Data Processing Agreement

Effective date: October 5, 2026.

This Data Processing Agreement ("DPA") forms part of the agreement between Four Leafs Technology, LLC ("Provider", "Processor") and the customer entering into Atlassian's standard Cloud Terms for the Certia application ("Customer", "Controller"), and applies to Provider's processing of personal data on Customer's behalf.

1. Definitions

Terms not defined here (Controller, Processor, Personal Data, Data Subject, Processing) have the meanings given in the EU General Data Protection Regulation (GDPR). Where the California Consumer Privacy Act, as amended by the CPRA (together, "CCPA"), applies — which, since the law's employee/HR/B2B exemptions expired January 1, 2023, can include a Customer's California-based employees reviewed through the Application — Provider acts as a "service provider" (not a "business") with respect to that personal information: it processes that data only for the purposes described in this DPA, does not sell or share it, and does not retain, use, or disclose it outside that direct business relationship, consistent with CCPA's service-provider requirements.

"Sub-processor" means a third party engaged by Provider to process personal data in providing the application.

2. Subject matter, nature, and duration

Provider processes personal data solely to provide Certia's access-review and certification-campaign functionality — pulling Jira/Confluence user, group, role, and activity data to build review campaigns, and using it as described in Section 4 below — for the duration of Customer's subscription, plus any period data is retained under Section 7.

3. Categories of data subjects

• Customer's Jira and Confluence users who are subjects of a review campaign (typically employees or contractors).
• Customer's users acting as reviewers or campaign administrators.

4. Categories of personal data processed

Per campaign, for each reviewed user: name, group names, role names, an inferred last-active timestamp, computed risk-flag labels, Jira account active/deactivated status, direct Jira project-role and Confluence space-permission grants, what a prior reviewer decided about them in an earlier cycle (including that reviewer's free-text note), and whether their access touches a resource the admin marked sensitive for that campaign. Reviewers also write a required free-text decision note about the subject for every decision — this field has no content filtering today; Customer is responsible for instructing its reviewers not to include special-category or otherwise sensitive personal data in it. Audit and notification records contain Atlassian account IDs and decision metadata, not names.

Email addresses — read transiently, not persisted: Provider's directory view reads each data subject's email address from Jira's API and uses it for one narrow purpose — comparing its domain against the organization's majority domain to compute an "external domain" risk-flag label — after which the address is discarded. It is not written to Forge Storage, not included in the per-campaign snapshot described above, and not disclosed to any sub-processor (Section 5); only the resulting risk-flag label is retained. Beyond this, Provider does not process any data about a subject beyond what is already visible to the application through Jira's and Confluence's own user, group, and permission data under Customer's existing Atlassian scopes.

5. Sub-processors

Sub-processor	Role	Data shared
Atlassian	Hosts the application and all Forge Storage (the application's sole data store), and runs AI-assisted classification of review items through its Forge LLMs service	All data described in Section 4, as inherent to Atlassian hosting the platform. The AI classification step receives only group names, role names, days-since-last-active, and risk-flag labels — never name, email, or account ID

Change notice (October 5, 2026): Anthropic has been removed as a sub-processor. AI-assisted classification now runs on Atlassian's Forge LLMs service inside Atlassian's cloud, so Atlassian is Provider's only sub-processor. This change reduces, rather than expands, the parties that process Customer personal data.

Provider will keep the sub-processor list above current on this page, and will post any change here at least 30 days before a new sub-processor begins processing personal data, giving Customer a reasonable opportunity to object on legitimate data-protection grounds. Where available, Provider will also flag the change through the billing/order contact Atlassian provides for an active subscription — a best-effort second channel, not the guaranteed one (that's this page, which requires no customer-supplied contact information to work).

6. International data transfers

Provider relies on the transfer mechanisms its own sub-processors already provide, rather than layering on its own: transfers to Atlassian are covered by Atlassian's Forge Data Processing Addendum — the agreement Forge app developers enter into with Atlassian, which incorporates Standard Contractual Clauses covering cross-border transfers of both the developer's and Customer's personal data to Atlassian.

This mechanism applies automatically to Provider's Atlassian Forge developer account — it requires no separate signature or non-standard enterprise contract to be in effect.

7. Data retention and deletion

Provider retains personal data processed under this DPA for the duration of Customer's subscription, and deletes it within 30 days of Customer uninstalling the Application. This deletion is currently a manual process carried out by Provider against Forge Storage, rather than an automated action triggered by uninstall itself — the commitment and the timeline are real either way.

8. Assistance with data subject rights

On Customer's written request, Provider will assist Customer in responding to a data subject's access, correction, or deletion request regarding personal data processed under this DPA, and will complete any deletion Customer confirms within 30 days. This is currently a manual process (Provider acting directly against Forge Storage), not yet Atlassian's own automated data-subject-request tooling (Forge's privacy.reportPersonalData API and/or a personalDataReporting manifest module) — Provider intends to adopt that automation as Certia grows, but honors a request made today on the same 30-day timeline regardless.

9. Security measures

Access to another person's data through the application is gated server-side on Customer's Jira ADMINISTER permission for every admin-facing route (checked per call, not inferred from which screen a request nominally came from); a reviewer can only read or act on their own assigned review items and notifications. All data is stored in Atlassian Forge Storage under Provider's Forge app installation — per Atlassian's own Forge shared-responsibility model, Atlassian encrypts this data at rest and protects it in transit via TLS, as part of operating the platform itself, not as something Provider configures. Provider's certified reports additionally carry a SHA-256 integrity fingerprint computed from the campaign's append-only audit log, so a report can be re-verified later against whether that audit log has changed since.

10. Audit rights

On reasonable written request, no more than once every 12 months, Provider will make available the compliance documentation it holds for its sub-processors (e.g. Atlassian's own security and compliance materials) and will respond in writing to reasonable questions about how personal data is processed under this DPA. Provider does not itself hold a SOC 2 report or ISO 27001 certification at this time — Certia's own certification is a longer-term goal (see CLAUDE.md's roadmap), not a current claim, and this DPA does not imply otherwise. An on-site audit is not offered, given Provider's scale as a solo-maintained application.

11. Breach notification

Provider will notify Customer without undue delay, and in any event within 72 hours of becoming aware, of any confirmed unauthorized access to, or disclosure or loss of, personal data processed under this DPA, along with whatever information is reasonably available at the time to help Customer meet its own downstream notification obligations.

12. Liability

Liability for processing under this DPA is subject to the limitations of liability set out in the standard Cloud Terms this DPA is incorporated into.

Back to Certia