Data processing agreement
This agreement sets out how silken processes personal data on your behalf when you use the service. It applies automatically to every customer and forms part of the terms. It is written to satisfy Article 28 of the GDPR and the equivalent provisions of the UK GDPR.
Scope and roles.
Who is who, and which data this covers.
This data processing agreement ("DPA") is between you ("Customer") and Velvet Software Limited, of 29 Earlsfort Terrace, Dublin 2, D02 AY28, Ireland, company registration number 633270 ("silken"). It is part of the terms of service and of any order form or master agreement between the same parties, and it applies from the first day you use the service. If you have signed a separate data processing agreement with silken, that one applies instead.
Customer is the controller of the personal data in the video it submits, in the converted output, and in the job records, URLs and webhook payloads that go with them ("Customer Data"), or its processor where it acts for its own customer. silken is the processor of Customer Data, or the sub-processor where Customer is itself a processor. silken is the controller of Customer's account, billing and contact data and of its own service logs, which the privacy policy governs and this DPA does not.
Terms in this DPA that the GDPR defines — controller, processor, personal data, personal data breach, processing, data subject, supervisory authority — have the meaning the GDPR gives them. "Applicable Data Protection Law" means the GDPR, the UK GDPR, the Data Protection Act 2018 and any other law on personal data that applies to Customer Data.
Instructions and purpose.
silken processes Customer Data to convert video, and for nothing else.
silken processes Customer Data only on Customer's documented instructions, which are this DPA, the terms, and the jobs, profiles and settings Customer submits through the API or the dashboard. The subject matter, duration, nature, purpose, types of data and categories of data subject are in the annex. silken does not process Customer Data for its own purposes, does not sell it, and does not use it to train or improve any model.
If silken believes an instruction infringes Applicable Data Protection Law, it tells Customer without delay and may suspend the instruction until Customer confirms or changes it. If law requires silken to process Customer Data otherwise, silken tells Customer before it does so, unless the law forbids that.
Customer is responsible for having a lawful basis to submit the data, for the media it chooses to convert, and for the storage it signs URLs for. The acceptable use policy applies.
Personnel and security.
Confidentiality of staff, and the measures in the annex.
silken allows its personnel to process Customer Data only where they need to in order to provide the service, and requires them to keep it confidential, including after they stop working for silken.
silken maintains the technical and organisational measures in the annex, which are appropriate to the risk of processing video for the purpose described. silken may update them, but not so as to reduce the overall protection of Customer Data. Customer is responsible for the security of the storage it signs URLs for, of its keys, and of its own systems.
Sub-processors.
General authorisation, a public list, and 30 days' notice of changes.
Customer gives silken general authorisation to use the sub-processors on the sub-processors page. silken has a written agreement with each of them that imposes data-protection obligations no less protective than this DPA, and silken remains responsible to Customer for their performance of those obligations.
silken gives at least 30 days' notice before it adds or replaces a sub-processor that processes Customer Data. The notice is a change to the sub-processors page, with the date it takes effect, and an email to any customer who has asked at the security address to be told. Customer may object on reasonable data-protection grounds within that period by writing to support@silken.io. The parties will then try in good faith to resolve the objection. If they cannot, Customer may end the affected service on written notice, and silken refunds any fees paid in advance for the period after it ends.
International transfers.
Processed in the EEA. Adequacy or standard clauses for anything else.
silken processes Customer Data in the European Economic Area: in Germany, the Netherlands and Ireland, as the sub-processors page lists. silken will not transfer Customer Data to a country outside the EEA, or give a person in one access to it, unless the transfer is covered by an adequacy decision of the European Commission, which today includes Israel, or by the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), or by another mechanism Applicable Data Protection Law recognises.
Where the Standard Contractual Clauses are the mechanism, and the transfer is from Customer as controller to silken as processor, they are incorporated into this DPA as Module Two (and as Module Three where Customer is a processor), with Clause 7 omitted, the option in Clause 9(a) taken as general authorisation with the notice period in section 04, the optional wording in Clause 11 omitted, Irish law and the courts of Dublin chosen for Clauses 17 and 18, and the Irish Data Protection Commission as the competent supervisory authority. For a transfer from the United Kingdom the UK addendum issued by the Information Commissioner applies on the same terms. The annex gives the parties and the description of the transfer.
Data subject requests and assistance.
silken passes them on and helps Customer answer.
If a data subject asks silken for access to, correction, erasure or portability of Customer Data, or objects to its processing, silken does not answer the request itself except to say it has passed it to Customer, and it tells Customer promptly. Taking account of the nature of the processing, silken helps Customer respond to such requests, and with Customer's obligations on security, breach notification, data protection impact assessments and prior consultation, to the extent Customer cannot do so without silken's help. Help beyond what the service already offers is given at reasonable cost agreed in advance.
Personal data breach.
Notice within 72 hours of becoming aware.
silken notifies Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Data. The notice goes to the security contact Customer has given, or otherwise to the account email, and says what happened, the categories and approximate number of data subjects and records affected, the likely consequences, and what silken has done and will do about it. Where silken cannot give all of it at once, it gives it in stages. silken takes reasonable steps to contain and investigate the breach and helps Customer meet its own duty to notify the supervisory authority and data subjects. Notice is not an admission of fault.
Audits.
Documents first, an audit if they are not enough.
silken makes available to Customer the information needed to show that it complies with Article 28 of the GDPR, including its security documentation and completed security questionnaires, which Customer can ask for at the security address. If that does not satisfy Customer, or a supervisory authority requires it, Customer may audit silken's compliance with this DPA once in any 12 months, or more often after a personal data breach, on 30 days' written notice, during business hours, in a way that does not disrupt the service or put other customers' data at risk, with an auditor bound by confidentiality. Each party bears its own costs, and Customer pays for silken's time at its standard rates beyond one day.
Return and deletion.
Working files go with the job. The rest goes on request.
silken removes working files at the end of each job, as the privacy policy describes. Output that silken hosts for Customer is removed at the end of the retention period stated there. When the agreement ends, silken deletes the remaining Customer Data, including job records that contain personal data, within 30 days after Customer asks it to in writing, or returns it to Customer first if Customer asks for that, and confirms the deletion in writing if asked. silken may keep what law requires it to keep, such as invoices, and continues to protect it under this DPA.
Liability, precedence and law.
Liability follows the terms. This DPA prevails on personal data.
Each party's liability under this DPA is subject to the limits in the terms, including the separate limit for breach of data-protection obligations in section 11 of the terms. Nothing in this DPA limits a liability that cannot be limited by law, or the rights of data subjects under the Standard Contractual Clauses.
If this DPA conflicts with the terms, an order form or the privacy policy about the processing of Customer Data, this DPA prevails. If it conflicts with the Standard Contractual Clauses, the clauses prevail. This DPA is governed by the law of Ireland, and the courts of Dublin have exclusive jurisdiction, subject to the clauses where they apply. It lasts for as long as silken processes Customer Data.
Questions about this DPA, a countersigned copy for your records, and security documentation can be requested at support@silken.io. A countersigned copy is not required for this DPA to apply.
Details of processing.
The description Article 28(3) and the Standard Contractual Clauses require, and the security measures.
Security measures
- Isolation of media parsing. The tools that read customer media run inside a sandbox with its own user, mount, network and process namespaces and no capabilities, and the worker refuses to start if it cannot confirm the sandbox.
- No storage credentials. silken holds no credentials to Customer's storage. It uses only the time-limited signed URLs Customer supplies, and refuses to fetch from or deliver to private and reserved network addresses, checking again on every redirect.
- Short-lived working files. Source and output files are staged in a directory of their own for each job on the worker's local disk and removed when the job ends, with a sweep at worker start for anything an abrupt stop left behind.
- Credentials. Passwords are stored as Argon2id hashes; API keys and session tokens as hashes; webhooks are signed with HMAC-SHA256.
- Transport. Connections to the API use TLS; mail uses TLS where the receiving server offers it.
- Access and limits. Every request is authenticated against an account, with rate, concurrency and spend limits per account, and sign-in attempts are limited.
- Logging. API and worker logs record request and job identifiers and errors and are held on silken's own servers; credentials in error messages are removed.
- Location. Processing takes place in Germany and the Netherlands, with service email through Ireland, as the sub-processors page lists.
More detail is in the privacy policy. Customers can ask for the security overview and a completed questionnaire at support@silken.io.