Roomote Cloud Data Processing Agreement

Last updated: July 23, 2026

This DPA is incorporated into the Roomote Cloud Terms of Service (the “Agreement”) between Roo Code, Inc., a Delaware corporation (“Roomote”), and Customer, and applies where Roomote processes personal data in Customer Content on Customer’s behalf. It is accepted by acceptance of the Agreement; a countersigned copy is available on request to legal@roomote.dev.

1. Definitions

“Personal Data”, “Controller”, “Processor”, “Data Subject”, “Processing”, “Personal Data Breach” have the meanings in Regulation (EU) 2016/679 (“GDPR”). “SCCs” means the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914. “Customer Personal Data” means Personal Data in Customer Content processed by Roomote on Customer’s behalf. Account and billing data that Roomote processes as a controller is governed by the Cloud Privacy Policy, not this DPA.

2. Roles and scope

Customer is the Controller (or a Processor acting for another Controller); Roomote is the Processor. Details of the Processing are in Annex I. Where UK GDPR or the Swiss FADP apply, this DPA applies with the adaptations in Section 10.3.

3. Roomote’s obligations

Roomote will:

(a) Process Customer Personal Data only on Customer’s documented instructions, including the Agreement, Customer’s configuration and use of the Service, and this DPA, unless required otherwise by law (in which case Roomote will inform Customer unless legally prohibited);

(b) ensure persons authorized to process are bound by confidentiality;

(d) not use Customer Personal Data to train AI models;

(e) assist Customer, taking into account the nature of the Processing, in responding to Data Subject requests and in Customer’s obligations under GDPR Articles 32–36, at Customer’s reasonable expense where permitted;

(f) notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, with the information reasonably available to Roomote;

(g) upon termination or deletion of a workspace, delete Customer Personal Data as described in Section 6;

(h) make available information reasonably necessary to demonstrate compliance with this DPA as described in Section 7.

4. Customer’s obligations

Customer is responsible for the lawfulness of the Personal Data it submits, for its instructions, for configuring the Service (including integrations and model providers) appropriately for the data it processes, and for obtaining any required notices and consents. Customer acknowledges that inference providers Customer connects act under Customer’s own agreements and are not Roomote Sub-processors.

5. Sub-processors

5.1 Customer generally authorizes the Sub-processors listed at roomote.dev/subprocessors (current list in Annex III).

5.2 Roomote will announce changes on that page at least 30 days before adding or replacing a Sub-processor that processes Customer Personal Data. Customer may object on reasonable data-protection grounds within 30 days of the announcement; if the parties cannot resolve the objection, Customer may terminate the affected workspaces and receive a pro-rata refund of prepaid fees.

5.3 Roomote imposes data-protection obligations on Sub-processors consistent with this DPA and remains responsible for their performance.

6. Deletion and return

Deleting a workspace (or account cancellation, or expiry of an unconverted trial followed by the 7-day grace period) permanently destroys the entire deployment, including databases, object storage, and associated volume backups and recovery archives. Customer may export Customer Content before deletion via the product or by request to support (fulfilled within 30 days). Roomote may retain data only where required by law, for as long as required, protected under this DPA.

7. Audits

Roomote will make available documentation describing its security measures and, upon reasonable written request (no more than once per year absent a regulator requirement or a Personal Data Breach), will respond to Customer’s reasonable security questionnaires and permit audits as required by GDPR Article 28(3)(h), conducted with reasonable notice, during business hours, without disrupting operations, and under confidentiality. Roomote does not currently hold SOC 2 or ISO 27001 certification; when third-party audit reports become available, providing them will satisfy audit requests to the extent they address the relevant controls.

8. International transfers

8.1 Customer Personal Data is processed in the United States.

8.2 Where the Processing involves a transfer from the EEA to Roomote in the US, the parties enter into the SCCs, Module Two (Controller to Processor) (or Module Three where Customer is a Processor), which are incorporated by reference. For the SCCs: Clause 7 (docking) is included; Clause 9(a) Option 2 (general authorization, 30 days’ notice); Clause 11 optional language is not used; Clause 17: Irish law; Clause 18: Irish courts. Annexes I and II of the SCCs are completed by Annexes I and II of this DPA; Annex III lists Sub-processors.

8.3 For UK transfers, the UK International Data Transfer Addendum applies to the SCCs; for Switzerland, the SCCs apply with the adaptations required by the FDPIC. If Roomote certifies to the EU–US Data Privacy Framework in the future, the DPF may serve as an alternative transfer mechanism; the SCCs remain as a fallback.

8.4 Roomote will notify Customer where legally permitted if it receives a legally binding request for Customer Personal Data from a public authority, will review the legality of such requests, and will provide the minimum data required.

9. Liability

The liability of each party under this DPA is subject to the limitations in the Agreement. This DPA does not limit Data Subjects’ rights.

10. General

10.1 This DPA prevails over conflicting terms in the Agreement regarding Personal Data; the SCCs prevail over this DPA in case of conflict.

10.2 This DPA terminates with the Agreement, surviving as long as Roomote processes Customer Personal Data.

10.3 References to GDPR include the UK GDPR and Swiss FADP where applicable, with references to the EU, Member State law, and supervisory authorities read accordingly.

Annex I — Details of Processing

A. Parties. Data exporter: Customer (controller). Data importer: Roo Code, Inc., 98 Graceland Dr, San Rafael, CA 94901, USA (processor). Contact: privacy@roomote.dev.

B. Description of Processing.

Subject matter & nature: Hosting and operating a dedicated, single-tenant deployment of the Roomote software; provisioning, storage, task execution in isolated sandboxes, backup, support, and deletion.
Purpose: Providing Roomote Cloud under the Agreement.
Duration: Term of the Agreement per workspace, until deletion under Section 6.
Categories of Data Subjects: Customer’s personnel and users; individuals whose data appears in Customer’s repositories, tasks, integrations, and related content, as determined by Customer.
Categories of Personal Data: Determined by Customer; typically identifiers and content in source code, commit history, issues, chat messages, prompts, logs, and connected-tool data. Customer should not submit special-category data unless it has assessed the Service as appropriate; the Service is not designed for such data and no special safeguards beyond Annex II are provided.
Frequency: Continuous.

C. Competent supervisory authority. Determined per SCC Clause 13 based on the exporter’s establishment.

Annex II — Technical and Organizational Measures

Tenant isolation: one private, dedicated deployment per customer (application services, PostgreSQL, Redis, object storage) with no shared tenancy; internal service communication over private networking.
Encryption in transit: TLS/HTTPS for browser-facing and service endpoints.
Secrets management: per-deployment encryption keys and generated secrets; customer inference keys held in-deployment via a local key proxy, not distributed to sandboxes or Roomote shared systems; control-plane job payloads encrypted at rest with AES-256-GCM.
Access control: control plane limited to health checks and access-state changes with no data-query pathway into tenant deployments; privileged infrastructure access restricted to a small number of authorized personnel for operations, support, security, and legal compliance; sessions revocable; strong password policy and verified email; optional SSO via Google.
Operations security: internal operations requests HMAC-signed with short validity windows; sandbox API uses per-tenant derived credentials, signed requests, nonce replay protection, rate and concurrency limits, and trusted-image allow-listing; security headers (CSP, referrer and content-type protections).
Sandbox isolation: task execution in isolated, per-task sandbox environments with ownership tags re-verified on operations.
Availability & resilience: daily backups and point-in-time recovery for tenant databases within the tenant’s own project; backups are destroyed with the deployment.
Deletion: immediate, complete destruction of the deployment including backups upon deletion; 7-day post-trial deletion for unconverted trials; legal-hold capability to suspend deletion where legally required.
Personnel: confidentiality obligations; access on a need-to-use basis; formal access audit logging being expanded as the organization grows.
Incident response: breach notification per Section 3(f); suspend-and- preserve procedure for abuse investigations.

Annex III — Sub-processors

Current list, purposes, and data categories: roomote.dev/subprocessors. As of July 23, 2026: Railway (infrastructure hosting), Modal (task sandboxes), Vercel (DNS), Resend (transactional email), Stripe (payments), Google (optional sign-in), PostHog and Intercom (portal only, consent-based). Inference/model providers connected by Customer are not Sub-processors.