Data Processing Agreement

Effective Date: June 1, 2026 - Template version · Last updated: October 11, 2026

1. Parties

This DPA is entered into between:

• Cova ("Processor," "we," "us") - a Delaware-incorporated software company operating Cova, an AI SRE agent, at getcova.ai.
• Customer ("Controller," "you") - the organization that has accepted the Terms of Service and uses the Service.

2. Definitions

• Personal Data - any information relating to an identified or identifiable natural person, as defined under applicable data protection laws (GDPR, CCPA, UK GDPR).
• Processing - any operation performed on Personal Data, including collection, storage, transmission, analysis, or deletion.
• Customer Data - Personal Data and other data that the Customer or its users submit to or generate through the Service.
• Sub-processor - a third-party service provider engaged by Cova to process Customer Data on Cova's behalf.
• Data Subject - the individual to whom Personal Data relates (typically the Customer's employees and authorized users).
• Security Incident - any actual or reasonably suspected unauthorized access to, disclosure of, or loss of Customer Data.

3. Scope and roles

For Customer Data processed through the Service:

• The Customer is the Controller. The Customer determines the purposes and means of processing, including which integrations to connect and which actions to authorize.
• Cova is the Processor. Cova processes Customer Data on the Customer's documented instructions, which are reflected in the configuration the Customer makes within the Service.
• Cova does not process Customer Data for any purpose other than providing the Service, except as required by law.

4. Customer instructions

By using the Service, the Customer instructs Cova to:

• Read telemetry and configuration from the third-party tools the Customer connects.
• Store investigation threads, audit logs, and related analysis outputs in Cova's database.
• Generate AI-assisted recommendations and carry out changes in the Customer's connected tools only after a Customer user approves them, or within the limits the Customer sets for each kind of change and each environment.
• Post incident updates and answers to the Slack workspace the Customer connects.
• Transmit incident data and questions to the AI model provider whose API key the Customer has added (Anthropic, OpenAI or Google), through the Customer's own account with that provider, for inference.

Any processing outside this scope requires the Customer's explicit instruction, communicated in writing to legal@getcova.ai.

5. Confidentiality and personnel

• Cova ensures that personnel authorized to process Customer Data are bound by written confidentiality obligations.
• Access to Customer Data is restricted to personnel with a legitimate operational need, on a least-privilege basis.
• Changes Cova personnel make to a Customer workspace are recorded in that workspace's audit log. See the Security page for current access-control practices.

6. Security measures

Cova implements appropriate technical and organizational measures to protect Customer Data against unauthorized access, disclosure, alteration, or loss. These include:

• Encryption at rest: Customer Data stored in Cova's PostgreSQL database (hosted on Neon) is encrypted at rest. Third-party API credentials are additionally encrypted using Fernet (AES-128-CBC + HMAC-SHA256) before storage, with encryption keys held separately from the encrypted data.
• Encryption in transit: All connections to the Service use HTTPS.
• Tenant isolation: Customer Data is scoped by tenant identifier across all database tables and API endpoints.
• Authentication: Users sign in through Google or GitHub; Cova does not store passwords. Sessions use cryptographically random 256-bit tokens, stored hashed. API keys are stored hashed.
• Rate limiting: Sensitive endpoints, such as invite lookups and webhook token access, are rate-limited.
• Audit logging: Every administrative action and every action Cova takes on the Customer's behalf is recorded in a per-tenant audit log.

The detailed and current list of security measures is published at getcova.ai/security.html and forms part of this DPA.

7. Sub-processors

The Customer authorizes Cova to engage the following Sub-processors to assist in providing the Service. Cova ensures each Sub-processor is bound by data-protection obligations no less protective than those in this DPA.

Cova will notify the Customer of any intended changes to the Sub-processor list at least 30 days before such changes take effect. The Customer may object to a new Sub-processor on reasonable data-protection grounds; if the parties cannot agree on a resolution, the Customer may terminate the affected portion of the Service.

8. Data Subject rights

The Customer is responsible for responding to requests from Data Subjects to exercise their rights (access, rectification, deletion, restriction, portability, objection). Cova will provide reasonable assistance, taking into account the nature of processing, by:

• Providing the Customer with the tools to export, delete, or amend Customer Data within the Service.
• Responding to assistance requests at privacy@getcova.ai within 10 business days.
• Deleting Personal Data from Cova's systems within 30 days of the Customer's documented deletion request.

9. International data transfers

Customer Data is processed and stored in the United States. Where the Customer is established in the European Economic Area, United Kingdom, or Switzerland, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2 - Controller to Processor) are incorporated into this DPA by reference and apply to transfers of Personal Data to Cova in the United States.

Where Cova is certified under the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework, transfers may rely on those certifications. Cova is not currently certified under these frameworks; transfers rely on the Standard Contractual Clauses above.

10. Personal Data breach notification

Cova will notify the Customer of any Security Incident affecting the Customer's Personal Data without undue delay, and in any case within 72 hours of becoming aware of the incident. The notification will include:

• A description of the nature and scope of the Security Incident, including the categories and approximate number of affected Data Subjects and records.
• The likely consequences of the Security Incident.
• The measures Cova has taken or proposes to take to address the incident and mitigate its effects.
• The point of contact at Cova for further information.

Cova will cooperate with the Customer's reasonable requests for information needed to fulfill the Customer's own notification obligations to supervisory authorities and Data Subjects.

11. Audits and assessments

Cova will make available to the Customer information necessary to demonstrate compliance with this DPA. The Customer may, no more than once per calendar year and with at least 30 days' prior written notice:

• Request a copy of Cova's then-current third-party security attestations and penetration-test summaries, when available.
• Submit a written security questionnaire, which Cova will complete within a reasonable timeframe.
• Conduct an on-site audit through a mutually agreed independent third-party assessor, at the Customer's expense, where regulatory requirements or material concerns make documentary review insufficient.

12. Return and deletion of data

On termination of the Service:

• Cova will, at the Customer's choice, return or delete all Customer Data within 30 days of termination.
• Encrypted third-party API credentials are deleted immediately upon disconnection of the corresponding tool or upon account termination.
• Backups containing Customer Data are subject to scheduled rotation and will be overwritten in the ordinary course of operations within 90 days.
• Cova will provide written confirmation of deletion upon request.

13. Liability

The liability of each party arising out of or in connection with this DPA is subject to the limitations and exclusions set out in the Terms of Service.

14. Term and termination

This DPA takes effect when the Customer accepts the Terms of Service or executes a separate signed version of this DPA, whichever is earlier, and remains in effect for as long as Cova processes Customer Data on behalf of the Customer. Sections 5 (Confidentiality), 10 (Breach Notification), 12 (Return and Deletion), and 13 (Liability) survive termination.

15. Governing law

This DPA is governed by the laws of the State of Delaware, United States, consistent with the Terms of Service, except where a different governing law is mandated by applicable data protection regulation in the Customer's jurisdiction.

16. Contact