Data Processing Agreement
Last updated October 22, 2026
1. Roles and scope
The customer is the data controller and Stockfront is the data processor for personal data the customer processes through the service. The agreement applies for as long as Stockfront processes such data on the customer’s behalf.
2. Instructions and purpose
Stockfront processes data only on documented instructions to deliver purchasing, inventory, sales sync, receiving and support functionality. Categories of data subjects may include the customer's employees, supplier contacts and Shopify customers in short-lived source data.
3. Confidentiality and security
Authorized persons are bound by confidentiality. Technical and organizational measures include access control, TLS, encryption at rest at infrastructure providers, secure session handling, logging without secrets, backups and incident handling.
4. Subprocessors
Approved categories include Vercel for hosting, Neon for the database, Resend for email and Shopify as the integration platform. Stockfront will notify of material changes and ensure equivalent data protection obligations.
5. Assistance
Stockfront reasonably assists with data subject rights, security breaches, DPIAs and supervisory inspections. Security breaches are notified without undue delay after Stockfront becomes aware of them.
6. Deletion and audit
On termination, personal data is deleted or returned at the customer’s choice, except where retention is required by law. Stockfront will make necessary documentation available and allow proportionate audits.
7. Transfers
Transfers outside the EEA must rely on a valid transfer basis, including an adequacy decision or the EU Standard Contractual Clauses where relevant.