Data Processing Addendum

1. About this Addendum

This Data Processing Addendum (the “Addendum” or “DPA”) is part of the agreement between OS Labs Inc, 705 Lakeview Plaza Blvd, Columbus, OH 43085, United States (“SnitchOS”, “we”, “us”) and the licensing organization (the “Customer”, “you”) under the SnitchOS Terms of Service (the “Agreement”), governing how SnitchOS processes personal data for the Customer monitoring company-owned Windows endpoints.

Where the Customer provides SnitchOS to downstream client organizations (“Client Tenants”), it remains responsible for instructions given to SnitchOS and for its agreements with those Client Tenants. If this Addendum conflicts with the Agreement, it controls for data protection matters.

2. Definitions

Capitalized terms not defined here have the meaning given in the Agreement or applicable data protection law.

• Applicable Data Protection Law: privacy and data protection laws applying here, including the EU/UK General Data Protection Regulation (“GDPR”) and US state laws like the California Consumer Privacy Act, as amended by the CPRA (“CCPA/CPRA”).
• Client Tenant: an organization served by the Customer whose endpoints are monitored through its SnitchOS account.
• Controller, Processor, Data Subject, Personal Data, Processing, and Personal Data Breach: as defined in the GDPR (or the equivalent CCPA/CPRA concepts of “business”, “service provider”, and “consumer”).
• Monitored User: an end-user employee of the Customer or a Client Tenant whose company-owned device is monitored by the agent.
• Endpoint Data: Personal Data described in Section 4.2 that SnitchOS collects from monitored endpoints and connected sources.
• Sub-processor: a third party SnitchOS engages to support the platform, whether or not it processes Endpoint Data; the current list, in Section 7.1, includes vendors processing only account or billing data (e.g., the payment processor), annotated as not processing Endpoint Data.

3. Roles of the parties

For processing Endpoint Data:

• The Customer, or relevant Client Tenant where the Customer acts on its behalf, is the Controller: determining monitoring's purposes and means, deciding which endpoints to enroll, setting productivity and retention rules, and bearing responsibility for its lawful basis.
• SnitchOS is the Processor, processing Endpoint Data only on documented instructions and only to support the platform.

Under CCPA/CPRA, SnitchOS acts as a service provider: we do not sell or share Endpoint Data, do not retain, use, or disclose it for any purpose other than performing the services, and do not combine it with data from other sources except as permitted by law to provide the service.

4. Scope and processing instructions

4.1 Documented instructions

SnitchOS processes Endpoint Data only to deliver, maintain, secure, and support the platform, and only as instructed. Instructions appear in this Addendum, the Agreement, and the Customer's dashboard choices: which endpoints are enrolled, how apps and sites are classified, retention windows, and which optional sources connect. If SnitchOS believes an instruction infringes Applicable Data Protection Law, we will inform the Customer promptly.

4.2 Data we process

The subject matter is workforce activity monitoring on company-owned, MSP-managed Windows devices; the purpose: sample device activity, produce productivity analytics, and retain a reviewable record. Data Subjects are Monitored Users and the Customer's administrators. Categories of Personal Data:

• Active-window metadata: process name and window title;
• Idle/active state, and app/website usage; for websites, only scheme, host, and path are stored, query strings/fragments stripped on the endpoint and again server-side;
• Input as counts only: keystroke, mouse-click, and mouse-distance totals; content is never recorded;
• Screenshots, one frame per minute by default and configurable per tenant between one frame every 30 seconds and one every 60 minutes, deduplicated and skipped while idle;
• Device and OS metadata (hostname, OS version, agent version, logged-in session);
• Administrator identity through Microsoft Entra or Google sign-in (name, work email, and the immutable Entra object ID or Google account ID); and
• Only if connected: Microsoft 365 Graph signals: Entra sign-ins and Teams/Outlook usage by device class.

4.3 Data we do not collect

SnitchOS does not intentionally extract keystroke content, clipboard contents, file contents, message bodies, audio, webcam imagery, saved passwords, or URL query strings and fragments as data fields. Screenshots, window titles, and URL paths can still display sensitive or special-category Personal Data; the Customer must configure collection, access, and retention accordingly.

5. Confidentiality

SnitchOS treats Endpoint Data as the Customer's confidential information. Personnel processing it are bound by written confidentiality obligations, which survive employment or engagement, and are granted only least-privilege access needed to operate and support the service.

6. Security measures

SnitchOS maintains technical and organizational measures appropriate to the risk, aligned with the AICPA Trust Services Criteria. SOC 2 readiness is under way with evidence collection in progress; there is no completed SOC 2 attestation. Current measures:

• Encryption in transit: endpoint-to-API and administrator traffic uses TLS 1.2 or later.
• Tenant isolation: every record carries a tenant identifier, every object-storage key is tenant-prefixed, and every API call is scope-checked; cross-tenant access is refused.
• Signed agent and updates: MSI and agent binaries are Authenticode-signed; updates verify publisher, hash, and a signed manifest before applying.
• Authentication: administrator access is through Microsoft Entra or Google single sign-on only; no local passwords.
• Append-only audit log: every authenticated mutation is recorded with actor, IP address, target, and outcome, retained for three years.
• Access control and disposal: least-privilege access and scheduled hard-deletion of expired data.

Off-site backups are encrypted in transit but not at rest; account for this when assessing risk.

7. Sub-processing

7.1 Authorized sub-processors

The Customer authorizes SnitchOS to engage the Sub-processors below, each bound by written contract terms no less protective than this Addendum's; SnitchOS remains responsible for their performance. The platform runs on infrastructure SnitchOS operates and controls; these Sub-processors support billing, authentication, email delivery, alerting, and hosting.

7.2 Changes to sub-processors

SnitchOS will give prior notice of any Sub-processor addition or replacement, with reasonable opportunity to object on legitimate data protection grounds. If the Customer objects and the parties cannot resolve it, the Customer may terminate the affected service portion as its exclusive remedy. The list above is current and authoritative, updated when it changes.

8. Assistance with data-subject requests

SnitchOS will reasonably assist with Data Subject requests to exercise rights: access, correction, deletion, restriction, and portability under Applicable Data Protection Law. If a Monitored User contacts SnitchOS directly, we will refer them to the Customer, not responding on its behalf except on its instructions.

9. Personal data breach notification

SnitchOS will notify the Customer without undue delay, and in any event within seventy-two (72) hours of becoming aware of a Personal Data Breach affecting Endpoint Data. The notification will describe, to the extent known: the breach's nature, categories and approximate volume of data and Data Subjects affected, likely consequences, and measures taken or proposed. SnitchOS will cooperate with the Customer's notification obligations to regulators and Data Subjects. Notification is not a fault acknowledgement.

10. Audits and information

SnitchOS will make available information necessary to demonstrate compliance with this Addendum, including its security documentation and, when available, a SOC 2 report. Audits beyond that require advance agreement on scope, timing, and cost; they occur no more than once yearly (except where required by a supervisory authority or after a Personal Data Breach), during business hours, under confidentiality, and without unreasonable disruption to SnitchOS or other customers.

11. Return and deletion of data

On termination or expiry, SnitchOS returns or deletes Endpoint Data at the Customer's choice. Absent contrary instruction, an offboarded tenant's Endpoint Data is purged from the platform. Screenshots are retained hot for 30 days, moved to cold storage through day 365, then hard-deleted. Activity events and other Endpoint Data are retained indefinitely by default, not customer-configurable today. The audit log is retained for three years. SnitchOS may retain data longer only where required by law, remaining subject to this Addendum. Residual backups expire through the normal cycle within 14 days of deletion, used only for disaster recovery.

12. International data transfers

Where SnitchOS transfers Personal Data from the European Economic Area, United Kingdom, or Switzerland to a country without an adequacy decision, the applicable European Commission Standard Contractual Clauses (and UK International Data Transfer Addendum, where relevant) apply by reference, with the Customer as data exporter and SnitchOS as importer. SnitchOS will assist with transfer impact assessments and implement supplementary measures where required.

13. Employee-monitoring notice (Customer responsibility)

The Customer, and where applicable its Client Tenants, is solely responsible for the monitoring's lawful basis and any required notice or consent from Monitored Users under Applicable Data Protection Law and employment law. Several US states, including New York, Connecticut, and Delaware, require advance written notice of electronic monitoring; other jurisdictions impose consent or works-council obligations. SnitchOS provides tooling to monitor and disclose; it does not determine the Customer's legal basis or provide employee notices on its behalf. See the security overview and Acceptable Use Policy.

14. Liability

Each party's liability under this Addendum, whether in contract, tort, or otherwise, is subject to the Agreement's liability limitations and exclusions. Nothing here limits liability where not permitted by Applicable Data Protection Law.

15. Contact

For privacy matters and Data-Subject-request assistance, legal notices, or operational and support questions, contact the SnitchOS contact form. See also our Privacy Policy.