Data Processing Addendum

Customer is the controller of the personal data it submits or authorizes LiveIndex to access. LiveIndexacts as processor and processes that data only on Customer's documented instructions, which include the Terms of Service, this DPA, and Customer's use of the Service, unless required otherwise by law.

LiveIndex processes delivery metadata from the systems Customer connects (pull-request and issue metadata, repository and project names, review activity, timestamps, deployment events) and account data (names, email addresses, organization). Processing is for the purpose of providing the Service: forecasts, summaries, bottleneck detection, and client-ready reports. LiveIndex does not access source code, commit contents, or file diffs.

Customer authorizes LiveIndex to engage the sub-processors listed on our sub-processor page. LiveIndex imposes data-protection obligations on each sub-processor and remains responsible for their performance. We will update that page before engaging a new sub-processor that handles customer data.

LiveIndex maintains technical and organizational measures appropriate to the risk, including tenant isolation, encryption in transit and at rest, application-layer encryption of integration credentials, role-based access control, audit logging, and signature-verified webhooks. These measures are summarized on our Security page.

AI-assisted features send delivery metadata to a sub-processor that does not train on API data by default. Customer may disable AI-assisted features for its organization at any time in settings, after which no such data is sent for AI processing.

LiveIndexwill assist Customer, taking into account the nature of processing, in responding to data-subject requests. Organization owners can export their organization's data and request deletion from within the Service; deletion removes the organization's data and revokes active sessions. On termination, LiveIndex deletes or returns customer data in accordance with its retention practices.

Where processing involves transfer of personal data across borders, the parties rely on a lawful transfer mechanism (such as the Standard Contractual Clauses) as applicable to the sub-processors involved.

For DPA execution or privacy inquiries, use the security contact form.