DPA and subprocessors

When your team uses kanman, kanman processes personal data on your behalf: the names and email addresses of your members, and any personal data that appears in your stories, repositories or tracker. Under the GDPR this requires a data processing agreement (DPA).

The DPA

The data processing agreement is published on the kanman website:

• English: kanman.ai/en/dpa/
• German: kanman.ai/de/avv/

It covers the subject and duration of processing, the types of data and data subjects, the technical and organisational measures, and the rules for subprocessors.

Subprocessors

kanman uses a small number of subprocessors, for example for hosting and for the language model providers that the coding agent and the reviewer use. The current list of subprocessors, with their purpose and location, is part of the DPA.

Which model provider processes data for your runs depends on your executor and on whether you bring your own key. With your own key, the provider works under your contract, not as kanman’s subprocessor, for the coding agent’s work. The independent reviewer and the writing of acceptance specs currently use kanman’s model providers for every team. See What model providers see.

Changes to subprocessors

kanman announces new subprocessors before they start processing your data, as described in the DPA. Workspace owners receive the notice by email and can object within the period the DPA sets.

Technical and organisational measures

The measures that matter most for a coding agent are described in these pages:

• Hosting and data residency: where code runs and data is stored
• Sandbox and secrets: run isolation, scoped tokens, secret names only
• Retention and deletion: what is kept and for how long

Questions

For a signed copy of the DPA, a security questionnaire or questions about a pilot, write to [email protected].