| Personal Data | Information about an identified or identifiable person contained in Customer Data. |
| Data Protection Laws | Privacy and data-protection laws that apply to the processing, including US state laws such as the California Consumer Privacy Act as amended (CCPA), and other US state privacy laws to the extent they apply. |
| Processing | Any operation on Personal Data, such as storing, rendering, emailing or deleting it. |
| Subprocessor | A third party we engage that processes Personal Data for the Service. |
| Security Incident | A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data we process. |
Other capitalized terms have the meanings in the Terms.
2. Processing details
| Item | Details |
|---|---|
| Subject matter | Hosting, refreshing, displaying and emailing the Customer’s Power BI reports through the Service. |
| Duration | The term of the Terms, plus the post-termination export and deletion period in Section 8. |
| Nature and purpose | Storing PBIX files and report versions; refreshing report data from the Customer’s sources; rendering reports in the Portal with each user’s row-level security identity; exporting and emailing scheduled reports; authenticating users; recording activity and usage; providing support. |
| Categories of data subjects | Customer’s Authorized Users; Email-Only Recipients; billing and technical contacts; any people whose data the Customer includes in its reports (for example its employees, customers or suppliers). |
| Categories of Personal Data | Account data (name, email, role, organization memberships, password hash, two-step sign-in secret and hashed recovery codes); recipient data (email address, assigned security roles, unsubscribe status); activity and usage records (sign-ins, report opens and views, deliveries, administrative changes, time stamps); and whatever Personal Data the Customer places in its reports. |
| Sensitive data | None. Protected health information and other sensitive categories are prohibited by the Terms and AUP (Section 2). |
| Data not processed | Data source credentials are passed to Microsoft Power BI, which stores them encrypted; they are not stored in our database, logs or activity records. |
3. Your instructions
3.1 We process Personal Data only on your documented instructions. The Terms, this DPA, and your configuration of the Service (users, roles, sharing, row-level security mappings, subscriptions and recipients) are your instructions. We will tell you if we believe an instruction breaks Data Protection Laws.
3.2 We will not sell or share Personal Data (as those terms are used in the CCPA), retain, use or disclose it outside our direct business relationship with you, or combine it with data from other sources, except as Data Protection Laws allow for service providers. We may create aggregated, de-identified usage statistics that identify no person or customer.
3.3 You are responsible for the lawfulness of the Personal Data you provide, for any notices and consents it requires, and for having a lawful basis to send reports to Email-Only Recipients.
4. Confidentiality of personnel
Only our personnel who need access to provide, support or secure the Service may access Personal Data. They are bound by confidentiality obligations. Staff access to your organization is recorded in your activity log, visible to your administrators. We do not currently use contractors with access to Personal Data; any we use will be bound by written confidentiality terms.
5. Security measures
We maintain the technical and organizational measures in Annex A, appropriate to the risk. We may update them if the overall level of protection is not reduced.
6. Subprocessors and data location
6.1 Authorization. You authorize us to use the Subprocessors in Annex B. Each is bound by written terms that protect Personal Data at least as well as this DPA. We remain responsible for their performance.
6.2 Changes. We may add or replace Subprocessors at any time, without advance notice, by updating Annex B. We will email the Client Owner about the change no later than 10 days after the new Subprocessor starts processing Personal Data. If you object, your sole remedy is to stop using the Service and cancel under the Terms; no refund is due.
6.3 Location. We host the Service and store Customer Data in the United States, in Microsoft Azure’s Central US region, including the Microsoft Power BI/Fabric resources that hold your reports. Some Subprocessors may process limited data (such as billing details or email delivery metadata) in other locations as described in Annex B.
7. Security incidents, assistance and audits
7.1 Incident notice. We will notify you without undue delay, and within 72 hours, after becoming aware of a Security Incident affecting your Personal Data. The notice will describe what happened, the data and people affected (as far as known), what we are doing, and a contact. We will update you as we learn more and take reasonable steps to contain it. Notice is not an admission of fault.
7.2 Data subject requests. If someone asks us to access, correct or delete their Personal Data in Customer Data, we will refer them to you. The Service lets your administrators update or remove users and recipients and export your data. We will provide reasonable further help where you cannot respond using the Service.
7.3 Other assistance. We will provide reasonable information you need for data protection assessments or regulator inquiries about the Service. Assistance beyond a reasonable effort may be charged at our then-current rates, agreed in advance.
7.4 Audits. On written request no more than once a year, we will answer a reasonable security questionnaire and provide a summary of our security measures and any third-party assessment (such as a penetration test summary once completed). Any on-site or further audit must be agreed in advance, at your cost, with reasonable notice and confidentiality. We do not yet hold a SOC 2 or similar certification.
7.5 Legal requests. If a government or court asks us for Personal Data, we will redirect it to you where possible, and notify you before disclosing unless the law forbids it.
8. Return and deletion
8.1 Export. On request during the term, or within 30 days after termination, we will provide a full export of Customer Data: your organization’s records, a list of people (email, name, role, status), the activity log, and every stored PBIX version. Exports never contain password hashes or two-step sign-in secrets.
8.2 Deletion. When that period ends (or sooner if you ask in writing), we delete, in this order: the Microsoft Power BI resources holding your reports, and the access identity we created for them; your files in storage, held under your organization’s random ID; every database record of your organization, including its activity log; and the accounts of your users who belong to no other organization on the Service. We keep one record that the deletion happened (random organization ID, date, reason, who requested it, record counts), with no names or people.
8.3 Backups and retained copies. Residual copies in encrypted backups and soft-deleted storage expire within 35 days and are not restored except for disaster recovery. Any export copy we hold is deleted within the same period. We may keep data the law requires us to keep, protected under this DPA, for as long as required.
8.4 Certification. On request, we will confirm deletion in writing.
9. Liability and term
Each party’s liability under this DPA is subject to the limitation of liability in the Terms. This DPA lasts as long as we process Personal Data for you, and survives termination of the Terms until deletion under Section 8 is complete. If this DPA conflicts with the Terms on Personal Data, this DPA wins.
Annex A — Security measures
| Area | Measure |
|---|---|
| Tenant isolation | Every customer record carries the organization’s ID, and all queries pass through a central scoping layer. Each organization has its own Microsoft Power BI report storage and access identity, and storage under its own ID. Automated cross-tenant isolation tests run on every change. |
| Access control | Central, deny-by-default authorization with role-based permissions and per-folder and per-report access. Row-level security is enforced with each viewer’s identity; a user without a required role sees nothing (fail closed). |
| Authentication | Passwords of at least 12 characters, checked against common passwords and stored hashed. Two-step sign-in (TOTP) required for all administrators and our staff; hashed one-time recovery codes. Sessions bound to one portal hostname; secure, HTTP-only cookies. |
| Abuse protection | Rate limits on sign-in, two-step codes, password reset, uploads, manual refreshes, “Send now” and report loads. |
| Application security | HTTPS only with HSTS; enforced Content Security Policy; CSRF protection; clickjacking protection; output escaping; upload validation; spreadsheet-formula neutralization in CSV downloads. An internal security review was completed in November 2026; a third-party penetration test is planned before public launch. |
| Encryption | In transit with TLS. At rest by Microsoft Azure storage and database encryption and by Microsoft Power BI for stored data source credentials. |
| Secrets | Platform secrets and certificates are held in Azure Key Vault and accessed by managed identity; the platform’s Microsoft credential is a certificate with expiry monitoring. Data source credentials are not stored by us. |
| Logging | Structured application logs tagged by organization ID, excluding credentials, tokens and record contents. A per-organization activity log of sign-ins, changes, deliveries and report views, visible to the customer’s administrators, including actions by our staff. |
| Monitoring | Alerts for application errors, job failures, database health and certificate expiry. Customers are alerted to failed scheduled refreshes and deliveries. |
| Resilience | Automated database backups with point-in-time restore; storage soft delete and versioning; every PBIX version kept; infrastructure defined as code. Restores are tested at least once a year; an off-provider backup copy is planned. |
| Personnel | Access limited to authorized staff with two-step sign-in; staff actions inside a customer’s organization are logged and visible to the customer. |
| Development | Only synthetic data is used in development and testing; real customer files are never used in development or sent to AI tools. |
Annex B — Subprocessors
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Microsoft Azure (Microsoft Corporation) | Application hosting, database, file storage, key management, logging and monitoring | All Customer Data | United States (Central US) |
| Microsoft Power BI / Microsoft Fabric (Microsoft Corporation) | Report storage, data refresh, rendering, exports; encrypted storage of data source credentials | PBIX files, report data, viewer identities for row-level security, data source credentials | United States (Central US) |
| Stripe, Inc. | Payments, invoicing, receipts, tax calculation | Billing contacts, payment details, invoices (no report data) | United States and other countries where Stripe operates |
| Maileroo | Sending scheduled report emails, invitations, password resets and alerts | Recipient email addresses, sender name, email content including report attachments | As stated in Maileroo’s published terms; may include locations outside the US |
| Cloudflare, Inc. | DNS; later, custom client domains and TLS certificates | Domain names; traffic metadata if proxying is enabled | Global network |
| Microsoft 365 (Microsoft Corporation) | Support and business email | Contact details and whatever customers send us | United States |
We use no other subprocessors today. An external uptime-monitoring service (health checks only, no Customer Data) and an off-provider backup service are planned; each will be added to this list under Section 6.2.