Data processing agreement (dpa) — Tailscale

Cited by

Facts read from this source

• DPA available Report an error

  “This Data Processing Addendum (“DPA”) is entered into by and between Tailscale and Customer and sets forth the parties’ obligations with respect to the Processing of Personal Data”

• DPA incorporated into agreement Report an error

  “This DPA is incorporated by reference into the Agreement.”

• DPA conflict precedence Report an error

  “in the event of a conflict between this DPA and the Agreement, this DPA controls except as expressly stated herein.”

• Covered laws Report an error

  “including to the extent applicable the General Data Protection Regulation, Regulation (EU) 2016/679 (“GDPR”), the United Kingdom Data Protection Act of 2018 (“UK Privacy Act”), the Swiss Federal Act on Data Protection (“FADP”), the California Consumer Privacy Act”

• UK sccs Report an error

  “To the extent legally required, the UK SCCs form part of this DPA and will be deemed completed as set forth in Schedule B.”

• Swiss transfers Report an error

  “references to the GDPR in Clause 4 of the EU SCCs are, to the extent legally required, amended to refer to the Swiss Federal Data Protection Act or its successor instead”

• No sell or share Report an error

  “Tailscale will not: (i) “sell” Personal Data (as such term in quotes is defined in applicable Data Privacy Laws); (ii) “share” or Process Personal Data for purposes of “cross-context behavioral advertising” or “targeted advertising””

• No HIPAA baa Report an error

  “Tailscale is not a ‘Business Associate’ under HIPAA, Tailscale does not require any ‘protected health information’ to perform under the Agreement”

• No sensitive data required Report an error

  “Tailscale does not require any special categories of personal information as enumerated under GDPR Article 9(1), “sensitive personal data” as defined by applicable privacy laws, or other sensitive information (including any payment card data, bank account numbers, precise geolocation data, tax identification numbers, Social Security numbers, driver’s license numbers, or other similar government identification numbers) to perform under the Agreement”

• Subprocessor change notice days Report an error

  “At least ten (10) days before enabling any new third party Subprocessor to access or participate in the Processing of Personal Data, we will update the Subprocessor Page and provide notice of the change.”

• Return destruction days Report an error

  “Tailscale will return or destroy Personal Data upon your request and within thirty (30) days of termination or expiration of the Agreement.”

• Retention procedures available Report an error

  “Upon your written request, we will make available to you those portions of our Retention Procedures, redacted as necessary to protect Tailscale Confidential Information, relevant to our Processing of Personal Data.”

• Termination refund on instruction violation Report an error

  “Such notice will entitle Customer to terminate the Agreement (or, if applicable, only the affected Order Form(s)) and receive a prompt pro-rata refund of any prepaid amounts”

• Public authority transparency report Report an error

  “no more than once per calendar year unless otherwise required by Data Privacy Laws, Tailscale will, upon Customer’s written request, provide a report to Customer regarding binding legal requests for disclosure of or access to Personal Data we have received from public authorities”

• Encryption at rest Report an error

  “Data resides at rest in the production environment encrypted with at least AES-256.”

• Encryption control plane Report an error

  “Control plane communication, which includes key exchange and coordinating device connections, employs a custom Noise IK-based protocol with X25519 as described in RFC7748”

• SSO support Report an error

  “We support Single Sign On (SSO) with multiple identity providers via SAML 2.0. We also offer customers the option to use their own identity provider (IdP).”

• Acl permission management Report an error

  “Access Control Lists (ACLs) allow you to define what users, groups, IP addresses, CIDRs, hosts, and tags can connect to each other in your network. ACLs are directional and default deny.”

• Penetration testing Report an error

  “We periodically use an independent third party to perform network penetration tests, application testing, and cloud assessments.”

• SOC 2 report Report an error

  “Our SOC 2 report is available to Tailscale customers on the Tailscale website or upon request (subject to confidentiality).”

• Production access controls Report an error

  “We require a business need to access the production environment. We require connections over our own tailnet or using SSH keys to access the production environment.”

• Peer review and code availability Report an error

  “All source code changes require a peer review and we regularly conduct audits of our source code.”

• Go memory safety Report an error

  “The core functionality of the Tailscale Solution, including the coordination server, logging infrastructure, DERP relay servers, and clients, are written in Go.”

• DPA update process Report an error

  “changes become effective for Customer: upon the next payment period (for Self-Serve customers); upon renewal of Customer’s then-current Order Form Term; or upon the effective date of a new Order Form”

• Schedule c data categories Report an error

  “Contact information (including name, email, role, company)”

• Subprocessor liability Report an error

  “We will remain liable for the acts and omissions of our Subprocessors as if they were our own.”

• Data subject requests Report an error

  “Tailscale will not respond to such Data Subject Requests itself, and you authorize Tailscale to redirect the Data Subject Request as necessary to you for handling.”

4 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The DevOps Engineer Architecture, reliability & security assurance
• The DevOps Engineer European sovereignty
• The IT Lead Architecture, reliability & security assurance
• The IT Lead European sovereignty
• The MSP Technician Architecture, reliability & security assurance
• The MSP Technician European sovereignty
• The Operations Manager Architecture, reliability & security assurance
• The Operations Manager European sovereignty
• The Information Security Officer Architecture, reliability & security assurance
• The Information Security Officer European sovereignty
• The Skeptic Architecture, reliability & security assurance
• The Skeptic European sovereignty