Data Processing Addendum

Controller and processor roles

When you send alerts through my-iris, you are the controller of the recipient data and alert content you provide, and MeshWorks Wireless Oy acts as your processor. We process that data only to deliver the service and on your documented instructions.

GDPR Article 28 framing

The DPA is structured to meet the requirements of Article 28 GDPR, covering scope and purpose of processing, confidentiality, security measures, subprocessing, assistance with data-subject requests, breach notification, and deletion or return of data at the end of the engagement.

Subprocessors

We use a small, deliberate set of subprocessors to deliver my-iris. The current list, their purpose, and their region are published on the subprocessors page, along with the mechanism by which we notify customers of changes.

Push delivery for the my-iris app (section 6.9). Apple and Google process data only for a workspace that uses the my-iris app. Choosing the app alerting model — when you sign up, or by asking us to switch your workspace — is your specific written authorisation of these two subprocessors under Article 28(2) GDPR, and we record who made the choice and when. They receive only the push address of a recipient’s app installation and an encrypted notification of fixed size, never the alert text or a phone number.

Data residency

my-iris runs on Cloudflare’s EU infrastructure: our core database and alerting state (D1 and Durable Objects) are pinned to the EU region, while some edge components (KV and Queues) are globally distributed by Cloudflare, holding the minimum needed and covered by the EU–US DPF / SCCs. Where a subprocessor involves a transfer, the DPA sets out the applicable safeguards.

Security measures

• Encryption in transit (TLS)
• Encryption at rest (AES-256)
• EU-region core storage (D1/DO)
• Role-based access control + tenant isolation
• Append-only audit logs
• Pseudonymisation + configurable retention

In summary: TLS in transit, AES-256 at rest, cryptographic webhook-signature verification, role-based access control, tenant isolation, append-only audit logs, and pseudonymisation of identifiers in long-retained records. The full technical and organisational measures (TOMs) are enumerated in Annex C of the DPA, available on request.