Data Processing Agreement

1. Roles

For YOUR account data (email, billing, usage), Yes Servicos Digitais is the controller — see the Privacy Policy.

For personal data possibly contained in the PROJECTS you publish (code, served content, environment variables), you are the controller and SimDeploy acts as processor (article 5, VII, LGPD), processing that data exclusively to provide the service: storing, publishing and serving your project.

2. Instructions and purpose

We process your projects' data only according to your instructions as expressed through the product itself (deploying, configuring variables, deleting). We do not access your projects' content except to operate the service, handle a support request from you, or comply with a legal obligation.

3. Security

Technical measures in place: environment variables encrypted at rest (AES-256-GCM); per-organization isolation in every query; builds executed outside the platform's servers; artifacts validated before extraction; tokens stored only as hashes; audit logging of sensitive actions.

4. Subprocessors

We use strictly necessary subprocessors: the infrastructure providers where projects are published (e.g. Cloudflare) and Stripe for payments (billing data, not your projects' data). Relevant changes to this list are communicated.

5. Incidents, return and deletion

Security incidents involving personal data are communicated to the affected customer without undue delay, with the information required by the LGPD.

Upon account closure or project deletion, published content is unpublished and artifacts are deleted from our systems, except backup copies purged on a regular cycle.

Questions and requests: support@simdeploy.com.