Data Processing Agreement
Last updated: October 14, 2026
The processor terms that apply when Firebeam processes personal data on your organization's behalf — GDPR Article 28, in readable form.
1. Roles and scope
For personal data contained in your workspace content — synced work items, comments, member names, analytics events — your organization is the controller and Firebeam is the processor. This DPA forms part of the Terms of Service and applies for as long as we process such data for you.
2. Nature and purpose of processing
Hosting, syncing, analyzing and displaying your workspace data; generating the AI outputs you request; sending the notifications and reports you configure. Data subjects are typically your team members, and the people referenced in your work items. The data is the professional content of those tools; Firebeam is not designed for special categories of data, and you agree not to sync them.
3. Documented instructions
We process your data only to provide the service as configured by you and as documented in the Terms, this DPA and your in-product settings. If we believe an instruction violates data protection law, we will tell you before acting on it.
4. Confidentiality
Everyone we authorize to process your data is bound by confidentiality obligations, and access is limited to what their role requires.
5. Security measures
We implement appropriate technical and organizational measures, including encryption in transit, database-level tenant isolation, role-based access control, rate limiting, and audit logging of administrative access. The Security page documents the current measures; we may improve them but not materially weaken them.
6. Subprocessors
You authorize the subprocessors listed on our Security page (payment, AI generation, email delivery, error monitoring). We remain responsible for their performance, bind them to equivalent obligations, and will inform workspace administrators of material changes to the list, giving you the opportunity to object. AI generation uses the EU-hosted provider by default. If a workspace administrator turns off EU model location, that choice is your instruction to us to also use the AI providers outside the EU listed there.
7. Assistance
Taking into account the nature of the processing, we assist you in responding to data subject requests and in meeting your security, breach-notification and impact-assessment obligations, using the tools built into the product wherever possible.
8. Personal data breaches
If we become aware of a personal data breach affecting your data, we will notify your workspace administrators without undue delay, describing the nature of the breach, the likely consequences, and the measures taken or proposed.
9. Deletion and return
When the agreement ends — or earlier at your request — we delete the workspace and its content, except where law requires retention. Where your plan includes export, you can retrieve your data before deletion; integration tokens are never included in exports.
10. Audits and transfers
We make available the information reasonably necessary to demonstrate compliance with this DPA, and contribute to audits you are legally entitled to conduct. Transfers outside the EU/EEA occur only under adequacy decisions or standard contractual clauses.
Questions about this page? support@firebeam.eu