Version 1.0.2 · Effective 2026-10-13 · Posted 2026-10-13 · Last updated 2026-10-13
In plain English (this summary is not part of the agreement; the full text below controls)
This addendum is part of the Terms for every organization that uses Tartan's hosted service. You don't sign it
separately.
Your organization controls its network data. We process it to run Tartan for you and as this addendum describes.
We don't sell your data, use it for ads, or use it to train AI models.
We also create aggregated or de-identified statistics from it, alongside running the service, to improve Tartan.
We commit not to re-identify them.
Our staff are bound to confidentiality. The security measures we use are listed in Annex II.
We tell you 30 days before adding a new subprocessor, and you can object.
We tell you about a breach affecting your data without undue delay.
Deletion is done by hand on your request today. Some records outlast it: security logs, certificate records and
backups. Section 10 lists them.
1. Parties and scope
1.1 This Data Processing Addendum ("DPA") forms part of the Tartan Networks Terms of Service
(https://tartannetworks.com/legal/terms), or of another written agreement for the hosted Tartan service (the
"Agreement").
It applies automatically to every organization that uses the hosted service. No separate signature or acceptance is
needed.
It is made between the organization that accepted the Agreement ("Customer") and TechSolve LLC, a Kentucky
limited liability company and the maker of Tartan Networks, 187 Pavilion Pkwy #131, Newport, KY 41071 ("TechSolve").
1.2 This DPA applies only where TechSolve processes Customer Personal Data on Customer's behalf while providing the
hosted service. That covers the hosted control plane, the console, the hosted lighthouses and relays, and hosted DNS
for the Customer's org zone.
It does not apply to:
a self-hosted deployment that TechSolve does not operate;
data that TechSolve processes as an independent controller. Examples are account and agreement records, website
visits and messages sent to our mailboxes. The Privacy Policy covers those
(https://tartannetworks.com/legal/privacy).
1.3 Definitions:
"Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the
Agreement. Where they apply, these include:
Regulation (EU) 2016/679 ("GDPR");
the GDPR as retained in UK law, together with the UK Data Protection Act 2018 ("UK GDPR");
the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations
("CCPA");
other US state privacy laws.
"Customer Personal Data" means the personal data that TechSolve processes on Customer's behalf under the
Agreement, as Annex I describes.
The terms "controller", "processor", "data subject", "personal data", "personal data breach", "processing",
"business", "service provider", "sell" and "share" have the meanings that the applicable Data Protection Laws give
them.
2. Roles
2.1 Customer is the controller of Customer Personal Data, or a processor acting for its own controller. TechSolve is a
processor of Customer Personal Data and, under the CCPA, a service provider.
2.2 Customer is responsible for the lawfulness of the Customer Personal Data it provides or causes to be provided.
This includes giving any notice to, and getting any consent from, its own people and device users. Examples include:
the names it gives to people and devices;
its decision to enrol a device;
its decision to turn on the optional RMM hook.
3. Instructions
3.1 TechSolve processes Customer Personal Data only on Customer's documented instructions. Those instructions are:
the Agreement and this DPA;
Customer's configuration and use of the service, through the console, the API, the agent and the apps;
any other written instruction that TechSolve agrees to.
The only exception is processing that the law requires of TechSolve. In that case TechSolve tells Customer first,
unless the law forbids it.
3.2 TechSolve will tell Customer if, in its opinion, an instruction breaks Data Protection Laws. It may suspend that
instruction until the matter is resolved.
4. Product improvement and limits on use
<!-- data-use -->
4.1 TechSolve will not:
sell or share Customer Personal Data, in the CCPA's sense of "sell" and "share";
use Customer Personal Data for targeted or cross-context behavioural advertising;
use Customer Personal Data to train, fine-tune or evaluate any artificial intelligence or machine-learning model, or
let anyone else do so;
combine Customer Personal Data with personal data from other sources, except where the CCPA allows a service
provider to;
retain, use or disclose Customer Personal Data outside the direct business relationship with Customer, or for any
purpose other than the business purposes in Annex I.
4.2 Aggregated and de-identified data. Besides running the service, TechSolve may create the following from the
service and use them to operate, secure, maintain and improve its services:
aggregated data, meaning statistics about the service that are designed not to relate to an identified or
identifiable person, device or organization;
de-identified data, as 11 CCR § 7050(a)(3) permits.
For de-identified data, TechSolve will:
(a) take reasonable technical and organizational measures so that it cannot reasonably be linked to a person,
household or device;
(b) publicly commit to keep and use it only in de-identified form, and not attempt to re-identify it, except to test
that its de-identification works;
(c) contractually require any recipient to meet (a) and (b).
Data that meets this section is not Customer Personal Data.
4.3 TechSolve will widen section 4.1 only by agreement with Customer, or under the change process in the Agreement. A
change that widens what TechSolve may do:
is a material change;
applies to Customer only after one of Customer's Owners accepts it explicitly in the console;
applies only to data collected after it takes effect.
It applies to data collected before then only with Customer's affirmative consent. Continued use of the service never
counts as that consent.
<!-- /data-use -->
5. Confidentiality
TechSolve ensures that everyone it authorises to process Customer Personal Data is bound by an appropriate duty of
confidentiality, contractual or statutory. Access is limited to people who need it to provide, support or secure the
service.
6. Security
6.1 TechSolve implements and maintains the technical and organizational measures in Annex II. Those measures give a
level of security appropriate to the risk, taking into account:
the state of the art;
the costs of implementation;
the nature, scope, context and purposes of the processing.
6.2 TechSolve may update those measures over time, provided an update does not materially reduce the overall security
of the service.
a notice in the console, once the console's policy-notice feature is live. Until then, notice is given in the
changelog and on the subprocessors page.
7.3 Customer may object on reasonable data-protection grounds within that 30-day period, by writing to
privacy@tartannetworks.com.
If the parties cannot resolve the objection in good faith, Customer may terminate the affected service.
TechSolve will refund any prepaid fees for the period after termination.
This is Customer's only remedy for the objection.
7.4 TechSolve will impose on each subprocessor data-protection obligations that are no less protective than this DPA.
TechSolve remains liable for its subprocessors' performance of those obligations, subject to the Agreement.
8. Assistance
8.1 Data-subject requests. TechSolve will help Customer, by appropriate measures and so far as possible, to respond
to requests from data subjects who exercise their rights.
If TechSolve receives such a request directly, it refers the person to Customer, confirms the referral to them, and
acts only on an Owner's instruction.
If the org no longer exists or has no Owner, TechSolve handles that one request itself.
Today, Customer can:
remove people, devices and passkeys itself through the console or the API;
export its org state.
For anything else, Customer writes to privacy@tartannetworks.com. TechSolve verifies the request with an Owner and acts
within 30 days. We are building self-serve deletion in the console.
8.2 Other assistance. Taking into account the information available to it, TechSolve will give reasonable help
with:
Customer's data protection impact assessments;
prior consultations with supervisory authorities;
Customer's security obligations.
9. Personal data breaches
9.1 TechSolve will notify Customer of a personal data breach affecting Customer Personal Data without undue delay, and
where feasible within 72 hours after becoming aware of it.
9.2 TechSolve will give Customer the information it reasonably needs to meet its obligations, as that information
becomes available. This includes:
the nature of the breach;
the categories and approximate number of records and data subjects affected;
the likely consequences;
the measures taken or proposed.
9.3 Notice goes to Customer's Owners in the console and to any contact address Customer has given us.
TechSolve holds no email addresses for most users, so Customer should give a security contact to
privacy@tartannetworks.com.
9.4 A notification is not an admission of fault or liability.
10. Deletion and return
10.1 While the service is active, Customer may export its org state with the tools the service provides. Today that
export is designed for moving an org to a control plane that Customer runs.
Within 30 days, they delete or de-identify Customer Personal Data in the live systems wherever the system allows it.
This is a manual process today. We are building self-serve deletion. When it exists, Customer will use it, and this
DPA will be updated under the Agreement's change process.
10.3 Some records outlast that deletion. They are not used except as stated:
Audit log. The audit log is append-only and hash-chained, so its entries cannot be altered or deleted without
breaking the chain.
Its entries name the people and devices that acted, and record when.
They are kept as security records, to defend legal claims and to show the integrity of the log.
Person records. When a person is removed, their record is marked removed, and their passkeys, sign-in identities
and sessions are revoked. Their display name and identifier stay on that record, because the audit log refers to
it.
Archives. Forgotten devices are copied to a device archive, and expired certificates to a certificate archive.
Neither archive is purged automatically yet. On a deletion request, TechSolve removes the org's archived device rows
by hand. Certificate records are kept as security records.
Backups. Backups are protected against alteration and deletion, and expire on these schedules:
point-in-time recovery: 14 days;
nightly database backups: 90 days;
audit-log exports: 365 days;
the public transparency registry: 3 years.
TechSolve does not restore from backups to process deleted data again, except to recover the service.
Public records. Certificates for Customer's org zone appear in public Certificate Transparency logs. TechSolve
cannot remove them.
Legal holds. Data that TechSolve must keep by law.
These records stay subject to this DPA until they are deleted.
11. Audits
11.1 TechSolve will make available the information reasonably needed to show compliance with this DPA. It does this
first through:
written answers to a reasonable security questionnaire, no more than once a year.
11.2 If that is not enough to meet a requirement of Data Protection Laws or of a regulator, Customer may audit
TechSolve. The audit is subject to all of the following:
30 days' written notice;
no more than once in any 12 months, unless a regulator requires more or a breach has occurred;
conducted during business hours;
carried out by Customer, or by an independent auditor bound by confidentiality;
no access to other customers' data;
at Customer's cost, including TechSolve's reasonable time at its then-current rates.
12. International transfers
12.1 TechSolve stores Customer Personal Data in Microsoft Azure regions in the United States. Its subprocessors may
process it in the locations listed in Annex III.
12.2 For now, TechSolve offers the hosted service to organizations outside the European Economic Area and the United
Kingdom.
The clauses below apply if, despite that, Customer Personal Data that is subject to the GDPR is transferred to
TechSolve in a country without an adequacy decision. In that case the Standard Contractual Clauses adopted by
Commission Implementing Decision (EU) 2021/914 apply, incorporated by reference, as follows:
Module 2 (controller to processor) applies, or Module 3 (processor to processor) where Customer is a processor;
clause 7 (docking) applies;
clause 9 option 2 (general authorisation) applies, with the notice period in section 7;
the optional language in clause 11 does not apply;
clause 17: the law of Ireland governs;
clause 18: the courts of Ireland have jurisdiction;
Annexes I–III of this DPA complete Annexes I–III of the Clauses.
12.3 For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Standard Contractual
Clauses, issued by the UK Information Commissioner, applies and is incorporated by reference.
Its tables are completed with the information in this DPA.
Either party may end it as its section 19 allows.
13. CCPA service-provider terms
To the extent the CCPA applies, TechSolve:
(a) processes Customer Personal Data only for the business purposes in Annex I;
(b) will not sell or share it;
(c) will not retain, use or disclose it outside the direct business relationship with Customer, or for any other
purpose, except as section 4.2 and the CCPA allow;
(d) will not combine it with other personal data, except as the CCPA allows;
(e) will comply with the CCPA and give the same level of privacy protection that the CCPA requires of businesses;
(f) will tell Customer if it can no longer meet its CCPA obligations;
(g) allows Customer, on notice, to take reasonable and appropriate steps to stop and remediate unauthorised use.
TechSolve certifies that it understands these restrictions and will comply with them.
14. Liability and precedence
14.1 Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of
liability in the Agreement.
14.2 If this DPA and the Agreement conflict, this DPA controls for the processing of Customer Personal Data. If the
Standard Contractual Clauses and this DPA conflict, the Clauses control.
14.3 TechSolve may update this DPA under the change process in the Agreement. An update will not reduce the protection
of Customer Personal Data without Customer's affirmative consent.
Annex I: Details of processing
Parties:
Data exporter: Customer, the controller. Contact: the Owners in Customer's console.
Data importer: TechSolve LLC (maker of Tartan Networks), the processor. Contact: privacy@tartannetworks.com.
Categories of data subjects:
Customer's people who have console access: Owners, Admins, Techs and Viewers.
Users of devices enrolled in Customer's org.
People in partner organizations who are given access by a grant.
Categories of personal data:
People:
display name;
a handle or, when Customer uses single sign-on, the SSO identifier and email;
the SSO issuer and subject.
Passkeys: public keys only, with the authenticator type (AAGUID), backup flags and attestation format. No
passwords.
Sessions: sign-in and last-active times.
Device approvals: the requesting device's name and operating system, the requester, the time, and the IP
address the request came from.
Devices:
device name and hostname, which may contain a person's name;
overlay addresses;
public keys and certificates;
software facts: agent or app version, OS family, CPU architecture, Nebula version and key-storage type, plus, for
Windows, the Nebula file paths and network adapter name;
at check-in: health summaries, short technical events and last-seen times;
the public IP address and port a device connects from, and the local network addresses it reports.
Records:
audit records of who did what, and when;
certificate records;
DNS names that Customer publishes in its org zone.
Special categories: none intended. Customer should not put sensitive data in names or free-text fields.
Not processed:
The content of traffic on Customer's network. It is end-to-end encrypted between devices, and TechSolve's relays
forward it without being able to read it.
In hosted mode, TechSolve holds Customer's network certificate authority in order to run the network.
TechSolve contracts never to use it to join Customer's network or to read its traffic.
The content of DNS lookups made on devices.
Nature and purpose (business purposes):
authenticating people and devices;
issuing certificates and network configuration;
coordinating connections between devices (lighthouses) and relaying encrypted traffic;
answering DNS for the org zone;
monitoring health;
keeping audit and security records;
support;
backup and recovery;
creating aggregated or de-identified data under section 4.2.
Frequency: continuous while the service is used.
Duration:
for the term of the Agreement, and then as section 10 describes;
endpoint and mobile devices unseen for 60 days are marked dormant, then forgotten about 90 days later, unless they
still have a live certificate or hold DNS or configuration. Forgotten devices are copied to the device archive;
infrastructure devices, such as edge, lighthouse and relay nodes, are not removed automatically;
device events are kept for 30 days.
We are building retention limits for:
the device and certificate archives;
admin-approval IP addresses;
sessions;
server and relay logs.
Competent supervisory authority: as clause 13 of the Standard Contractual Clauses sets out, where they apply.
Annex II: Technical and organizational measures
Traffic encryption. Network traffic is end-to-end encrypted between Customer's devices. Relays forward it
without being able to read it.
Certificate authority custody. In hosted mode, TechSolve's signing service holds each org's network CA keys in
managed key stores, with recovery copies held offline. They are used only to issue that org's certificates and
configuration.
No passwords. People sign in with passkeys (WebAuthn) or through Customer's own identity provider. TechSolve
stores only public keys.
Hardware-backed device keys.
Device keys are created on the device and are never exported to TechSolve.
They are kept in hardware-backed storage where the device has it: TPM or CNG on Windows, StrongBox or TEE on
Android.
Org isolation. Row-level security separates each org's records in the database.
Tamper-evident audit. The audit log is hash-chained and append-only. The service's database role cannot alter
or delete its entries.
Encryption in transit and at rest.
All control traffic uses TLS or Nebula.
Databases, backups and key stores use the cloud provider's encryption at rest.
Backups.
The database is backed up nightly to immutable (WORM) storage in a second US region.
There are also 14 days of point-in-time recovery.
Hosting. Microsoft Azure, in the East US 2 and Central US regions, USA.
Access control.
Staff access is limited, needs strong authentication and is logged.
The console has role-based access (Owner, Admin, Tech, Viewer) and step-up authentication for sensitive changes.
Minimisation.
The Windows agent does not read usernames, serial numbers or MAC addresses.
The Android app has no analytics, crash-reporting or advertising SDKs.
The in-app DNS resolver does not log query names.
Edge splash pages log only the time, the requested TLS server name (SNI hostname) and the status.