Data processing agreement

Last updated November 4, 2026

This agreement is part of the Terms of service between Tabla DB, Inc. (“we”) and every account that uses Tabla (“you”). It applies whenever an account keeps personal data in Tabla that is protected by the European Union’s General Data Protection Regulation (GDPR), the UK GDPR or Switzerland’s Federal Act on Data Protection, and it takes effect with the Terms, with nothing to sign. If your organization needs a copy signed by us, write to support@tabladb.com and we’ll send one.

1. Who does what

For the records, files, comments and everything else an account keeps in its databases (“customer data”), you decide what is kept and why: you are the controller, and we process it on your behalf as your processor. If you are yourself a processor for someone else, we are your subprocessor, and this agreement applies the same way.

For what Tabla needs in order to run — the names and email addresses people sign in with, billing, and our own records of how Tabla is used — we are the controller, as our privacy policy describes.

2. What we do with customer data

We process customer data only to provide Tabla to you: to store it, show it to the people you give access, back it up, export it, send the emails and webhooks you set up, and help with support you ask for. Those are your instructions, together with this agreement and what you and your people do in Tabla. If we believe an instruction would break data protection law, we tell you. We never sell customer data, use it for advertising, or use it to train any model. Annex 1 describes the processing.

3. What we keep for ourselves

Our records of how Tabla is used — including session recordings, which hide what is in records — are ours, used only to run, secure and improve Tabla. We never show or hand them to your organization, so they can’t be used to watch or assess anyone’s work. A team account’s admins can switch session recording off for everyone in it.

4. The people who handle it

Everyone we allow to access customer data has committed to keeping it confidential.

5. Security

We keep the security measures in Annex 2. We may improve them over time, and we never change them in a way that lowers the protection they give.

6. Subprocessors

You authorize us to use the subprocessors listed in Annex 3 and on our subprocessors page. Before we add or replace one, we email the admins of every account at least 30 days ahead. You can object on reasonable data protection grounds within those 30 days; if we can’t resolve your objection, you can stop using Tabla, and we refund any part of a plan you have already paid for and won’t use. Each subprocessor is bound by contract to the same data protection obligations as this agreement, and we remain responsible to you for its work.

7. Helping you

Tabla’s own tools answer most requests from the people whose data you keep: the export gives a copy, editing corrects, and deleting erases. For anything they can’t do, we help within a reasonable time. If someone contacts us about data you hold, we pass the request to you rather than answer it ourselves. We also give you the information you reasonably need for a data protection impact assessment or a consultation with a supervisory authority.

8. If there is a breach

If we become aware of a breach of security that affects customer data, we tell your account’s admins without undue delay, and within 48 hours: what happened, what data and how many people are likely affected, the likely consequences, and what we are doing about it. We keep you updated as we learn more.

9. Where customer data is processed

Customer data is stored in the European Union: the database on Hetzner’s servers in Nuremberg, Germany, and files and backups with Cloudflare R2 under its EU jurisdiction. Tabla DB, Inc. is a company of the United States, our team reaches the servers from Egypt, and some subprocessors are in the United States (Annex 3). Where any of that is a transfer of personal data out of the EU, the UK or Switzerland, section 10 covers it.

The data stays encrypted in transit and at rest, and reaching it from outside the EU takes our operators’ own keys. No government has ever asked us for customer data. If one does, we challenge the request where there are grounds to, disclose only the minimum the law compels, and tell you first unless the law forbids it.

10. Standard contractual clauses

For any transfer of customer data to us outside the European Economic Area, the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 are part of this agreement, with you as data exporter and us as data importer: Module Two where you are a controller, and Module Three where you are a processor. These choices apply:

• Clause 7, the docking clause, applies.
• Clause 9(a): Option 2, general written authorization, with the 30 days’ notice in section 6.
• Clause 11(a): the optional wording does not apply.
• Clause 13: the supervisory authority of the EU member state where you are established, or as clause 13(a) otherwise provides.
• Clause 17: Option 2, the law of the EU member state where you are established; where that law does not allow third-party beneficiary rights, or you are not established in the EU, the law of Ireland.
• Clause 18(b): the courts of the member state whose law applies under clause 17.
• Annexes I, II and III of the clauses are Annexes 1, 2 and 3 below.

For transfers from the United Kingdom, the UK Information Commissioner’s International Data Transfer Addendum (version B1.0) applies alongside the clauses, with its tables completed from this agreement and “neither party” chosen in Table 4. For transfers from Switzerland, the clauses apply with the Swiss Federal Data Protection and Information Commissioner as the competent authority where Swiss law governs the transfer, “member state” read so that people in Switzerland can bring claims where they live, and references to the GDPR read as including the Swiss Federal Act on Data Protection.

11. Audits

We make available what you need to see that we meet this agreement: this agreement, the measures in Annex 2, and written answers to a reasonable security questionnaire once a year. If that isn’t enough, or a supervisory authority requires it, you or an independent auditor bound to confidentiality may audit us, at your cost, with 30 days’ notice, during business hours, and no more than once a year unless after a breach.

12. When processing ends

You can export everything at any time. When you delete records, a database or your account, the data leaves Tabla at once — deleted records, fields and tables wait in a trash for 7 days first — and leaves our backups within 30 days. When this agreement ends, customer data is deleted the same way, unless the law requires us to keep it.

13. The rest

Each party’s liability under this agreement is subject to the limits in the Terms, except where the standard contractual clauses or the law don’t allow a limit. If this agreement and the Terms disagree, this agreement wins; if the standard contractual clauses disagree with anything, the clauses win. We may update this agreement for changes in the law or in Tabla; we email account admins before a change that matters takes effect, and no change lowers the protection it gives.

Annex 1 — Description of the processing

• Data exporter: the account, as identified when it signed up; contact: its admins; role: controller (or processor). Activities: using Tabla. Signature and date: accepting the Terms.
• Data importer: Tabla DB, Inc., 3711 Werner Avenue, Austin, TX 78722, United States; contact: support@tabladb.com; role: processor (or subprocessor). Activities: providing Tabla. Signature and date: publishing this agreement.
• People whose data is processed: whoever the account keeps records about — for example its staff, collaborators, customers, contacts or study participants — and the people who use the account.
• Kinds of data: whatever the account puts in its records, files and comments, and the names and email addresses of the people who use it.
• Special categories of data: the account decides whether to keep any. They are protected by the measures in Annex 2, and seen only by the people the account gives access.
• How often: continuously, for as long as the account uses Tabla.
• What the processing is: hosting, storing, backing up, searching, showing and exporting the data, sending the emails and webhooks the account sets up, and support at the account’s request.
• Purpose: providing Tabla under the Terms.
• How long: as long as the account keeps the data, then as section 12 says.
• Subprocessors: the same data and processing, for the purposes listed in Annex 3.
• Supervisory authority: as clause 13 is chosen in section 10.

Annex 2 — Security measures

Where data is kept

• The database that holds every record runs on Tabla’s own server at Hetzner in Nuremberg, Germany, in a data center whose operator is certified to ISO/IEC 27001.
• Uploaded files and the database’s backups are stored with Cloudflare R2 under its EU jurisdiction, which keeps them inside the European Union.

Encryption

• Every connection uses HTTPS with TLS 1.2 or newer, and browsers are told to accept nothing else.
• The database and the server’s logs are stored encrypted (AES-256). Files and backups are encrypted at rest by the storage provider.

Signing in, and who can see what

• People sign in with a link emailed to their own address, which expires after 15 minutes. Tabla stores no passwords, and keeps sessions, API keys and invitation links only as one-way hashes.
• A session ends 30 days after it was last used.
• Each database has its own members, each an owner, editor or viewer, and every request is checked against that role before anything is read or written. API keys can be limited to chosen databases, and to reading only.
• Every table a customer makes is a table of its own in the database, never rows mixed into a table shared with other customers.

Our own access

• Only Tabla’s operators can reach the server, with SSH keys; password logins are switched off. The firewall admits web traffic and SSH and nothing else, and the database and file store can’t be reached from the internet at all.
• We don’t read what customers store. When a support request needs us to look at a database, access is read-only, expires, needs a written reason, and every grant is logged.
• Everyone with access has committed to keeping what they see confidential.

Keeping it running

• Every change to the database is copied to separate storage in the EU within about two minutes, on top of a full copy every night, kept for 30 days. Restoring is a written procedure, tested on the live system, and at most a couple of minutes’ changes could be lost.
• Deleted records, fields and tables wait in a trash for 7 days before they’re removed.
• Security updates install automatically, and every change to Tabla passes its automated tests before it ships.
• An outside service checks every few minutes that Tabla is up, and errors are recorded and grouped on our own server so they are found and fixed quickly.

Logs and recordings

• Web server logs and error reports are kept for 90 days, and our record of product activity for 13 months.
• Session recordings hide what’s in records, can be opened only by Tabla’s own team, are never shown or handed to a customer’s organization, and are deleted after 30 days. A team account’s admins can switch recording off for everyone in it.

If something goes wrong

• If personal data an account stores in Tabla is ever exposed, we tell that account’s admins without undue delay, and within 48 hours of learning of it, with what we know, and keep them updated.
• Security problems can be reported to support@tabladb.com, as security.txt says.

Leaving

• Any database can be exported whole at any time, on every plan: its tables as CSV, its files as files, and its structure as JSON.

Annex 3 — Subprocessors

As of November 4, 2026. The current list is always on our subprocessors page.