Data Processing Agreement - Trust Center

What's Included

GDPR Article 28 Compliance

Covers all required processor obligations under EU data protection law.

Standard Contractual Clauses (SCCs)

EU Commission-approved Module 2 clauses for controller-to-processor transfers.

UK GDPR Addendum

Covers UK-specific requirements post-Brexit.

Security Incident Response

48-hour notification commitment with detailed incident reporting.

Subprocessor Management

30-day advance notice of subprocessor changes with objection rights.

Technical & Organizational Measures

Detailed security controls including encryption, access controls, and monitoring.

Request DPA

To request our Data Processing Agreement, please contact us with your company information. We typically respond within 2 business days.

Your business email address

Company name and address

Your Overskill account email (if different)

Request DPA via Email

[email protected]

Data Processing Details

Subject Matter: Provision of AI-powered application generation and hosting services
Duration: For the term of your subscription, plus data retention period
Nature of Processing: Storage, retrieval, AI processing, hosting, transmission
Purpose: To enable you to create, deploy, and manage web applications
Data Categories: Account information, application content, user prompts, generated code, usage data
Data Subjects: Your authorized users; end users of your generated applications

International Data Transfers

Overskill's infrastructure is primarily located in North America (United States and Canada), where customer and app data is stored. Data collected by apps you build on Overskill, including your end users' data, is stored in each app's own database: on Cloudflare D1 in North America for new apps (the default since September 2026), or on Turso in AWS us-east-1 (Virginia, USA) for older apps. Files your apps store are kept in Cloudflare R2 in eastern North America. Our subprocessors may process data in the United States, Canada, the Netherlands and, for some of the vendors on our Subprocessors page, other countries worldwide; each one's location is shown on our Subprocessors list. Where you or your app's end users are located outside the United States and Canada, the following cross-border transfer mechanisms apply.

Where data is stored and processed

Platform services: Render · Oregon, USA (US West) — the Overskill web app, background processing and caches
Platform database: Amazon Aurora on AWS · AWS us-west-2 (Oregon, USA) — accounts, workspaces, chat history, app source code, support and billing records
App databases: Cloudflare D1 · North America — data collected by apps you build; the default for new apps
App databases (older apps): Turso · AWS us-east-1 (Virginia, USA) — apps created before September 2026 that have not moved to Cloudflare D1
File storage: Cloudflare R2 · Eastern North America — uploads, app assets, screenshots and database backups
Published apps: Cloudflare · Global — served from Cloudflare's network, close to each visitor
Build and preview environments: E2B · USA (Google Cloud) — where your app is built and previewed while you edit it
Email from your app's custom domain: Amazon SES on AWS · AWS us-east-1 (Virginia, USA)

EU / EEA & UK (GDPR)

EU/EEA and UK personal data is stored in the United States and Canada (North America) and may be processed by our subprocessors in the United States, Canada, the Netherlands and, for some of the vendors on our Subprocessors page, other countries worldwide. Where that means a transfer outside the EU/EEA or UK, it is made under the EU Commission's Standard Contractual Clauses (SCCs, Module 2 — controller-to-processor), together with the UK International Data Transfer Addendum, supported by supplementary technical and organizational measures (encryption in transit and at rest, access controls). These are included in our DPA on request.

Japan (APPI)

Under Japan's Act on the Protection of Personal Information (APPI), providing personal data to a third party in a foreign country generally requires the data subject's prior consent, unless equivalent protection measures are ensured. For customers in Japan, Overskill relies on your consent obtained at the point of collection for the transfer of personal data to the United States and Canada (North America) for storage, and to the United States, Canada, the Netherlands and, for some of the vendors on our Subprocessors page, other countries worldwide for processing by the subprocessors on our Subprocessors list, and we contractually require our subprocessors to maintain protections substantially equivalent to those required under APPI. We do not currently rely on a Japan-specific adequacy or accreditation scheme; the consent-plus-equivalent-safeguards basis described here is the mechanism in place today.

Data residency: Overskill does not currently offer in-region data storage (for example, EU- or Japan-resident storage). Our databases and file storage are in North America, as described above. If your use case requires in-region data residency or a specific transfer mechanism not described above, contact [email protected] so we can confirm what we can support before you rely on it.

Key Protections

48-Hour Breach Notification

We commit to notifying you of any confirmed security incident within 48 hours of discovery.

Audit Rights

You have the right to review our data protection policies and request third-party audit reports.

Data Deletion

Upon termination, 30-day export window followed by deletion within 90 days (backup rotation).

Data Subject Rights

We assist you in responding to data subject access, rectification, and deletion requests.

Objection Rights

Object to new subprocessors within 30 days with right to terminate if concerns aren't resolved.

Transfer Mechanisms

Standard Contractual Clauses (Module 2) with supplementary measures for EU/EEA/UK transfers, and consent-plus-equivalent-safeguards for Japan (APPI). See International Data Transfers above.

Frequently Asked Questions

Do I need a DPA?

If you're using Overskill to process personal data of EU/EEA residents (including employee or customer data), GDPR Article 28 requires you to have a DPA with your data processors. Even if you're not legally required to have one, a DPA provides additional contractual protections.

Is the DPA free?

Yes, we provide our standard DPA at no additional cost to all customers.

Can we use our own DPA template?

We prefer to use our standard DPA which has been designed for our services. However, for enterprise customers with specific requirements, we can discuss modifications. Please contact [email protected].

How does Overskill handle international data transfers for customers in Japan?

Overskill's hosting takes place primarily in North America (United States and Canada), where app databases, file storage and the platform database are kept, and our subprocessors may process data in the United States, Canada, the Netherlands and, for some of the vendors on our Subprocessors page, other countries worldwide (see International Data Transfers). Under Japan's APPI, cross-border transfer of personal data generally requires the data subject's prior consent unless equivalent protection is ensured. For customers in Japan, we rely on your consent obtained at collection for the transfer to the United States and Canada (North America) for storage and to the United States, Canada, the Netherlands and, for some of the vendors on our Subprocessors page, other countries worldwide for processing, and we contractually require our subprocessors to maintain protections substantially equivalent to APPI. We do not currently offer Japan-resident data storage. If you need a different mechanism or in-region residency, contact [email protected] before relying on it.

How is the DPA executed?

Once you request the DPA, we'll send you a copy for review. The DPA can be executed electronically via DocuSign or a click-through acceptance, depending on your preference.

Questions About Our DPA?

Our legal team is here to help. Contact us with any questions about our Data Processing Agreement or data protection practices.

[email protected]