> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lanesync.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Processing Agreement (template)

> Template DPA for enterprise LaneSync customers — customize with legal counsel before execution.

:::warning
This is a **template stub** for procurement discussions. Have your legal counsel review and customize before signing.
:::

## 1. Definitions

* **Customer Data**: Release governance metadata, CI evidence (test results, vulnerability scan summaries and reports), and audit logs uploaded to LaneSync by Customer.
* **Processor**: LaneSync (the SaaS provider).
* **Controller**: The Customer organization using LaneSync.

## 2. Processing scope

LaneSync processes Customer Data solely to provide release governance, quality tracking, and SDLC enforcement services as described in the LaneSync Terms of Service.

LaneSync does **not** process Customer application source code.

## 3. Security measures

Processor implements:

* Envelope encryption (AES-256-GCM) with per-tenant key context
* Row Level Security for multi-tenant isolation
* TLS 1.3 in transit, KMS encryption at rest
* Least-privilege database access (`sdlc_app` role)
* Audit logging of sensitive data access

See [Enterprise security](/enterprise/security) for full details.

## 4. Subprocessors

Processor uses subprocessors listed at [Subprocessors](/enterprise/subprocessors). Processor will notify Controller of material changes with 30 days notice.

## 5. Data retention and deletion

Upon termination, Customer Data is deleted within **30 days** unless legal retention requirements apply. Customer may export quality reports via the dashboard before termination.

## 6. Data subject requests

Processor will assist Controller in responding to data subject requests to the extent Customer Data contains personal data (e.g., GitHub usernames in audit logs).

## 7. Contact

Data protection inquiries: **[security@lanesync.dev](mailto:security@lanesync.dev)**