Data Processing Agreement

1. Parties and roles

Controller means the Customer identified in the Order Form, which decides the purposes and means of the processing of personal data in the Forge service for its organisation and for the tenant workspaces it manages.

Processor means Asterio Group AB, registration number 559289-1856 (VAT number SE559289185601), Ekebovägen 14, 663 32 Skoghall, Sweden, which processes that personal data on the Controller's behalf when providing Forge.

Asterio is an independent controller only for the processing described in its Privacy notice: the account and access records of the people who sign in to the portal, the audit records it needs to secure the service, and its own business records. Everything else that Forge records about the Controller's users, devices and deployments is processed under this DPA.

2. Definitions

Terms written with a capital letter have the meaning given in the Terms of Service or in Article 4 of the GDPR. Personal Data means the personal data described in Annex 1. Sub-processor means another processor engaged by Asterio to process Personal Data. Instructions means the Controller's documented instructions under section 4.

3. Subject matter, duration, nature and purpose

The subject matter of the processing is the operation of Forge for the Controller: recognising and approving devices, installing Windows and drivers on them, recording deployment events and decisions, serving the Controller's site caches, and operating the optional connectors the Controller enables. The processing lasts for the term of the Agreement and the deletion period that follows it. Its nature and purpose, the categories of data subjects and the categories of Personal Data are described in Annex 1.

4. The Controller's instructions

4.1 Asterio processes Personal Data only on the Controller's documented Instructions, including with regard to transfers of Personal Data to a third country, unless Union or Member State law to which Asterio is subject requires otherwise; in that case Asterio informs the Controller of the legal requirement before processing, unless the law prohibits it on important grounds of public interest.

4.2 The Agreement, this DPA and the settings the Controller's administrators make in the portal (registered networks, approval rule, zero-touch, Boot from home, Autopilot registration and group tags, Sentinel destination, site delivery defaults, user roles) are the Controller's complete Instructions. Approving a deployment is an Instruction to erase the selected disk and install Windows. Further Instructions must be given in writing and may incur reasonable additional fees if they go beyond the Service as described.

4.3 Asterio informs the Controller without undue delay if, in its opinion, an Instruction infringes the GDPR or other Union or Member State data protection law, and may suspend the processing concerned until the Controller confirms or changes the Instruction.

5. Asterio's obligations

5.1 Confidentiality. Asterio ensures that the persons it authorises to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process Personal Data only to the extent needed for their tasks.

5.2 Security. Asterio implements and maintains the technical and organisational measures described in Annex 2, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risks to data subjects, so as to ensure a level of security appropriate to the risk (Article 32). Asterio may update the measures provided the level of security is not reduced.

5.3 Sub-processors. Asterio engages Sub-processors only under section 6.

5.4 Assistance. Asterio assists the Controller under section 9.

5.5 Deletion and return. Asterio deletes or returns Personal Data under section 11.

5.6 Information and audits. Asterio makes available to the Controller the information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits under section 12.

5.7 Records and contact. Asterio keeps a record of its processing activities as processor (Article 30(2)) and names a contact for data protection matters: forge@asterio.se.

6. Sub-processors

6.1 The Controller gives Asterio general authorisation to engage the Sub-processors listed in Annex 3 and, subject to this section, further Sub-processors.

6.2 Asterio informs the Controller's Workspace administrators in the portal or by e-mail at least 30 days before it adds or replaces a Sub-processor. The Controller may object in writing within that period on reasonable data protection grounds. If the parties cannot resolve the objection, the Controller may terminate the affected part of the Service, or the Agreement if the Service cannot reasonably be provided without the Sub-processor, and receive a refund of prepaid fees for the remaining term.

6.3 Asterio imposes on each Sub-processor, by written contract, data protection obligations that provide at least the level of protection of this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. Asterio remains fully liable to the Controller for the performance of the Sub-processor's obligations.

6.4 Services that the Controller itself engages are not Sub-processors of Asterio: Microsoft Entra ID, Intune and Autopilot in the Controller's own tenant, the Controller's Microsoft Sentinel workspace, and Microsoft's content delivery for Microsoft 365 Apps. Asterio sends data to them only on the Controller's Instructions.

7. Security measures

The technical and organisational measures in Annex 2 describe the state of the Service at the effective date of this DPA. Asterio keeps them under review and may replace a measure with one that provides equivalent or better protection. The Controller is responsible for the security of its own Microsoft tenant, its users' accounts and devices, its networks, its Forge Cache hosts and the boot media it distributes.

8. Personal data breaches

8.1 Asterio notifies the Controller without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Personal Data. The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact for more information. Information that is not available at first may follow in phases.

8.2 Asterio documents breaches affecting Personal Data and assists the Controller with its notifications to the supervisory authority and to data subjects (Articles 33 and 34). Asterio does not notify the supervisory authority or data subjects on the Controller's behalf unless the Controller instructs it to.

9. Assistance to the Controller

9.1 Taking into account the nature of the processing, Asterio assists the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to data subjects' requests to exercise their rights (Articles 12 to 23). The portal lets the Controller's administrators view, export and remove users, devices and deployment history themselves; for anything else Asterio acts on the Controller's written request. If a data subject contacts Asterio directly about the Controller's Personal Data, Asterio forwards the request to the Controller within five business days and does not answer it on the merits unless instructed.

9.2 Taking into account the nature of the processing and the information available to Asterio, Asterio assists the Controller in ensuring compliance with Articles 32 to 36 (security, breach notification, data protection impact assessments and prior consultation), including by providing the documentation of the Service and the measures in Annex 2.

9.3 Asterio may charge reasonable fees for assistance that goes beyond what the Service provides or that is caused by the Controller's breach of the GDPR.

10. International transfers

Personal Data is stored and processed in Microsoft Azure's Sweden Central region. Asterio does not transfer Personal Data outside the European Union or the European Economic Area and does not instruct its Sub-processors to do so. Where a Sub-processor transfers Personal Data to a third country for its own operations (for example Microsoft for support or service operations), the transfer is governed by that Sub-processor's data protection terms, including the standard contractual clauses adopted by the European Commission and, for Microsoft, the European Union Data Boundary commitments.

11. Deletion and return

11.1 During the Agreement the Controller can export its data through the portal (lists of deployments, devices and users, and per deployment the timeline and device log bundles as one zip file) and, where enabled, continuously to its own Microsoft Sentinel workspace.

11.2 After the end of the Service, Asterio keeps the Controller's data available for export for 30 days, and thereafter deletes all Personal Data, including copies, within 90 days, unless Union or Member State law requires storage of the Personal Data. Database backups expire 35 days after they were taken. Device log bundles are deleted 30 days after upload in any event. Asterio confirms the deletion in writing on request.

11.3 Deletion does not reach copies that the Controller holds: content downloaded to its devices, the content of its own Forge Cache hosts, data exported to its Sentinel workspace, or devices registered in its Autopilot tenant.

12. Audits

12.1 Asterio makes available the information necessary to demonstrate compliance with this DPA: the documentation of the Service, the description of measures in Annex 2, the list of Sub-processors, and, where available, independent audit reports or certifications for the hosting platform.

12.2 Where this information is not sufficient, the Controller, or an independent auditor bound by confidentiality that the Controller mandates, may audit Asterio's compliance with this DPA once per twelve months, and additionally after a personal data breach affecting the Controller or when required by a supervisory authority. The Controller gives at least 30 days' written notice, the parties agree the scope and timing in good faith, the audit is conducted during business hours without unreasonable disruption, and each party bears its own costs. The Controller may not audit the premises or systems of Microsoft; for those Asterio provides Microsoft's audit reports and certifications.

13. Liability

Liability under this DPA follows Article 82 of the GDPR and section 14 of the Terms of Service as far as the GDPR permits a limitation. Each party is liable for the administrative fines imposed on it for its own breach of the GDPR.

14. Term and precedence

This DPA applies for as long as Asterio processes Personal Data for the Controller. In case of conflict, this DPA prevails over the Terms of Service for the processing of Personal Data. Changes to this DPA require written agreement, except that Asterio may update Annex 2 under section 7 and Annex 3 under section 6. This DPA is governed by the law and venue of the Terms of Service.

Annex 1. Description of the processing

Subject matter and purpose. Operation of the Forge Windows deployment service for the Controller: authenticating and authorising the Controller's users; recognising and claiming devices; approving, denying and tracking deployments; delivering verified Windows images and driver packs to the Controller's devices; recording deployment events and device log bundles for troubleshooting; registering devices in the Controller's Windows Autopilot tenant where the Controller enables it; exporting deployment events to the Controller's Microsoft Sentinel workspace where the Controller enables it; enrolling and supplying the Controller's Forge Cache servers; and showing dashboards and notifications about the Controller's deployments.

Nature of the processing. Collection from the Controller's users and devices, storage, structuring, retrieval, display to authorised users, transmission to the Controller's own Microsoft services on its Instructions, and deletion.

Duration. The term of the Agreement and the deletion period in section 11.

Categories of data subjects.

• Employees, contractors and administrators of the Controller, and of organisations whose tenants the Controller manages as workspaces, who sign in to the Forge portal.
• Employees and contractors who operate devices being deployed, whose devices' public network addresses and device identifiers are recorded.
• Where device names or Windows Setup logs contain names of persons, the persons to whom the devices are assigned.

Categories of Personal Data.

• User identity and access: display name, e-mail address or user principal name, Microsoft Entra object ID and tenant ID, workspace role, creation, change and last-seen times, the identity of the person who changed the role.
• Audit records: the acting user's object ID, time and action for approvals, denials, device claims and removals, setting changes, cache enrolments and revocations, notification acknowledgements, and the reason text of incident access.
• Device identity: serial number, manufacturer, model, SMBIOS UUID, device name, architecture, whether the device is known from Autopilot inventory, and the hashes of device proofs (never the proofs themselves).
• Network data: the public IP address of a device at claim and deployment time, the address an approval is bound to, the Controller's registered public IP ranges, and the host name, private address and version of the Controller's Forge Cache servers.
• Deployment data: deployment identifiers, phases, decisions, fixed event codes, numeric exit codes, failure reasons and timestamps.
• Device log bundles: Windows Setup, DISM and driver installation logs, network and disk configuration, firmware, manufacturer and serial facts, and the Forge client logs, redacted by the device of tokens, proofs, passwords, claim codes and hardware hashes; kept 30 days.
• Autopilot registration (where enabled): the device's serial number, manufacturer, model, group tag and hardware hash, transmitted to Microsoft Graph in the Controller's tenant; the hardware hash is held only for the duration of the request and is not stored.
• Microsoft 365 configuration (where enabled): the configuration XML the Controller saves, which may contain the Controller's organisation name.

Special categories of data. None are intended. The Controller must not place special categories of personal data (Article 9) or data relating to criminal convictions (Article 10) in device names, group tags, reason texts or configuration.

Annex 2. Technical and organisational measures

• Identity and access control. Portal sign-in is delegated to Microsoft Entra ID; Forge stores no passwords. Every request is authorised on the server against the validated tenant ID and user object ID, the user's workspace role and the customer scope derived on the server, never from a selector in the request. Forge administrators are an explicitly configured list of identities. Devices authenticate with deployment-bound proofs that expire and are stored as hashes; cache servers authenticate with their own renewable credentials and pinned certificates.
• Transport encryption. All connections between browsers, devices, cache servers and the service use HTTPS with certificate validation. The only exceptions are the initial firmware boot loader, which Secure Boot verifies by signature, and encrypted content blocks exchanged between authorised devices on the same customer site over the Controller's own network.
• Encryption at rest and private networking. Azure encrypts the database and storage at rest. The database, storage and key vault have no public network access and are reachable only through private endpoints; the public portal has no direct access to them and no storage account key exists in the system. Devices read images only through short-lived, read-only grants for one pinned object.
• Integrity of deployed content. Windows images and driver packs are published with signed manifests and verified by length and SHA-256 on the device; boot releases are signed and time-limited; the service never executes manufacturer content.
• Isolation between customers. Customer scope is enforced on every request; resources of another customer are not disclosed (they answer as not found). Rate limits apply per deployment, per device and per address.
• Logging and minimisation. Deployment timelines accept only fixed event codes and numeric exit codes; credentials, device proofs, raw installer output and administrator identities are not uploaded to them. Device log bundles are redacted on the device, limited in size and number, scanned for the device's own proof before acceptance, and deleted after 30 days. Audit tables are append-only for the runtime identity. Raw HTTP logging and request tracing are disabled on the hosting platform.
• Change and release management. Changes are tested before deployment; production deployments and infrastructure changes are recorded with receipts; publishing access is limited to a single build host address and the service's identities have no publishing rights.
• Availability and backups. Azure SQL point-in-time backups are retained for 35 days on zone-redundant storage; images are stored on zone-redundant storage. The Service runs in a single Azure region (Sweden Central).
• Customer-side components. The Forge Cache installer and its executables are Authenticode-signed; the cache stores its credential under Windows DPAPI protection in a folder readable only by administrators and the service account; it serves only private network addresses and only content verified against the Controller's plan.
• Personnel. Asterio personnel with access to the service are bound by confidentiality and limited to the people who operate and support it; administrative access is authenticated through Microsoft Entra ID and recorded.
• Data subject rights support. Administrators can view, change and remove users, devices and deployment history in the portal; per-deployment export is available as a zip file.

Annex 3. Sub-processors

No other Sub-processor is engaged at the effective date of this DPA.

Version 1.0. Effective 9 October 2026.