Data Processing Agreement
A standard Data Processing Agreement (DPA) is available to all WatchTower15 customers and requires no negotiation to accept. Under it, WatchTower15 Incorporated acts as the processor and you remain the controller of the monitoring data you send to the platform. We process that data only on your documented instructions, apply appropriate technical and organisational security measures, and impose equivalent obligations on any sub-processors that host the service in your chosen region.
The types of data processed include your servers’ and domains’ monitoring data and, for monitored databases, database server metrics and configuration, database identifiers (schema and table names: in clear only when you choose the Clear names privacy mode, as keyed hashes in the default Hashed mode), schema structure and normalised SQL statements — never table content or credentials. Statement statistics for a monitored database (numbers keyed by hashes, never statement text) expire after 30 days and are not deleted earlier. Statement text, kept only when you choose Clear names, is deleted with the database or when you switch it to another privacy mode. Database log events, read from a monitored database’s slow-query and error logs, carry keys, numbers and error codes, never a value from a statement or a message; with Clear names the statement’s normalised text, the error message with its values removed and the account name are kept too. Database log events expire from the live store 30 days after they are recorded, and from its daily backups within a further 30 days. Database account names come from two places: with the optional account grant, the database advisor reads the server’s account names and their authentication settings (authentication plugin, TLS requirement, password expiry and lock state), and a database’s slow-query log names the account that ran each slow statement. Account names reach WatchTower15 in clear only with Clear names, as keyed hashes otherwise, and password hashes are never read.
The DPA reflects the requirements of Article 28 of the UK and EU GDPR and covers the details of processing, international transfers, breach notification, and the return or deletion of your data at the end of the engagement. This page is a summary; the full, signable agreement is published on the WatchTower15 website.