For agency procurement
Data processing addendum
Processing scope
Stepfree processes account information, public-page scan results, and configuration data solely to provide monitoring, reporting, and product support.
Security
Access is limited by role, stored data is encrypted at rest, transport uses TLS, and recurring monitoring requires domain ownership verification.
Private-beta subprocessors
Supabase provides the hosted database and authentication, Vercel hosts the application and worker, and Resend delivers monitoring email. Payment processing is not used during the pilot.
Private beta data notice · Do not add authenticated areas or non-public personal data. A signable DPA with deletion terms will be supplied before paid processing begins.