Processing, suppliers and international access
Updated 15 October 2026. Ready IT ApS, CVR 38769383; contact@readyit.dk.
This notice supplements the processing information accompanying OpalSpan. It explains the service and its recipients; it does not replace an accepted order, change a retention period, authorise a new processing purpose or upgrade a device's telemetry instruction. Your recorded agreement and any separately accepted feature instructions identify your contractual versions.
The prospective clarification package identifies the underlying agreements and the exact 15 October supplements. Where that package is shown for a new order, acceptance covers its complete listed documents. Its effective-from boundary is 15 October 2026 at 15:30 UTC; actual availability depends on publication and the order's selected package. Earlier accepted orders and separately accepted feature profiles are not silently migrated. The preparation legends in the unchanged supplemental copies are explained by the activation notice; they are not a record of anyone's assent.
Explicit CPU limiting telemetry
Full-v3 (telemetry-full-v3) is a separately selected, bounded extension with
exact privacy v10,
DPA v10 and
instruction v10.
Earlier documents, Full-v1/Full-v2 grants, future-device defaults, suppliers and
retention remain unchanged. Publication or installation does not enable metrics
on every device. The selected device still requires current authority and no
local veto; collector absence/failure does not block independent repair.
Windows OS limits/firmware records, Linux thermal-event intervals/CPUFreq policy/ daemon-cgroup quota evidence and macOS returned OS CPU limits describe distinct sources. System thermal warning is separate from actual CPU restriction; usage, temperature and clock comparisons alone do not establish cause. The existing scalar history/cadence is reused, with no driver, stress test or new provider.
Who is responsible for what?
Ready IT is controller for its own account administration, billing, security and necessary support/incident handling. For customer technical-work information processed on your instructions, Ready IT is your processor. If you are an MSP processing for a client, Ready IT is a subprocessor within that client's authorised chain. A business name in Checkout, a paid subscription or a signed-in technician does not by itself establish that chain or a lawful basis.
Before using a free or personal workspace for another controller's data, arrange the applicable processing agreement and instructions with contact@readyit.dk. A lack of company details does not make organisational work household use.
Authorised Mech context can span cases and conversations in the same workspace. Separate case names and chat folders are not separate confidentiality boundaries. Keep different clients' information separate where their instructions or access requirements demand it.
Hosted Mech and your own assistant are different routes
Hosted Mech sends necessary conversation context, selected attachments and tool evidence to OpenAI's API. Selected PNG/JPEG/WebP images, PDFs and text can include personal data. Screenshots and command output may reveal more than the immediate technical fault. Remove unrelated information and do not include credentials. Additional sensitive categories require a lawful, specific instruction and appropriate safeguards; a general instruction to repair a device is not an instruction to copy all its contents.
Selected-file Python analysis uploads the chosen file and question to an OpenAI Code Interpreter container. Results return to the private conversation. The service requests container deletion and retries failures; provider expiry and other provider retention are separate. This does not give the provider general access to Bridge or the customer's device.
When your external assistant operates OpalSpan Agent CLI, its provider can receive the prompts, device outputs and files made available to that assistant. Unless Ready IT expressly supplies that assistant under an identified agreement, you select and contract with its provider. Its account type, local/cloud transcripts, training preferences, retention and transfer arrangements apply. Ready IT's hosted-Mech API arrangement does not automatically cover your Claude Code, Codex or other assistant account. Local agent execution is not a promise of local-only inference. Ready IT remains responsible for its own OpalSpan processing in either route.
Suppliers and locations
Suppliers' roles depend on the particular purpose. A recipient below is not automatically authorised to receive every category of customer-controlled data. Supplier links describe their wider services, not a claim that OpalSpan uses all of them.
| Supplier / service | OpalSpan information and purpose | Location and contractual boundary |
|---|---|---|
| Amazon Web Services; ordinary Danish-account contracting route: Amazon Web Services EMEA SARL, with the AWS DPA's identified parties | Lightsail hosts Bridge, PostgreSQL and self-hosted Typesense; private S3 holds conversation artifacts and bug-report originals; CloudWatch receives operational metadata; CloudFront handles the public/service edge. Typesense is not a separate hosted search supplier in this deployment. | Bridge and private artifact storage are in Stockholm, eu-north-1. CloudFront is international; the availability site's separate US-region storage is not the customer-file store. AWS service terms incorporate the DPA, supplementary addendum and applicable SCC/alternative transfer arrangements. This is not an EU-only-access promise. |
| AWS SES; the same AWS contractual route, additional optional customer-case purpose | The individually reviewed customer/device-owner service message, recipient/company/verified reply information, included case/preference capabilities and minimum delivery metadata. | SES API v2 in Stockholm, eu-north-1; addressed Internet mail, recipient handling and applicable support/onward processing retain their distinct AWS DPA/transfer arrangements. Each workspace requires its applicable additional instruction; existing signed/base versions are not silently extended. |
| OpenAI Ireland Ltd.; hosted Mech API | Necessary context, selected files/images, tool evidence, hosted search and selected-file analysis, plus usage/request metadata | The production project and runtime use Global geography, Standard tier and Standard Retention. OpenAI DPA section 4.1 addresses EEA onward transfers through SCC-containing agreements or applicable adequacy. Its current subprocessor list identifies infrastructure, support, moderation and affiliate processing outside the EEA. |
| Okta / Auth0 | Authentication, sign-in identity and authentication metadata; OpalSpan separately controls membership and device permissions | EU Auth0 tenant. Supplier support/onward processing is not established as EU-only. Applicable account terms and the service-specific supplier chain must be distinguished from the tenant hostname. |
| Microsoft 365 / Graph | Existing contact correspondence and contract/rights confirmations, including message/attachment and delivery information | Microsoft agreement and Products and Services DPA; international processing/support may apply. This does not describe a newly enabled Automation-mail service. |
| Stripe | Hosted payment/Checkout, invoicing, buyer information and payment references | Payment, fraud and legal purposes include Stripe's own controller processing. These are not automatically customer technical-work subprocessings. |
| GitHub, Inc. / applicable GitHub service terms | Ready IT's product-support issue workflow: submitted bug-report message, report JSON including reporter identity and bounded context, and links to private-S3 originals | GitHub is not the host or transport for ordinary customer cases, device work or hosted Mech processing. This support recipient is not automatically a subprocessor for that technical-work service. Its applicable role/contract must be assessed for the support purpose and any particular included material. GitHub can process information internationally, including in the US. |
Supplier information: AWS terms, AWS subprocessors, OpenAI DPA, OpenAI subprocessors, Okta terms and subprocessors, Microsoft DPA, Stripe privacy, GitHub privacy and GitHub DPA scope. Ask contact@readyit.dk for the applicable safeguards and processing-chain details.
Optional customer-case communications
The optional service-update purpose uses the processing supplement, feature instruction and privacy supplement alongside the workspace's existing accepted agreement. It leaves current signup/purchase and other signed instructions unchanged. Operator selection is separate from the organisation's attributable workspace instruction and each exact human message decision; setup and private preparation do not send mail.
The platform From identity is OpalSpan <updates@opalspan.com>, distinct from the company branding and its verified selected Reply-To. A sending identity is not a receiving mailbox. Existing SES feedback forwarding/account suppression is distinct from OpalSpan's case-scoped opt-out and is not automatic inbox/bounce observation; provider admission can occur without delivery. No mailbox reader, event collector, marketing/open/click tracking or new receiving service is added by this purpose.
Case/preference links are deliberately bounded capabilities. Anyone holding or forwarded a live case link can view its deliberately shared fields until expiry/revocation; recipient scoping is not authentication. Provider/recipient/recovery retention is not the link timer, and material already received cannot be recalled through link revocation.
OpenAI data controls
Ready IT's organisation has disabled model-feedback, evaluation/fine-tuning and
API input/output sharing. The production project is configured with Standard
Retention, not Zero Data Retention or Modified Abuse Monitoring. Mech sends
store=false for Responses output. This is not a no-retention promise:
- API content is not used for model training by default unless opted in.
- Default abuse monitoring can retain content for up to 30 days, with the provider's stated legal and harm-prevention exceptions.
- Prompt caching and hosted containers can retain separate application state; the provider describes cache retention up to 24 hours.
- Image/file safety handling can have separate review/retention exceptions.
See OpenAI's current data controls. Regional processing requires supported endpoints/models and applicable account eligibility/agreements. A European storage setting, by itself, would not cover all system metadata, support access or onward processing.
Bug reports and attachment links
GitHub hosts Ready IT's source and product-support issues, not the OpalSpan application or its ordinary customer/device processing. The relevant exception is an explicitly submitted product bug report. Ready IT uses this workflow to investigate and repair its own service: ordinarily a Ready IT controller support/incident purpose, not an instruction to perform the customer's device repair through GitHub. This does not make every report customer-controlled content or GitHub a general technical-work subprocessor.
The delivery copies the message and the complete structured report JSON into the private issue body. That JSON includes:
- Report identifier, acceptance time and service release information.
- The authenticated reporter's display name, email and identity-provider issuer/subject. A report can therefore contain reporter personal data even when it contains no end-customer material.
- If supplied and authorised: workspace identifier/name, conversation/run identifiers, access-session/device identifiers, and a selected device's display/machine name or a selected case's title. It does not copy the conversation transcript, case notes or the device's contents.
- Sanitised screen/page route, date-display mode, browser family and viewport size; bounded recent error categories/asset locations and failed-request route/status/reference metadata. No raw query/fragment, request bodies, headers, console history, error messages or raw stacks are collected by this structured diagnostics path.
- Selected image filenames, media types, sizes and hashes.
Original JSON and selected screenshot bytes are stored in private AWS S3, not committed as attachment files in Git. The issue nevertheless contains the JSON text itself, attachment filenames/hashes and download links. A screenshot or the reporter's free-text message can additionally include customer material; the workflow does not imply that every report does. Do not include unrelated information. If a report needs customer-controlled material beyond Ready IT's own support purpose, establish the actual instruction, roles and safeguards for that material rather than automatically classifying the entire product as processing through GitHub.
Anyone holding an attachment link can download its original without logging in. New report links have a fixed 90-day lifetime from publication preparation; the download exchange issues a URL lasting at most five minutes, capped by that original expiry. Do not forward these links to people who should not see the report. Previously issued links retain their own expiry.
Link expiry is not a promise that the issue, report record and every recovery copy are erased at that instant. Confirmed expired attachment objects are removed by bounded application cleanup after successful storage deletion. Pending/uncertain delivery originals are retained for reconciliation rather than silently discarded. Issue/report history and necessary incident/claim evidence have their own purposes. Contact Ready IT for access, correction, restriction or deletion; customer-controlled information is handled with the relevant controller.
Retention and security boundaries
Application and system CloudWatch log groups currently have 14-day retention. This is separate from workspace access-audit retention, case/conversation history, provider logs and required financial evidence. S3 object expiry is application-managed; there is no blanket bucket lifecycle erasing every object after seven or ninety days.
Automatic Lightsail recovery snapshots retain seven daily generations. Separate local recovery copies are not governed by that rotation. The existing DPA's return/deletion obligation includes relevant recovery copies and lawful exceptions; restore handling must reconcile completed deletion/restriction instructions before returning data to use.
The artifact bucket blocks public access and uses AWS server-side AES-256 encryption. Application conversation protection, scoped access and encrypted transport address different threats. These facts do not establish customer-exclusive key custody, end-to-end encryption for all content, or an inability of a provider to access intelligible data.
International demands and CLOUD Act
Stockholm hosting does not remove all foreign-jurisdiction risks. Equally, US ownership does not automatically make processing unlawful. A covered adequacy route, such as the EU-US Data Privacy Framework for a participating entity, differs from an SCC route requiring an assessment of its effectiveness.
A foreign authority's demand does not by itself establish a GDPR legal basis or lawful transfer. Requests need a case-specific assessment under Article 48, the applicable processing basis and Chapter V. Supplier commitments to redirect, notify where lawful, challenge inappropriate requests and minimise disclosure are relevant safeguards, not guarantees that disclosure can never occur.
For background, see Datatilsynet's cloud guidance, third-country transfer guidance and EDPB Article 48 guidance.