Skip to content

Data Processing Addendum

Last updated 2026-10-14 · Version 1.1

This Data Processing Addendum (“DPA”) forms part of the Subscription Agreement between Xavier Device Management LLC (“Xavier”) and the Customer, and applies whenever Xavier processes Customer Personal Data in providing the Service. It takes effect when the Customer accepts the Subscription Agreement; no separate signature is required. Capitalized terms not defined here have the meanings given in the Subscription Agreement.

1. Definitions

  • “Data Protection Laws” means all laws that apply to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) and similar US state laws.
  • “Customer Personal Data” means personal data within Customer Data.
  • “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data processed by Xavier or its Subprocessors.
  • “Subprocessor” means a third party engaged by Xavier to process Customer Personal Data.
  • “SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
  • “Controller”, “processor”, “data subject”, “personal data”, “processing”, “business”, and “service provider” have the meanings given in the applicable Data Protection Laws.

2. Roles and scope

  1. The Customer is the controller of Customer Personal Data, or a processor acting for its own customers or affiliates. Xavier is the Customer’s processor or, where the Customer is a processor, its subprocessor. Under the CCPA, the Customer is the business and Xavier is the service provider.
  2. Xavier is a controller, not a processor, of personal data it processes to run its own business, such as account, billing, and support contact information and website data. That processing is described in the Privacy Policy.
  3. The subject matter, nature, purpose, and duration of the processing, and the types of personal data and categories of data subjects, are described in Annex I.

3. Customer obligations

  1. The Customer is responsible for the lawfulness of the processing it instructs, for having a lawful basis for collecting Customer Personal Data through the Service, and for giving the notices and obtaining the consents required under Section 7 of the Subscription Agreement.
  2. The Customer controls which optional data collection features are enabled in its Tenant (including precise location, application usage, Android network and security logs, and AI tool configuration scanning), and is responsible for that choice.
  3. The Customer will not submit the restricted data described in Section 8 of the Subscription Agreement.

4. Xavier obligations

  1. Instructions. Xavier will process Customer Personal Data only on the Customer’s documented instructions, unless required to do otherwise by law, in which case Xavier will inform the Customer before processing unless the law prohibits it. The Agreement, the Customer’s configuration of its Tenant, and actions taken by its Authorized Users are the Customer’s complete instructions. Xavier will tell the Customer if, in its opinion, an instruction infringes Data Protection Laws.
  2. Confidentiality. Xavier will ensure that personnel authorized to process Customer Personal Data are bound by obligations of confidentiality.
  3. Security. Xavier will implement and maintain the technical and organizational measures in Annex II. Xavier may update them provided the overall level of protection is not materially reduced.
  4. CCPA. Xavier will not sell or share (as those terms are defined in the CCPA) Customer Personal Data; will not retain, use, or disclose it for any purpose other than providing the Service, outside the direct business relationship with the Customer, or as otherwise permitted by the CCPA; will not combine it with personal data Xavier receives from other sources except as the CCPA permits; and will comply with the CCPA’s obligations for service providers. Xavier will notify the Customer if it can no longer meet these obligations. The Customer may take reasonable steps to stop and remediate unauthorized use.

5. Subprocessors

  1. The Customer gives Xavier general authorization to engage Subprocessors. The current Subprocessors are listed on the Subprocessors page.
  2. Xavier will impose on each Subprocessor, by written contract, data protection obligations that provide at least the same level of protection as this DPA, and remains liable to the Customer for each Subprocessor’s performance of those obligations.
  3. Xavier will give at least 30 days’ notice before a new Subprocessor begins processing Customer Personal Data, by updating the Subprocessors page and emailing Customers who have asked to subscribe to changes. The Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith. If it is not resolved, the Customer may terminate the affected part of the Service by notice with immediate effect, and owes fees only for usage up to the date of termination.
  4. Services the Customer chooses to connect to its Tenant (such as identity providers, alerting destinations, storage accounts, its own database, and AI clients) are not Subprocessors. The Customer directs the transfer of data to them.

6. Assistance

  1. Data subject requests. The Service lets the Customer view, correct, and delete Customer Personal Data about individual devices and people. Where the Customer cannot fulfil a data subject request itself, Xavier will provide reasonable assistance. If Xavier receives a request directly, it will refer the data subject to the Customer and will not respond itself except as required by law.
  2. Impact assessments. Xavier will provide reasonable information the Customer needs to carry out data protection impact assessments and prior consultations with supervisory authorities relating to the Service.
  3. Government requests. If Xavier receives a legally binding request from a public authority for Customer Personal Data, it will notify the Customer before disclosing unless legally prohibited, will challenge requests it reasonably considers unlawful, and will disclose only the minimum required.

7. Security Incidents

Xavier will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting the Customer’s Customer Personal Data. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Xavier will provide further information as it becomes available and will take reasonable steps to contain and remediate the incident. Notification is not an acknowledgement of fault. Notice will be sent to the Customer’s account holder email address.

8. Audits

  1. Xavier will make available the information reasonably necessary to demonstrate compliance with this DPA. This includes written answers to reasonable security questionnaires, no more than once in any 12-month period unless a Security Incident has occurred.
  2. If that information is not sufficient to demonstrate compliance, or a supervisory authority requires it, the Customer may conduct an audit, itself or through an independent auditor bound by confidentiality, no more than once in any 12-month period, on at least 30 days’ notice, during business hours, and in a way that does not compromise the security of the Service or other customers’ data. The Customer bears its own costs and reimburses Xavier’s reasonable costs.
  3. Xavier does not currently hold third-party security certifications or attestations (such as SOC 2 or ISO 27001).

9. Return and deletion

On termination of the Agreement, Xavier will make Customer Personal Data available for export and then delete it as set out in Section 13.3 of the Subscription Agreement (and, for trials, Section 4). If the Customer uses its own database, the Customer controls the deletion of the data in it, and Xavier deletes the connection details and the Customer Personal Data it holds outside that database. Copies held in Xavier’s backups are deleted as those backups expire, no later than 12 months after the backup was made, and remain subject to this DPA until then. Xavier may retain Customer Personal Data where required by law, and will keep it confidential and process it only for that purpose.

10. International transfers

  1. Xavier processes Customer Personal Data in the United States. Unless the Customer keeps its Tenant’s data in its own database, Xavier stores it, and its backups, in the United States or, if the Order specifies another storage region that Xavier offers, in that region. Choosing a storage region outside the United States does not change where Xavier processes Customer Personal Data, and the transfer terms in this Section continue to apply. If the Customer uses its own database, Customer Personal Data in that database is stored in the location the Customer chooses, and the Customer is responsible for that database’s security and backups. Subprocessors may process Customer Personal Data in the locations listed on the Subprocessors page.
  2. EU. To the extent Customer Personal Data subject to the GDPR is transferred to Xavier in a country without an adequacy decision, the SCCs are incorporated into this DPA as follows: Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor. The Customer is the data exporter and Xavier the data importer. Clause 7 (docking clause) applies. In Clause 9, Option 2 (general written authorization) applies, with the notice period in Section 5(c) of this DPA. The optional wording in Clause 11 does not apply. In Clause 13, the competent supervisory authority is determined by the data exporter’s establishment or representative. In Clause 17, Option 1 applies and the governing law is the law of Ireland. In Clause 18, disputes are resolved by the courts of Ireland. Annexes I and II of this DPA complete the corresponding annexes of the SCCs, and the Subprocessors page completes Annex III.
  3. United Kingdom. For transfers subject to UK data protection law, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) is incorporated. Its Tables are completed with the information in this DPA, and either party may end it as permitted by its Section 19.
  4. Switzerland. For transfers subject to the FADP, the SCCs apply with these changes: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; and the term “member state” does not exclude data subjects in Switzerland from bringing claims in their place of habitual residence.
  5. If a transfer mechanism is invalidated or replaced, the parties will cooperate to put in place an appropriate alternative.

11. General

This DPA is subject to the limitations of liability in the Subscription Agreement. If this DPA conflicts with the Subscription Agreement, this DPA prevails for the processing of Customer Personal Data. If the SCCs conflict with this DPA, the SCCs prevail. This DPA ends when Xavier no longer processes Customer Personal Data.

Annex I – Description of processing

A. Parties

  • Data exporter: the Customer, as identified in its Xavier account. Contact: the account holder. Role: controller (or processor).
  • Data importer: Xavier Device Management LLC, 8 The Green, Suite B, Dover, Delaware 19901, United States. Contact: via xavier-dm.com/contact or legal@xavier-dm.com. Role: processor (or subprocessor).

B. Categories of data subjects

  • The Customer’s Authorized Users (administrators, users, and auditors of the Tenant).
  • End Users: people who use Managed Devices or are assigned to them, and people imported from the Customer’s identity provider.
  • Other people whose information appears on Managed Devices or in Customer Data, such as the owners of user accounts, browser profiles, and Apple IDs signed in on a Managed Device.

C. Categories of personal data

Depending on the platforms enrolled and the features the Customer enables:

  • Authorized User data: name, email address, role, hashed password, sign-in and activity records.
  • Directory data: End User names, email addresses, usernames, and group memberships, imported from the Customer’s identity provider or entered by the Customer.
  • Device identifiers and inventory: device name, model, serial number, UDID, IMEI/MEID, Wi-Fi MAC address, operating system, storage, battery, encryption and security status, assigned user, and local user accounts.
  • Mobile network data (Android): carrier, phone number, SIM serial (ICCID), and roaming status, where the device provides them.
  • Software data: installed applications and versions; on Macs, developer packages and runtimes (such as Homebrew, npm, pip, and RubyGems) and project dependency manifests; browser profiles (including the signed-in Google account name and email) and extensions; and signed-in Apple ID details.
  • Location data: if the Customer enables location reporting or uses Lost Mode, precise location from the device (latitude, longitude, accuracy, altitude, speed, heading) and the place name derived from it.
  • Usage and activity data (if enabled): daily totals of time each application is in the foreground; Android security logs; Android network logs, including the hostnames looked up and connections made by each app; and removable storage (USB) attachment events.
  • AI tool data (if enabled): AI tools, extensions, and MCP servers found on a device, and, if configuration scanning is enabled, findings from AI tool configuration files, which may include indications that credentials are present.
  • Escrowed secrets: disk encryption recovery keys, Activation Lock bypass codes, recovery lock and firmware passwords, and unlock tokens.
  • Command and script data: commands sent to devices, their results, and the output of scripts the Customer runs.
  • Network data: IP addresses of Managed Devices and Authorized Users.

The Service does not capture screenshots, screen recordings, keystrokes, message content, or general web browsing history.

D. Special categories of data

None intended. The Customer must not submit special categories of personal data (Subscription Agreement, Section 8).

E. Frequency of transfer

Continuous, for the duration of the Agreement.

F. Nature and purpose of processing

Hosting, storage, transmission, analysis, and display of Customer Personal Data to provide the Service: enrolling and managing devices, inventory and compliance reporting, delivering commands, software, and configuration, alerting, billing by device count, support, and securing the Service.

G. Retention

For the duration of the Agreement, subject to the retention periods the Service applies (for example, activity log records are kept for 365 days, command records for 90 days, script output for 60 days, and application usage for the period the Customer sets, up to 365 days) and to deletion by the Customer. After termination, as described in Section 9.

H. Subprocessors

As listed on the Subprocessors page, for the purposes stated there.

Annex II – Technical and organizational measures

  • Hosting: the Service runs on Google Cloud in the United States, on a managed Kubernetes cluster with private nodes spread across multiple zones. Tenant databases are hosted on MongoDB Atlas in the United States or in the storage region specified in the Order, except where the Customer chooses to keep its Tenant’s data in its own MongoDB database. Xavier’s account and billing records are kept in a separate database in the United States. Backups are kept in the same region as the database they back up. Database connection strings are kept in a secrets vault and never written to logs.
  • Tenant isolation: each customer’s data is stored in a separate database. Sessions, device credentials, and API tokens are bound to a single Tenant and rejected by any other.
  • Encryption in transit: all connections to the Service use TLS. Device requests are authenticated with per-device certificates issued by the Service’s own certificate authority, and request signatures are verified.
  • Encryption at rest: databases, backups, and infrastructure storage are encrypted at rest by the hosting providers. Recovery keys, escrowed passwords, storage credentials, and integration credentials are additionally encrypted by the application with AES-256-GCM. Infrastructure secrets are kept in a managed secrets vault.
  • Access control: role-based access for Authorized Users (administrator, user, and auditor roles). Passwords are stored only as salted one-way hashes. Sessions expire. Sign-in, password reset, API, and MCP requests are rate-limited. Saved credentials cannot be read back after they are entered.
  • Least privilege for integrations: MCP tokens are read-only, limited to the MCP endpoint, revocable, and responses exclude recovery keys and other secrets. Device agent credentials can only report for their own device.
  • Logging: commands, script runs, recovery key reveals, and MCP queries are recorded in the Tenant’s activity log, which is kept for 365 days and visible to the Customer.
  • Availability and backups: continuous database backup with 7-day point-in-time recovery and scheduled snapshots as described in the Service Level Agreement; external uptime monitoring with alerting.
  • Personnel: access to production systems and Customer Data is limited to Xavier personnel who need it to operate and support the Service, who are bound by confidentiality obligations.
  • Data minimization: optional collection features (precise location, application usage, network and security logs, AI configuration scanning) are off until the Customer enables them.
  • Vulnerability management: dependencies and infrastructure are kept up to date, and security issues can be reported through the contact form, as described in the Security Overview.