Data Processing Agreement

1. Parties and how this agreement applies

MSD is provided at mastermindsecuritydesign.com and is operated by Mastermind Security Solutions Ltd, a company registered in England and Wales under company number 13344765, whose registered office is at 10 Indus Road, Shaftesbury, SP7 8FU, United Kingdom (“we”, “us”, “our”). Contact: support@mastermindsecuritydesign.com (support and privacy), billing@mastermindsecuritydesign.com (billing).

This Data Processing Agreement (“DPA”) is made between us, as processor, and the customer that holds the MSD account or workspace (“you”), as controller. It forms part of the Terms of Service and applies on every plan, Free included. You accept it when you accept the Terms at sign-up. It is intended to meet Article 28(3) of the UK GDPR and, where it applies, the EU GDPR. If this DPA and the Terms conflict on the processing of personal data, this DPA takes precedence.

Enterprise customers can ask for a signed, custom data processing agreement. Until one is signed, this standard DPA applies.

This DPA covers personal data that you or your users put into MSD (“Customer Personal Data”). It does not cover the personal data we use as a controller to run your account, such as your sign-in details, billing contacts and support messages; the Privacy Notice covers those.

2. Details of the processing

• Subject matter: hosting MSD and processing Customer Personal Data so that we can provide it to you.
• Duration: for as long as you use MSD, and then until the data is deleted as described in section 8.
• Nature and purpose: storing, versioning, retrieving, displaying and exporting project files and workspace data; generating reports and drawings when you ask; sending the service emails that the workspace sends, such as invitations; and providing support when you grant access.
• Types of personal data: names, job titles and contact details of people named in projects; site, building and location information; descriptions of security equipment and its placement; plan images, photographs or documents you upload; the names and email addresses of workspace members and invitees; and anything else you choose to include. MSD is not designed for special category or criminal offence data. Do not upload it, including camera images that identify people.
• Data subjects: your staff and workspace members, your clients and their staff, site contacts, and anyone else whose details you include in a project.

3. Our obligations as processor

• We process Customer Personal Data only on your documented instructions. The Terms, this DPA and the way you use MSD form those instructions. The exception is where UK law requires otherwise; in that case we tell you first, unless the law forbids it. We tell you if we think an instruction breaks data protection law.
• Everyone we authorise to process Customer Personal Data is bound by confidentiality.
• We apply the technical and organisational measures in Annex 1 (Article 32 UK GDPR). We may improve them, but we will not reduce the overall level of protection.
• We use sub-processors only as described in section 4.
• We help you meet your obligations on data subject requests (section 6), security, breach notification (section 5), data protection impact assessments and prior consultation with the ICO, taking into account the nature of the processing and the information available to us.
• At the end of the service we delete or return Customer Personal Data as set out in section 8.
• We make available the information needed to show compliance with Article 28 and support audits as set out in section 9.

4. Sub-processors

You give general authorisation for us to use the sub-processors below. Each one is bound by written terms that protect personal data at least as well as this DPA. We remain responsible to you for their performance.

Changes to sub-processors. At least 30 days before we add or replace a sub-processor, we update this page and email the owner of each workspace. You can object on reasonable data protection grounds by emailing support@mastermindsecuritydesign.com within that period. If we cannot reasonably meet the objection, you may close the affected workspace or account before the change takes effect. For a paid plan, we refund any prepaid fees for the period after closure.

5. Personal data breaches

We notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. We send the notice to the workspace owner's email address. As far as the information is available, it includes:

• the nature of the breach, the categories and approximate numbers of people and records concerned;
• the likely consequences;
• the measures taken or proposed.

We add information as it becomes available. A notice is not an admission of fault.

6. Data subject requests

MSD lets you find, correct, export and delete the data in your workspaces yourself, which answers most requests. If we receive a request directly about Customer Personal Data, we pass it on to you and do not respond ourselves, except to say who to contact. If you cannot answer a request with the tools in MSD, we help you within a reasonable time.

7. Data location and international transfers

Customer Personal Data is stored in the EU and the UK as described in section 4, and processed in the UK by us. Some processing by sub-processors may happen outside the UK and EU, for example on Cloudflare's global network, or by Google or Microsoft during sign-in. Where it does, we rely on UK adequacy regulations, or on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, where applicable.

8. Return and deletion

• Return: while your account is open, you can download your data at any time from Account settings. The download is a ZIP file with your account details and the current project file of each project. Each project can also be downloaded on its own.
• Deletion by you: deleting a project moves it to the trash. Projects left in the trash for 30 days are permanently deleted with all their versions by a daily job, and you can delete them sooner from the trash. Deleting your account permanently deletes the workspaces you own straight away, including their projects, all versions and stored files.
• End of a paid plan: the workspace moves to the Free plan and the projects are kept until you delete them or close the account. If you want everything deleted at the end of the contract, close the account or email support@mastermindsecuritydesign.com.
• Older versions: project versions older than your plan's version history are deleted automatically.
• Backups: the database's point-in-time recovery history, provided by Cloudflare, keeps earlier states for up to 30 days. Deleted records drop out of it after that. We keep no separate backup copies of project files, so deleted files are not recoverable.
• Records we keep: security audit-log entries, which hold an email address and the action taken, and email delivery records, which hold the recipient, template and time but not the message content. We keep these as the controller under the Privacy Notice, and also where the law requires us to keep data. [Retention period for these records to be confirmed.]

9. Information and audits

Once a year, or after a personal data breach, you may send us a written security questionnaire. We answer it within 30 days, in good faith and with reasonable detail, using this DPA and Annex 1 as the basis. We share our security review on request, under confidentiality. Where a written answer cannot reasonably show compliance, or a regulator requires it, we agree a proportionate further audit with you. You give reasonable notice and meet your own costs.

10. Liability and changes

The limits of liability in the Terms apply to this DPA, unless the law does not allow them to. We may update this DPA to reflect changes in the law or in MSD. We give notice as for the Terms and never reduce the protection of Customer Personal Data. Each version has a date, and we record the version you accepted with your account.

Annex 1 — Technical and organisational security measures

This annex lists the measures MSD has in place today.

• Encryption in transit: HTTPS only, with TLS provided by Cloudflare. Browsers are told to use HTTPS only (HSTS). A strict Content Security Policy is applied to the site and the app.
• Encryption at rest: Cloudflare D1 and R2 encrypt stored data at rest, with keys managed by Cloudflare.
• Passwords: stored only as scrypt hashes with a secret server-side key (pepper), never in plain text. Passwords must have at least 12 characters, and common passwords are refused.
• Sign-in protection:
  • Cloudflare Turnstile bot checks on sign-up, sign-in and password reset.
  • Rate limits, and a temporary lock on an account after repeated failed sign-ins.
  • Optional two-factor authentication (authenticator app) for every user.
  • Google and Microsoft sign-in use the authorisation-code flow with PKCE, state and nonce. ID-token signatures are verified against the provider's published keys, and the issuer is checked (per tenant for Microsoft). Accounts are linked only on a verified email address.
• Sessions: secure, HTTP-only cookies bound to this site, with protection against cross-site request forgery. Sessions are revoked on sign-out and on password change, and they expire after inactivity and after a fixed maximum time.
• Administrative access: two-factor authentication is mandatory for MSD's owner/admin account. The admin functions refuse any session that has not completed it. Admin sessions expire after a shorter period of inactivity.
• Per-tenant isolation: every request for workspace data checks that the user is a member of that workspace, with role-based permissions (owner, admin, designer, viewer). Automated tests check that one customer cannot reach another customer's data.
• Support access: MSD staff cannot open your project files unless a workspace admin grants time-limited support access. Each grant and each file access is recorded.
• Audit log: security-relevant events are recorded. These include sign-ins and failures, two-factor changes, role changes, data exports and account deletion, support access, and administrative actions, which require a stated reason. Workspace admins can see their workspace's log.
• Data minimisation: email delivery records keep metadata only, not message content. Analytics are opt-in, use no cookies and count page views only. Passwords, tokens and two-factor secrets are never written to logs.
• Development: automated access-control and tenant-isolation tests are part of the build checks. Dependencies are pinned and their licences checked. A security review against the OWASP ASVS was carried out before launch; an independent penetration test has not yet been done.

Contact

Data protection questions and requests: support@mastermindsecuritydesign.com.