Data Processing Agreements & Addendums
Access GeoServer’s standardized Data Processing Agreements, security addendums, and regulatory compliance documents. All templates align with GDPR, CCPA/CPRA, HIPAA (where applicable), and ISO 27001 standards.
As a data processor, GeoServer enters into Data Processing Agreements (DPAs) with all customers who process personal data through our platform. Below you will find our master DPA, jurisdiction-specific addendums, and supplementary security documents. All agreements are subject to your active subscription tier and service configuration.
Available Agreements & Addendums
Master Data Processing Agreement
Core DPA covering data controller/processor responsibilities, lawful processing bases, data subject rights, and breach notification procedures.
Download PDF ↓EU Standard Contractual Clauses (SCCs)
Supplementary module for cross-border data transfers outside the EEA/UK, aligned with EU Commission Regulation 2021/914.
Download PDF ↓Security & Confidentiality Addendum
Details technical and organizational measures (TOMs), encryption standards, access controls, and incident response SLAs.
Download PDF ↓Business Associate Agreement (BAA)
For US healthcare entities requiring HIPAA-compliant processing safeguards. Only available on Enterprise plans.
Request Access 🔒Subprocessor & Data Transfer Addendum
Lists approved sub-processors, transfer mechanisms, and opt-out procedures for third-party data handling.
Download PDF ↓Geospatial Data Governance Addendum
Covers spatial data provenance, coordinate reference system compliance, and open-standard format retention policies.
Download PDF ↓Regulatory Alignment & Certification Status
| Framework / Regulation | Coverage | Document Reference | Status |
|---|---|---|---|
| GDPR (EU/EEA) | Full Controller-Processor Compliance | Master DPA + EU SCCs | Active |
| CCPA / CPRA (California) | Data Processing & Deletion Rights | Master DPA + Security Addendum | Active |
| HIPAA (USA) | ePHI Processing Safeguards | Business Associate Agreement | Enterprise Only |
| ISO 27001:2022 | Information Security Management | Security & Confidentiality Addendum | Certified |
| SOC 2 Type II | Security, Availability, Confidentiality | Security Addendum + Audit Reports | Audited Q1 2025 |
Request a Custom DPA or Amendment
Need a jurisdiction-specific variation, extended liability terms, or a bespoke data processing workflow? Submit a request below. Our compliance team typically responds within 2 business days.