Data processing agreement
This template applies when the customer is the controller and nestIP processes personal data to provide the API.
Roles
The customer decides why a score is needed. nestIP processes data as the API docs and this agreement describe. Write to hello@nestip.net to sign a copy that names both parties.
Data
IP addresses submitted for scoring, the caller IP of the API client, and the customer’s own account data. Looked-up addresses are not written to usage_logs.
Purpose
Return the score, reasons, and quota; limit abuse; record payment. This data is not sold.
Time
Caller IP on a log line: IP_LOG_RETENTION_DAYS, default 30 days. Account profile: until deletion. Payments: as accounting rules require.
Measures
API keys are hashed, passwords use bcrypt, TLS terminates at Caddy, and Postgres and Redis stay on the server’s private network.
Subprocessors
PayOS when the customer turns payments on. The server provider in Singapore (the machine that is running). IP data feeds are public sources, not recipients of customer data.
Data-subject requests
The customer forwards an end-user request to hello@nestip.net. We help within the data we actually hold.