Data Processing Agreement

1. Parties and scope

This agreement is between you (the “Controller” — the person or organisation administering a Discord server that uses this service) and Titan Software z.s. (zapsaný spolek (registered association)), Czech Republic, ID 29738725 (the “Processor”).

It applies to personal data the Processor processes on your instructions, and forms part of the Terms of Service. It does not apply to data the Processor processes for its own purposes as a controller — your account, billing, platform security, abuse prevention, and the shared threat lists — which are covered by the privacy policy. Section 3 states the boundary precisely, because getting it wrong is the most common defect in agreements of this kind.

2. Subject matter, duration, nature and purpose

• Subject matter: automated security monitoring, threat detection and moderation enforcement for your Discord server, plus the dashboard, snapshots, deny lists and API that support it.
• Duration: for as long as the bot is present in your server or you hold dashboard access, plus the deletion periods in section 9.
• Nature and purpose: collecting, evaluating, storing and acting on data about your server's members according to the configuration you set.

3. Categories of data and data subjects

Data subjects: members of your Discord server, and the people you grant dashboard access to.

Special categories (Art. 9): not deliberately processed. Message excerpts, where you enable them, can incidentally contain such data because people write what they write — which is a reason to leave excerpts off unless you need them.

4. Processing only on your instructions

The Processor processes the data only to provide the service and only as instructed. Your instructions are: this agreement, the Terms, and the configuration you set in the dashboard or through the API — thresholds, actions, exemptions, retention settings and the sharing opt-ins. Changing a setting changes the instruction.

If the Processor believes an instruction infringes data protection law it will tell you before acting. The Processor will not process the data for its own purposes, except as a controller for the purposes named in section 3 of the privacy policy.

5. Confidentiality

Personnel with access to the data are bound by confidentiality, are granted access only where needed, and platform-operator access requires two independent controls to agree — a database flag and membership of an allowlist held in the deployment configuration. Operator access to a server the operator does not administer is recorded in that server's own audit log, so you can see it.

6. Security measures (Art. 32)

These are measures in place, not aspirations:

• Encryption in transit for all connections, with HSTS on the dashboard.
• Authenticated encryption at rest (AES-256-GCM, per-purpose additional authenticated data) for OAuth access and refresh tokens, webhook URLs and signing secrets, notification destinations, and sensitive game identifiers.
• Pseudonymisation of IP addresses (keyed HMAC, never stored raw), of game identifiers, and of targets in the shared threat table.
• Credential hashing — API keys with scrypt, session tokens as keyed digests. API key plaintext is displayed once and is unrecoverable.
• Tenant isolation — every record carries its server ID, one central authorization check guards every endpoint, and ownership is re-verified on every lookup by record ID. Enforced by an automated test suite on every change.
• Role-based access control with least privilege, and a rank ordering that prevents anyone granting themselves a role at or above their own.
• Append-only audit logging of configuration changes, moderation actions, key issuance, restores, team changes and operator actions — including denied attempts.
• Availability — bounded-batch data processing, distributed rate limiting that fails closed, idempotent enforcement so a redelivered event cannot act twice, health and readiness probes, and graceful shutdown.
• Secure development — static analysis, secret scanning over full history, dependency vulnerability scanning, and a typed data-access layer with no dynamic SQL.

A fuller description is on the security page. The Processor may update these measures provided the level of protection is not reduced.

7. Subprocessors

You give general authorisation for the Processor to engage the subprocessors listed at /subprocessors. That page is the authoritative list and is dated.

• The Processor will give at least 30 days' notice before adding or replacing a subprocessor, by updating that page and notifying you.
• You may object on reasonable data-protection grounds. If the objection cannot be resolved, you may terminate the affected part of the service and have the data deleted under section 9.
• Each subprocessor is bound by data protection obligations no less protective than these, and the Processor remains liable for their performance.

8. International transfers

Discord Inc. (United States) is inherent to the service and cannot be avoided while using Discord. Each provider's location and the safeguard relied on — an adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses — is stated on the subprocessors page. You may request a copy of any safeguard.

9. Deletion and return

These are the periods the service actually enforces:

• On request, at any time. Delete your server from its settings page. Access is revoked immediately, API keys and webhooks are disabled, and all data is permanently deleted after 30 days — a window in which support can undo a mistake.
• On removing the bot. Processing stops immediately. If the bot is not re-added within 30 days, the server is marked for deletion and removed after a further 30 days.
• During the relationship. Data is deleted on the retention schedule in the privacy policy, section 5, enforced by scheduled jobs.
• Return. Incidents and audit records can be exported as JSON or CSV from the dashboard at any time, before or during a deletion grace period.
• Backups follow their own rotation and age out separately; they are not edited to remove individual records.
• Entries in the shared threat lists that you contributed are not deleted when you leave, because other communities rely on them. They expire and are then deleted on the schedule in the privacy policy, and any affected person can have one revoked through the appeal route.

10. Assisting you

• Data subject requests. If a member contacts the Processor directly it will not respond on your behalf, and will refer them to you where the request concerns your instructions. Where you need data to answer a request, the Processor will provide it — the dashboard's incident and audit exports cover most cases, and the Processor will assist where they do not.
• Appeals. For the shared threat lists, where the Processor acts as controller, it operates its own appeal route and will inform you of an outcome affecting an entry your server submitted.
• Impact assessments. The Processor will provide the information you reasonably need for a DPIA or a consultation with a supervisory authority. The privacy policy and this document are intended to be usable as inputs.

11. Personal data breaches

• The Processor will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting data processed on your instructions — leaving you time inside your own 72-hour obligation.
• The notification will describe the nature of the breach, the categories and approximate number of records concerned, the likely consequences, and the measures taken or proposed. Where the full picture is not yet available it will be provided in phases rather than delayed.
• The Processor will assist you in meeting your own notification duties and will not notify your members on your behalf without your instruction.

12. Audits and information

On reasonable written request the Processor will provide the information needed to demonstrate compliance with this agreement. Where that is insufficient, you may audit — subject to reasonable notice, confidentiality, no more than once a year absent a specific concern, and without access to other customers' data.

13. Duration and precedence

This agreement applies for as long as the Processor processes personal data on your instructions. Where it conflicts with the Terms of Service on a data protection matter, this agreement prevails. It is versioned; the current version is 2026-09-04, and material changes are notified in the same way as changes to the Terms.

14. Contact

Data protection: [email protected]. Security incidents: [email protected].