Provisional version for the test phase. This text will be checked by a lawyer before the public launch.
Last updated: November 6, 2026
Roles and conclusion
This agreement supplements the terms of use and applies as soon as you put other people's personal data into Tamiso, in line with Article 28 GDPR. It is concluded electronically by accepting the terms or using these features. You are the controller. The provider ([To complete: name or company name]) is the processor and acts on your behalf.
For your own account data, the security of the service and our contacts with you, we are the controller: see the privacy policy.
Subject, duration and purpose
Processing consists of storing and analysing what you send in order to provide the service: dependency and code analysis, project tracking, client reports, NIS2 file, Cyber Resilience Act reports. It lasts as long as you use the service, then until the deletion described below.
People and data concerned
- People: members of your team, your clients' contacts, and anyone whose name appears in what you send.
- Data: emails of invited people, name and contact of your clients, content of your reports and files, stored code excerpts (file, line, masked excerpt), names appearing in analysed files.
Tamiso is not designed for special categories of data (health, opinions, biometrics, convictions) or children's data: do not put them in it.
Your instructions
Your instructions are what you do in the service, these documents and what we agree in writing. We may refuse an instruction that seems to us to be against the law, and we tell you so.
Our obligations
We process the data only to provide, secure and maintain the service, following your instructions, unless the law requires otherwise. People with access are bound by confidentiality. We help you, as far as possible, to answer requests from the people concerned, impact assessments and questions from an authority.
Your obligations
You guarantee that you have a legal basis for this data and the right to entrust it to us, and you inform the people concerned. You protect your access and keys, and you share client report links with the right people.
Security
Encrypted connection (HTTPS), passwords and access keys stored as hashes, optional two-factor authentication, separation of workspaces, form protection, attempt limits, code analysed in memory and secrets masked, backups accessible only to the server's operator. These measures may evolve without lowering the level of protection.
Data breach
We notify you without undue delay, if possible within 48 hours of confirming a breach affecting your data, with the information available: nature, people and data concerned, consequences, measures taken. It is up to you to assess whether the authority or the people must be notified.
Sub-processors
You give us general authorisation to use sub-processors. They are listed in the "Third-party services" section of the privacy policy: hosting (OVH), email, Anthropic for AI features, GitHub for linked repositories. We announce any change on that page or by email. You may object on serious grounds within 14 days; if no solution is found, you can stop using the feature concerned or the service.
Transfers outside the European Union
The data is stored in the European Union. Some providers may process it in the United States, on the bases set out in the privacy policy.
Deletion and export
You can export your results and delete a project or your account at any time. The data is then erased from the database, and from backups no later than 14 days after that. The security log stays for 180 days.
Audit
We give you the information needed to show compliance with Article 28, usually in writing. An audit is carried out remotely, with 30 days' notice, at most once a year (except after a data breach or at an authority's request), at your expense, without endangering the security of the service or other customers' data.
Liability and precedence
Liability follows the terms of use, without limiting what the GDPR requires. For the protection of entrusted data, this agreement takes precedence over the terms. If you refuse it, do not put other people's personal data into Tamiso.
Changes
We may change this agreement as the service, the providers or the law evolve. We tell you about an important change in the application or by email.