GoRunner
Sign inStart free

Last updated 2 November 2026

Data Processing Agreement

1. Parties and scope

This agreement is between you, the business that uses GoRunner Cloud (the controller), and AC Süppmayer GmbH, Kaiserstr. 26a, 66111 Saarbrücken, Germany (“we”, the processor). It is part of the Terms of Service and applies whenever we process personal data on your behalf in GoRunner Cloud.

A self-hosted installation of GoRunner sends us nothing, so this agreement does not apply to it. Where this agreement and the Terms differ on data protection, this agreement prevails.

2. Subject matter, nature, purpose and duration

  • Subject matter: hosting and running your organization’s workflows in GoRunner Cloud.
  • Nature: receiving, storing, reading, transforming, sending, showing and deleting data, as your workflows, triggers and settings say.
  • Purpose: providing GoRunner Cloud under the Terms: running workflows, showing their runs, Keel, and support you ask for.
  • Duration: as long as the Terms run, and after that until the data is deleted under section 10.

3. Personal data and data subjects

Types of data: whatever you put through GoRunner. That includes workflow definitions and their sample data; run inputs and outputs; trigger data, such as webhook requests (with the sender’s IP address) and form submissions; files inside runs; connections and their credentials; data your workflows keep in GoRunner’s storage steps; Keel conversations; and, for your organization’s audit log, your members’ names, email addresses, IP addresses and actions. Special categories of data (Art. 9 GDPR) only if you choose to process them.

Data subjects: your members; your employees, customers, prospects, suppliers and anyone else whose data your workflows process; people who send data to your webhooks or fill in your forms.

4. Your instructions

  1. We process the data only on your documented instructions: the Terms, this agreement, the way you set up and use GoRunner (your workflows, connections and settings), and any further instruction you send in writing to privacy@gorunner.io.
  2. If EU or German law requires us to process the data otherwise, we tell you first, unless that law forbids it.
  3. We tell you at once if we think an instruction breaks data protection law.
  4. You are responsible for the lawfulness of the processing you instruct.

5. Confidentiality

Everyone we allow to process the data is bound to confidentiality. GoRunner staff do not read your data, except with your permission, to fix a problem you report, for security or abuse investigations, or when the law requires it. Each staff visit to your organization is recorded in your audit log.

6. Security

We take the technical and organisational measures in Annex 1 (Art. 32 GDPR). We may change them as the service develops, as long as the level of protection does not fall.

7. Sub-processors

  1. You authorise the sub-processors listed on the sub-processors page.
  2. We tell you at least 30 days before we add or replace one, by email to your organization’s owners and on that page. Within that time you may object on reasonable data protection grounds. If we cannot resolve the objection, you may end the contract before the change takes effect.
  3. We bind each sub-processor by contract to the data protection obligations of this agreement, and we remain responsible to you for its work.
  4. The AI provider your organization connects to Keel, with its own account, and the apps and services your workflows connect to are not our sub-processors. You engage them under your own contracts; we send them data on your instruction.

8. Assistance

We help you answer requests from data subjects (Art. 12–22 GDPR). Most can be met in the dashboard, where you can see and delete runs, workflows, members and your organization. We also help you with security, breach notification, impact assessments and consultations (Art. 32–36 GDPR), as far as the information we hold allows.

9. Personal data breaches

If a personal data breach affects your data, we tell your organization’s owners without undue delay after we become aware of it, by email, with what we know of its nature, likely consequences and the measures taken (Art. 33(3) GDPR), and we add to it as we learn more. We help you meet your own duties to notify.

10. Deletion and return

  1. While the contract runs, you can delete data yourself at any time. Runs are deleted automatically 90 days after they finish; each workflow keeps its newest finished run per environment.
  2. Before the contract ends, you can take your data out through the dashboard and the API. When your organization is deleted, we delete its data at once, including its own encryption key. Copies leave our storage’s previous versions and our backups within 7 days.
  3. We keep data longer only where EU or German law requires it.

11. Information and audits

We give you the information you need to show that this agreement is kept (Art. 28(3)(h) GDPR), and allow audits, including inspections, by you or an auditor you appoint who is bound to confidentiality. Where documents answer the question, we answer in writing first. Audits are announced with reasonable notice, normally 30 days, take place during business hours, and must not disrupt the service or expose other customers’ data.

12. Transfers outside the EU

Your data is stored in the EU, in Amazon Web Services’ Frankfurt region. Some sub-processors are US companies or have US parents; the sub-processors page says which. Transfers to them rest on the EU-US Data Privacy Framework (Art. 45 GDPR), for each that is certified under it, and on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We send you a copy on request.

13. Liability

Liability under this agreement follows the Terms (§ 8), without limiting either side’s liability under Art. 82 GDPR towards data subjects.

Annex 1: Technical and organisational measures

Where the data is

  • Servers, database and object storage in Amazon Web Services’ Frankfurt region (eu-central-1). The database is not reachable from the internet; the storage blocks all public access.

Encryption

  • At rest: the database (AWS KMS), the object storage (SSE-S3) and the server disks and their snapshots are encrypted.
  • Connection credentials, secret variables, AI keys, two-factor secrets, single sign-on secrets and held runs’ step outputs are also encrypted by GoRunner with a key of each organization’s own (AES-256-GCM), itself encrypted with a master key. They are decrypted only on the workers that run workflows. Deleting an organization deletes its key.
  • In transit: HTTPS with HSTS for the API; verified TLS to the database; HTTPS to the object storage.
  • API tokens, AI-app tokens, recovery codes, invitation tokens and sign-in links are stored only as hashes.

Access control in GoRunner

  • Sign-in by emailed link or code, with optional two-factor authentication (TOTP and recovery codes). Sensitive account changes need a fresh second factor or a recent sign-in.
  • Organization and workspace roles; API tokens limited to the permissions their maker holds; publishing is a permission of its own.
  • Rate limits on sign-in and the API.

Staff access

  • A staff visit to an organization starts read-only; changes need a second factor. Every visit is recorded in the organization’s own audit log, and ends after its time limit or an hour idle.
  • Operators reach production through AWS Systems Manager with a role protected by multi-factor authentication.

Separation

  • Every record belongs to one organization and workspace, and every request is checked against them. Each organization’s secrets are encrypted with its own key.

Availability and recovery

  • Daily database backups and server disk snapshots, kept 7 days. Object storage keeps previous versions for 7 days.

Logging and data minimisation

  • An audit log of sign-ins, changes to members, roles, tokens, single sign-on and connections, workflow edits and each use of a stored credential, readable by the organization.
  • Secret headers are removed from stored webhook requests; secrets are masked in step errors and removed from monitoring data; server logs carry IDs, not client IP addresses.

Review

  • Security-relevant changes are reviewed before release, and these measures are checked when the service changes.

Annex 2: Sub-processors

The current list is on the sub-processors page, which is part of this agreement.