Data processing agreement

Section 1 — Roles

You are the controller of the personal data in your workspace. Oneop is your processor. Where you are yourself processing on behalf of your own client, you are their processor and Oneop is a sub-processor; this agreement applies in the same way down the chain.

Oneop is a controller in one narrow respect: data about your account holders as customers of Oneop — names, work emails, billing records, sign-in events. That is governed by the Privacy policy, not by this agreement.

Section 2 — Scope of processing (Art. 28(3)(a))

Section 3 — Your instructions (Art. 28(3)(a))

Oneop processes personal data only on your documented instructions. Your configuration of the Service — the automations you build, the integrations you connect, the emails you send, the AI features you switch on — constitutes those instructions, together with this agreement and the Terms of service.

Oneop will tell you if, in its opinion, an instruction infringes data protection law, and may decline to carry it out.

Oneop will not process your data for its own purposes. Specifically: Oneop does not train, fine-tune or evaluate any model using the content of your workspace, does not sell personal data, and does not use it for advertising.

Section 4 — Confidentiality (Art. 28(3)(b))

Everyone at Oneop with access to personal data is bound by a written confidentiality obligation, and access is granted on a need-to-know basis. Internal operator access is governed by permission tokens rather than by broad roles, so an individual holds only the permissions their job requires.

Section 5 — Security measures (Art. 28(3)(c) / Art. 32)

The full, specific list is published at /security and kept current. The measures material to this agreement:

Separation. 275 of the platform's 329 database tables carry a tenant identifier and every query against them is scoped to the tenant on the session. Isolation is a property of the data layer, not of an application filter a developer has to remember. No route reads or writes across a tenant boundary.

Authentication. Passwords are hashed with scrypt using a 64-byte derived key, a per-user random salt and constant-time comparison. Google and Microsoft OAuth, SAML 2.0 single sign-on with genuine signature, issuer and expiry validation, and SCIM 2.0 provisioning are available. TOTP two-factor is available to tenant users and is mandatory for every Oneop operator.

Session separation. The customer application, the internal operator console and the project client portal are three separate session principals with three distinct cookies and three distinct signing secrets. A production deployment refuses to start if the three secrets are not all different.

Stored credentials. Third-party credentials you give the Service — mailbox passwords, integration keys, DKIM private keys — are encrypted with AES-256-GCM before storage, and no API route returns a private key to a caller.

Egress control. Every surface where you can supply a URL passes an SSRF guard that rejects private, loopback and link-local destinations and re-validates on every redirect hop.

Inbound webhooks fail closed: an unverified or unconfigured signature is rejected rather than trusted.

Logging. The internal operator audit log is append-only, scrubbed of credential material on write, and can be streamed to your own SIEM over HTTPS with an HMAC-SHA256 signature and at-least-once delivery.

What Oneop does not claim. No SOC 2, ISO 27001, PCI DSS or HIPAA certification. No penetration-test report. No uptime SLA. No blanket encryption-at-rest claim: specific credentials and private keys are encrypted by the application, but whole-database and whole-disk encryption are properties of the hosting provider rather than of this software, and Oneop will not assert them as its own control. No region selection: where the platform runs is stated in Section 8 and is the same for every customer.

Section 6 — Subprocessors (Art. 28(3)(d))

You give Oneop general authorisation to engage subprocessors. The current list — each one named, with what it does and what data reaches it — is published and dated at/trust/subprocessors.

Oneop will:

• keep that page current and dated;
• give at least 30 days' notice, by email to account owners, before adding or replacing a subprocessor that processes personal data — the same 30 days committed on the subprocessor register;
• impose data protection obligations on each subprocessor that are no less protective than these; and
• remain liable to you for a subprocessor's performance.

If you object to a new subprocessor on reasonable data-protection grounds, tell us within the notice period. We will discuss it. If we cannot resolve it, you may terminate the affected part of the Service and receive a refund of prepaid, unused fees for it. That is the remedy Oneop offers, deliberately a real one rather than a wider one Oneop could not honour in practice.

6.1 — Integrations you connect yourself are not Oneop subprocessors

When you connect HubSpot, WooCommerce, WordPress, a mailbox, Apollo.io, a shipping carrier, an e-signature provider or a bank feed, you are instructing the transfer using credentials you supply. Those providers are your processors under your own agreement with them. Oneop encrypts the credentials and moves the data you asked it to move; it does not select those vendors on your behalf and does not list them as its subprocessors. They are named on the subprocessors page in a separate section so you can see the full picture.

Section 7 — AI processing

This section exists because it is the question customers actually ask, and because the answer is specific enough to be checkable.

One provider. Google is the sole AI model provider. Every AI call the platform makes goes to Google's Generative Language API. There is no OpenAI, Anthropic or other model provider in the product, and no model routing between providers.

What is sent. Only the content the specific feature needs: for a chatbot reply, the conversation turn and any knowledge-base passages retrieved to ground it; for an AI reply draft, the ticket thread; for document OCR, the uploaded document; for an agent run, the reasoning context that run assembled. Your whole database is not sent, and no AI feature runs unless it is triggered.

What happens before it is sent. Every prompt passes through two steps that run on every call, on every plan, and cannot be turned off:

1. PII redaction — detected personal identifiers are stripped from the prompt before it leaves.
2. Prompt-injection detection — a detected injection pattern blocks the call entirely rather than degrading it.

Metering. Every call passes through a single point that records the usage against your workspace before the model is called, so AI processing is attributable per tenant rather than pooled. A build-breaking test fails Oneop's CI if any agent code bypasses that point or omits the tenant identifier.

Bring your own key. On the Business plan you may supply your own Google API key. If you do, AI calls run against your key and your own account and contract with Google, and Google's handling of that data is governed by your agreement with them rather than by Oneop's.

What Oneop does not represent. Oneop does not train, fine-tune or evaluate any model on your data — there is no training pipeline in the product. Oneop doesnot make representations on Google's behalf about how Google retains, logs or uses data submitted to its API; that is governed by Google's terms for the Generative Language API, and you should read them if the answer matters to your risk assessment. Oneop's commitment is limited to what Oneop controls: what is sent, that it is redacted first, that it is metered, and that it is never used to train anything.

Which Google service, and whose terms. Oneop calls Google's Gemini models through the Generative Language API at generativelanguage.googleapis.com. That processing is governed by Google's Gemini API Additional Terms of Service, published atai.google.dev/gemini-api/terms, which treat paid and unpaid use of the API differently — including on whether Google may use submitted content to improve its services. Which of the two applies is a property of Oneop's Google billing account rather than of this document, so this document does not assert it. If the difference is material to your risk assessment, ask at legal@oneop.io before you rely on it and Oneop will state in writing which tier its deployment uses.

Section 8 — Location of processing and international transfers

Oneop's application and its PostgreSQL database are hosted by Hetzner Online GmbH, in Germany. Both run on the same server; there is no separate database provider. Attachments and uploaded files are held in Cloudflare R2 object storage, in a bucket created in Cloudflare's European Union jurisdiction. Primary processing of your data therefore takes place in the EU.

Personal data may nonetheless be transferred outside your country, because several subprocessors operate in the United States. They are named individually, with the data each receives, at /trust/subprocessors.

Those onward transfers rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), and on the UK International Data Transfer Addendum for transfers originating in the United Kingdom — in each case as incorporated into that provider's own published data processing addendum and accepted as part of Oneop's contract with the provider. They are incorporated by reference, not annexed in full to this agreement, and Oneop relies on no adequacy decision and has negotiated no bespoke clauses. The register at/trust/subprocessors names every provider, so you can read the addendum being relied on for each.

Oneop offers no region selection: Germany and the EU are where the platform runs, not a per-customer option, and Oneop cannot host a workspace elsewhere on request.

Section 9 — Assisting you (Art. 28(3)(e) and (f))

Data subject requests. The Service lets you find, export and correct records yourself. Account owners can export the workspace's contacts, conversations, tickets and deals from within the application, and can request erasure by email address, which anonymises the matching contact and user records. That tooling does not cover every table; for anything beyond those record types, email privacy@oneop.io and we will assist manually and without charge for reasonable volumes.

Personal data breach. Oneop will notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting your data, with the information available at the time and updates as the picture develops. A first notice will not wait on a complete investigation; you will be told what is known and what is still unknown.

Why 48 and not 72. 72 hours is your deadline as controller under Art. 33(1), measured from the moment you become aware. If Oneop took the same 72 hours to tell you, you would be out of time before you started. 48 hours leaves you at least a full day to assess the breach and notify your supervisory authority. It is also a window Oneop can actually meet: it does not depend on a 24/7 security operations centre, which Oneop does not have and does not claim.

Impact assessments. Oneop will provide reasonable assistance with data protection impact assessments and prior consultations, using the information available to it.

Section 10 — Deletion and return (Art. 28(3)(g))

You may export your data at any time while your subscription is active.

On termination, Oneop will delete or anonymise personal data in your workspace within 30 days, except where retention is required by law. Backups are overwritten on their ordinary cycle; Oneop makes no public commitment about backup frequency, backup retention or recovery time, and deliberately states none here, so a copy of your data may persist in a backup after those 30 days and until that backup is itself overwritten.

Internal audit records of operator activity are retained under their own schedule — a floor of one year, with a default of approximately seven — because their purpose is to evidence who did what, and deleting them on request would defeat it.

Section 11 — Audits (Art. 28(3)(h))

Oneop will make available the information reasonably necessary to demonstrate compliance with this agreement, and will respond to a reasonable security questionnaire once per year.

Be aware of what does not exist. Oneop holds no third-party audit report — no SOC 2, no ISO 27001, no penetration-test report — so there is no report to send you in lieu of a questionnaire. What Oneop can offer instead is specificity: theSecurity page names each control, and Oneop will answer questions about any of them in detail.

On-site audits. You may audit Oneop's processing under this agreement once in any twelve-month period, on at least 30 days' written notice, during business hours, at your own cost, subject to confidentiality and to not disrupting the Service or accessing any other customer's data. A supervisory authority exercising a statutory power is not subject to those limits. Oneop is a very small team, and a bounded audit right is what it can genuinely meet — which is why it is bounded rather than open-ended.

Section 12 — Liability and general

Liability under this agreement is subject to the limitations in theTerms of service, except where data protection law prevents that.

This agreement is governed by the law of Pakistan and the courts ofLahore, Pakistan have exclusive jurisdiction — the same law and the same venue as Section 14 of the Terms of service, chosen deliberately so the two documents cannot drift apart. That choice does not displace the data protection law of the country where a data subject is, or that country's supervisory authority and courts, where that law applies of its own force. Nothing here limits a data subject's rights under Art. 79 or Art. 82 GDPR.

Questions or a countersigned copy: legal@oneop.io

Links out

SubprocessorsSecurityPrivacy policyTerms of serviceAI governance

No CTA banner on this page — a legal page ending in a sales banner reads badly and helps nothing.