Data processing agreement (dpa) — ZeroTier

Cited by

Facts read from this source

• DPA available Report an error

  “ZeroTier Data Processing Addendum October 2025 This Data Processing Addendum (“DPA“) supplements and forms part of the agreement (the “Agreement“)”

• UK addendum Report an error

  “This paragraph 2 (UK Addendum) shall apply to any transfer of Covered Data from the Organization (as data exporter) to ZeroTier (as data importer)”

• Swiss addendum Report an error

  “This Swiss Addendum will apply to any Processing of Covered Data that is subject to Swiss Data Protection Laws or to both Swiss Data Protection Laws and the EU GDPR.”

• Governing law Report an error

  “With regard to Clause 17 of the Standard Contractual Clauses (Governing law), the Parties agree that option 1 will apply and the governing law will be Dutch law.”

• Supervisory authority Report an error

  “The competent supervisory authority is Autoriteit Persoonsgegevens (Dutch Data Protection Authority).”

• List URL Report an error

  “As listed at the ZeroTier Trust Center: https://trust.zerotier.com”

• Change notice days Report an error

  “ZeroTier will provide the Organization with at least fourteen (14) days’ notice of any proposed changes to the Authorized Sub-processors.”

• Certifications in lieu of audit Report an error

  “the certification or documentation is dated within twelve (12) months of the Organization’s audit request; and (b) ZeroTier confirms that there are no known material changes in the controls audited, The Organization agrees to accept that certification or documentation in lieu of conducting a physical audit of the controls”

• Encryption at rest Report an error

  “ZeroTier encrypts data at rest using AES-256 and in transit using TLS 1.2 or higher.”

• Encryption key storage Report an error

  “Encryption keys are stored separately from the encrypted information.”

• MFA Report an error

  “use of multi-factor authentication to access data on ZeroTier’s systems;”

• Vendor audits Report an error

  “The Data Importer conducts audits of vendors (including subprocessors) that have access to the ZeroTier’s data by reviewing vendors’ security accreditation (such as ISO 27001 or SOC II) reports.”

• Vm hardening Report an error

  “ZeroTier ensures that all virtual machines are hardened in accordance with the Center for Internet Security (CIS) Benchmarks.”

• Disaster recovery Report an error

  “ZeroTier has a documented disaster recovery plan that ensures that key systems and data can be restored in a timely manner in the event of a physical or technical incident.”

• Data breach notification Report an error

  “ZeroTier shall notify the Organization in writing without undue delay after becoming aware of any Security Incident.”

• Return deletion Report an error

  “if requested to do so by the Organization (on behalf of its Customers, as appropriate) within sixty (60) days of expiry of the Agreement (the “Retention Period”), provide a copy of all Covered Data in such commonly used format as requested by the Organization”

• Backup overwrite period Report an error

  “back-ups of personal data processed by ZeroTier on behalf of the Organization are overwritten on a regular basis and in any event every sixty (60) days to ensure deletion and rectification requests are fully actioned.”

• Deletion of covered data Report an error

  “on expiry of the Retention Period, delete all copies of Covered Data Processed by ZeroTier or any Authorised Sub-processors”

• Controller roles Report an error

  “for the purposes of the GDPR, ZeroTier acts as a controller with respect to the Processing of Usage Data and Administration Data for the Controller Purposes.”

• No data sale Report an error

  “ZeroTier is prohibited from: (a) selling Covered Data or otherwise making Covered Data available to any third party for monetary or other valuable consideration;”

• Deidentified data commitment Report an error

  “publicly commit to Process the Deidentified Data solely in deidentified form and not to attempt to reidentify the information;”

• Fips 140 3 Report an error

  “FIPS 140-3 Certificate #5424”

• Fips algorithms Report an error

  “FIPS 203 FIPS 204”

• SOC 2 type ii Report an error

  “SOC 2 Type II”

• GDPR badge Report an error

  “SOC 2 Type II GDPR”

• Importer entity Report an error

  “Data Importer (Processor) ZeroTier Inc. 48 Market St #911530 San Francisco, California 94104”

• Privacy contact Report an error

  “privacy@zerotier.com”

• Categories processed Report an error

  “Name, contact information (including email), role at the Organization; Encrypted data packets transferred by Authorized Users through the Service; Contents of tickets raised, requests and communications sent to ZeroTier; and Usage data relating to use of the Services, including IP address.”

• Transfer frequency Report an error

  “Frequency of the transfer Continuous”

• Products named Report an error

  “ZeroTier Inc. processes personal data solely for the purpose of providing its networking services (“ZeroTier One” and “ZeroTier Central”) and related technical support to the Customer in accordance with the Agreement.”

3 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The DevOps Engineer European sovereignty
• The IT Lead European sovereignty
• The MSP Technician European sovereignty
• The Operations Manager European sovereignty
• The Information Security Officer European sovereignty
• The Skeptic European sovereignty