Roles
The customer is the controller; the platform acts as a processor within the meaning of Article 28 of the GDPR.
Instructions
The platform processes data only to provide the service configured by the customer.
Security
Encryption of secrets, role-based access control, two-factor authentication, logging, encrypted backups.
End of contract
Data can be exported at any time and is deleted within 30 days of the end of the contract.