Legal

Data processing addendum

Last updated October 19, 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other written agreement between Customer and [Company legal entity] (“MergeHarbor”) for the MergeHarbor services (the “Agreement”). It applies whenever MergeHarbor processes Customer Personal Data on Customer’s behalf. If this DPA conflicts with the Agreement, this DPA prevails. If it conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

1. Definitions

“Data Protection Laws” means all laws that apply to the processing of Customer Personal Data under the Agreement. These include the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it forms part of UK law together with the UK Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), along with comparable US state laws.
“Customer Personal Data” means personal data contained in Customer Data (as defined in the Agreement) that MergeHarbor processes on Customer’s behalf.
“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
“UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner, version B1.0, in force from 21 March 2022.
“Subprocessor” means any third party that MergeHarbor engages to process Customer Personal Data.
“Personal Data Breach” means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data that MergeHarbor or its Subprocessors process.
“Controller”, “processor”, “data subject”, “personal data”, “processing”, and “supervisory authority” have the meanings given in the GDPR. “Business”, “service provider”, “sell”, and “share” have the meanings given in the CCPA.

2. Scope and roles

2.1 Customer is the controller, or a processor acting for its own controllers, of Customer Personal Data. MergeHarbor is a processor, or a subprocessor where Customer is a processor. Under the CCPA, MergeHarbor is Customer’s service provider.

2.2 MergeHarbor is an independent controller of the personal data it processes for its own business purposes, such as account administration, billing, security, and its own legal compliance. The Privacy Policy describes that processing, and this DPA does not cover it.

2.3 Self-hosted deployments. When Customer runs MergeHarbor software in its own environment, Customer Data stays in that environment and is sent only to the model providers that Customer configures. MergeHarbor does not process Customer Personal Data from such a deployment. The exception is personal data that Customer chooses to share with MergeHarbor, for example in a support request, and this DPA applies to that data.

2.4 Annex I describes the subject matter, nature, purpose, and duration of the processing, and the categories of data and data subjects.

3. Customer’s instructions

3.1 MergeHarbor processes Customer Personal Data only on Customer’s documented instructions, unless the law requires otherwise. Where the law requires other processing, MergeHarbor will tell Customer before processing, unless the law prohibits it. Customer’s instructions are set out in the Agreement and this DPA, and in Customer’s configuration of the services, such as connected repositories, routing mode, model-provider, model and region restrictions, and retention periods. Customer may give additional written instructions that are consistent with the Agreement.

3.2 MergeHarbor will tell Customer promptly if, in its opinion, an instruction infringes Data Protection Laws.

3.3 Customer is responsible for the lawfulness of its instructions and of the Customer Personal Data it submits. This includes having a legal basis for the processing and giving any notices that are required, for example to developers whose commits and comments are reviewed.

3.4 CCPA. MergeHarbor will not:

sell or share Customer Personal Data;
retain, use, or disclose it for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship with Customer;
combine it with personal data MergeHarbor receives from other sources, except as the CCPA permits.

MergeHarbor will comply with the CCPA’s obligations that apply to it and will tell Customer if it can no longer meet them. Customer may take reasonable steps to stop and remediate unauthorized use.

3.5 No training. MergeHarbor will not use Customer Personal Data or any other Customer Data to train, fine-tune, or improve machine-learning models. It will engage model providers only under terms that prohibit them from doing so.

4. Confidentiality

MergeHarbor limits access to Customer Personal Data to personnel who need it to provide, support, or secure the services. Those personnel are bound by written confidentiality obligations, or a statutory duty of confidentiality, and receive appropriate data protection and security training.

5. Security

5.1 MergeHarbor implements and maintains the technical and organizational measures described in Annex II. These measures are designed to protect Customer Personal Data against Personal Data Breaches and to provide a level of security appropriate to the risk, as required by Article 32 GDPR.

5.2 MergeHarbor may update these measures over time, but will not materially reduce the overall level of security during the term of the Agreement.

5.3 Customer is responsible for the security settings it controls, such as single sign-on enforcement, roles, API keys, IP allowlists, retention periods, and data residency settings, and for securing its own self-hosted deployments.

6. Subprocessors

6.1 Authorization. Customer gives MergeHarbor general authorization to engage Subprocessors. Customer approves the Subprocessors listed in Annex III as of the date of this DPA.

6.2 Model providers and routing. To review pull requests on the hosted service, MergeHarbor sends redacted diffs and code context to the model providers listed in Annex III. Which provider handles a request depends on Customer’s routing settings and the risk of the change. Where Customer has restricted providers, models, or regions in its data residency settings, MergeHarbor routes Customer Personal Data only to the Subprocessors and regions those settings permit. Where Customer supplies its own model-provider accounts, that provider acts under Customer’s own agreement with it and is not MergeHarbor’s Subprocessor.

6.3 Obligations. MergeHarbor will:

engage each Subprocessor under a written agreement whose data protection obligations are no less protective than this DPA, to the extent applicable to the services it provides;
assess each Subprocessor’s security and privacy practices before engaging it;
remain liable to Customer for each Subprocessor’s performance of those obligations.

6.4 Changes and objections. MergeHarbor will give at least 30 days’ notice before a new Subprocessor processes Customer Personal Data. Notice is given by updating Annex III and emailing customers who have subscribed to notifications at privacy@mergeharbor.com. Customer may object in writing on reasonable data protection grounds within that 30-day period. The parties will then discuss the objection in good faith. Where available, MergeHarbor may offer a change in configuration that avoids the new Subprocessor, for example by excluding a model provider from Customer’s routing. If the parties cannot resolve the objection within 30 days, Customer may terminate the affected services by written notice and receive a refund of prepaid fees for the remainder of the term. In an emergency, for example to replace a Subprocessor that has failed or has been compromised, MergeHarbor may make a change on shorter notice and will tell Customer as soon as reasonably possible.

7. Assistance

7.1 Data subject requests. Taking into account the nature of the processing, MergeHarbor will help Customer, by appropriate technical and organizational measures, to respond to requests from data subjects to exercise their rights. The console and API let Customer export and delete review data, manage users, and set retention periods. If MergeHarbor receives a request directly, it will forward the request to Customer without undue delay and will not respond itself, except to direct the data subject to Customer.

7.2 Impact assessments and consultations. MergeHarbor will give Customer reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to MergeHarbor.

7.3 Government requests. If MergeHarbor receives a legally binding request from a public authority for Customer Personal Data, it will take the following steps, unless the law prohibits them:

refer the authority to Customer and notify Customer promptly;
challenge the request where there are reasonable grounds to consider it unlawful;
disclose only the minimum information required.

8. Personal Data Breaches

8.1 MergeHarbor will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach. Notice goes to the email addresses of Customer’s organization owners, and to any security contact Customer has designated.

8.2 The notice will describe the following, to the extent known, and MergeHarbor will provide further information as it becomes available:

the nature of the breach;
the categories and approximate number of data subjects and records concerned;
the likely consequences;
the measures taken or proposed to address the breach and mitigate its effects;
a contact point for more information.

8.3 MergeHarbor will promptly take reasonable steps to contain, investigate, and remediate the breach. It will cooperate with Customer so that Customer can meet its obligations to notify supervisory authorities and data subjects.

8.4 Notifying a breach is not an admission of fault or liability.

9. Deletion and return

9.1 During the term, Customer can export its review data from the console or API and can delete repositories, reviews, or its entire organization. It can also set a retention period after which review data is deleted automatically.

9.2 After the Agreement ends, Customer has 30 days to export its data. MergeHarbor then deletes Customer Personal Data from production systems within 30 days, including repository mirrors and indexes. Backups are deleted as they expire, within [Backup retention period, e.g. 90] days. If Customer deletes its organization, deletion starts after a 7-day grace period. MergeHarbor may retain Customer Personal Data where Union, Member State, or other applicable law requires it. In that case MergeHarbor keeps it confidential and processes it only for the purpose the law requires.

9.3 On request, MergeHarbor will confirm deletion in writing.

10. Audits

10.1 MergeHarbor will make available to Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA. This includes:

written responses to reasonable security and privacy questionnaires;
a description of its security measures;
any independent audit reports or certifications MergeHarbor holds at the time, provided under confidentiality.

10.2 If that information is not enough to demonstrate compliance, or if a supervisory authority requires it, Customer may audit MergeHarbor’s compliance itself or through an independent auditor bound by confidentiality. The following conditions apply:
Customer gives at least 30 days’ written notice.
Audits take place no more than once in any 12-month period, except after a Personal Data Breach or where a supervisory authority requires otherwise.
Audits take place during business hours, under a scope and plan agreed in advance.
Audits are carried out in a way that does not disrupt MergeHarbor’s operations or compromise the confidentiality or security of other customers’ data.
Each party bears its own costs.

10.3 This section applies in addition to the audit rights in the Standard Contractual Clauses and is intended to give effect to them.

11. International transfers

11.1 MergeHarbor and its Subprocessors may process Customer Personal Data in Australia (AWS Asia Pacific (Sydney) region) and in other countries where the Subprocessors in Annex III operate, subject to Customer’s data residency settings.

11.2 EEA transfers. Where Customer Personal Data is transferred from the European Economic Area to MergeHarbor, or onward to a Subprocessor, in a country that does not have an adequacy decision, the Standard Contractual Clauses are incorporated into this DPA by reference. They apply as follows:

Module 2 (controller to processor) applies where Customer is a controller, and Module 3 (processor to processor) applies where Customer is a processor.
Clause 7 (docking clause) applies.
In Clause 9, Option 2 (general written authorization) applies, with the notice period set out in section 6.4.
The optional language in Clause 11 does not apply.
In Clause 13, the competent supervisory authority is the one determined in accordance with that clause.
In Clause 17, Option 1 applies, and the governing law is the law of [EU Member State for SCCs, e.g. Ireland].
In Clause 18(b), disputes are resolved by the courts of the same Member State.
Annexes I, II, and III of this DPA complete Annexes I, II, and III of the SCCs.

11.3 UK transfers. For transfers subject to the UK GDPR, the UK Addendum is incorporated into this DPA and completed with the information in the SCCs and in Annexes I to III. For Table 4 of the UK Addendum, either party may end it as set out in Section 19 of the UK Addendum.

11.4 Swiss transfers. For transfers subject to Swiss law, the SCCs apply with the following changes:
References to the GDPR are read as references to the Swiss Federal Act on Data Protection.
The competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.
“Member State” includes Switzerland, so that data subjects in Switzerland can enforce their rights there.

11.5 Alternative mechanisms. If a transfer mechanism is invalidated or replaced, the parties will cooperate to rely on a valid alternative mechanism. MergeHarbor may rely on the EU-US Data Privacy Framework or its UK and Swiss extensions where MergeHarbor or a Subprocessor is certified.

12. Liability and term

12.1 Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, unless Data Protection Laws or the SCCs prohibit this.

12.2 This DPA remains in effect for as long as MergeHarbor processes Customer Personal Data on Customer’s behalf.

To request a signed copy of this DPA, contact legal@mergeharbor.com.

Annex I: Description of processing

A. Parties

Data exporter: Customer, as identified in the Agreement or Order Form. Contact: the organization owner on Customer’s account. Role: controller, or processor on behalf of its controllers.
Data importer: [Company legal entity], [Registered address]. Contact: privacy@mergeharbor.com. Role: processor, or subprocessor.

The parties sign Annex I by entering into the Agreement.

B. Categories of data subjects

Customer’s Users, such as developers, reviewers, and administrators.
Authors, committers, and commenters whose information appears in Customer’s repositories and pull requests, including Customer’s contractors and contributors to open-source projects that Customer connects.
Any other individuals whose personal data Customer includes in source code, pull requests, rules, or knowledge documents.

C. Categories of personal data

Names, usernames, user IDs, and email addresses from code hosts and identity providers.
Commit and pull-request metadata, such as author, timestamps, and branch names.
Contents of pull-request titles, descriptions, comments, and review feedback.
Any personal data that is present in source code or configuration.
Group memberships shared through single sign-on.
IP addresses and user agents recorded in audit logs.

D. Special categories of data

None are intended. Customer agrees not to submit special categories of personal data, except as incidentally contained in source code. The measures in Annex II apply to any such data.

E. Frequency of transfer

Continuous, for as long as Customer uses the services.

F. Nature of the processing

Mirroring and indexing connected repositories, including code search, dependency graphs, and embeddings.
Redacting secrets.
Sending pull-request diffs and code context to AI model providers to generate review findings.
Verifying findings.
Posting review comments and status checks to Customer’s code host.
Storing reviews, findings, usage records, analytics, and audit logs.
Providing support.

G. Purpose of the processing

To provide, secure, and support the MergeHarbor services for Customer under the Agreement.

H. Retention

Review data (reviews, findings, and usage records) is kept for the retention period that Customer sets, or for the term of the Agreement if no period is set.
Repository mirrors and indexes are kept while the repository is connected. Mirrors may be evicted from worker disks and re-created when needed.
Audit logs are kept for the period agreed with Customer.
After termination, all of the above is deleted as described in section 9.

I. Transfers to Subprocessors

The subject matter, nature, and duration of each Subprocessor’s processing are described in Annex III.

Annex II: Technical and organizational measures

Architecture and isolation

Every request is scoped to one organization. Users and API keys from other organizations receive “not found”, so the existence of an organization is not disclosed.
Repository indexes are stored in independent cells.
The review agent can read only the repository and commit it was asked to review, using short-lived signed tokens.
Self-hosted deployment is available on Kubernetes or AWS for customers who need Customer Data to remain in their own environment.

Data minimization and redaction

Before content reaches a model, logs, or archives, the following are removed: API keys, tokens, private keys, JWTs, passwords in connection strings, and high-entropy secret assignments.
Each pull request is reviewed with the diff and only the code context that is relevant to it.
Repository mirrors are partial clones that exclude files above a size limit.

Encryption

TLS 1.2 or higher is used in transit, with optional mutual TLS between internal services.
Data is encrypted at rest.
Code-host tokens and identity-provider secrets are additionally encrypted with AES-256-GCM using rotatable keys.

Access control

Sign-in options include OpenID Connect single sign-on with PKCE, enforceable SSO, domain restrictions, and mapping of identity-provider groups to roles.
Built-in roles and custom roles are available, with checks that prevent users from granting permissions they do not hold.
Passwords are stored as Argon2id hashes. Sessions and API keys are stored only as keyed hashes.
Organizations can set IP allowlists and session lifetimes.
Authentication endpoints are rate-limited.
Internal personnel are granted access on a least-privilege, need-to-know basis.

Logging and monitoring

An audit log records every change, sign-in, permission denial, and export, with actor, IP address, and before-and-after values. Secrets are masked.
Audit records are append-only and hash-chained per organization, so tampering can be detected.
Audit events can be exported as CSV or JSONL.
Services are monitored through metrics and tracing.

Code-host integrations

MergeHarbor requests only the code-host permissions it needs.
Every webhook is authenticated, and replayed webhooks are rejected.
Outbound calls to customer-supplied hosts are restricted to HTTPS and blocked from reaching internal and cloud-metadata addresses.

Availability and resilience

Work is distributed across workers with automatic failover and job retries.
Databases are backed up regularly, and backups are encrypted.

Retention and deletion

Each organization can set a retention period, and expired data is deleted automatically.
Deleted organizations are purged after a grace period.
Expired sessions, sign-in links, and password resets are cleaned up automatically.

Vulnerability management and incident response

MergeHarbor maintains a responsible disclosure program and acknowledges reports within two business days.
MergeHarbor maintains a documented incident response process that meets the notification commitments in section 8.

Personnel and vendors

Personnel are bound by confidentiality obligations and receive security training.
Subprocessors are assessed before they are engaged and are bound by written data protection terms.

Annex III: Subprocessors

These Subprocessors may process Customer Personal Data when Customer uses the hosted MergeHarbor service. Model providers process data only when Customer’s routing and data residency settings permit them to.

Subprocessor	Purpose	Location
Amazon Web Services, Inc.	Hosting, storage, and encrypted backups of the MergeHarbor service	Australia (AWS Asia Pacific (Sydney) region, ap-southeast-2)
Anthropic, PBC	AI model inference for reviews	United States, or other regions where offered
OpenAI, L.L.C.	AI model inference for reviews, and code embeddings for search	United States, or other regions where offered
Twilio Inc. (SendGrid)	Sign-in links, invitations, and notification emails	United States
GitHub, Inc.	Code-host integration (the MergeHarbor GitHub App) for organizations that connect GitHub, and GitHub sign-in	United States
Cloudflare, Inc.	DNS hosting and domain registration only. Cloudflare does not proxy service traffic or receive Customer Data	Global DNS network

This list is also published at /legal/subprocessors. MergeHarbor will update this list as described in section 6.4.