The terms under which OpenVLAN processes personal data on behalf of its customers, per the GDPR and similar regimes. Last updated: August 2026.
When you use OpenVLAN to operate a tailnet, you are the controller (or a processor acting for your own controller) and we are a processor. This DPA covers processing described in the privacy policy: account data, device metadata, and coordination metadata. We never process payload traffic.
We process personal data only to provide the service as documented, on your instructions as expressed through the product and this agreement, and as required by law.
We engage a limited list of subprocessors for hosting, support, and billing. The current list is published and maintained at the subprocessors page. Customers may subscribe to change notifications; material changes get 30 days' notice, during which you may object on reasonable data-protection grounds.
Encryption in transit (AmneziaWG/TLS) and at rest, least-privilege access controls, audit logging, and independent SOC 2 Type II and ISO 27001 programs. Details in the security overview.
We assist controllers with data subject access, deletion, and correction requests to the extent we hold relevant data — typically account and coordination metadata. Requests route through privacy@openvlan.com or your account team.
For transfers out of the EEA/UK, we rely on Standard Contractual Clauses (2021 modules) plus supplementary measures described in our transfer documentation, available on request under NDA.
We notify affected customers without undue delay after confirming a personal data breach affecting their data, with enough detail for the controller to meet its own notification duties.
On termination, customer data is deleted within 30 days, except retention required by law, as described in the privacy policy.
Our independent audit reports (SOC 2, ISO certificates) satisfy the audit-right requirement for most customers; specific contractual audits can be arranged with the enterprise team.
This document is an illustrative template for a demo site and is not legal advice.