Instatus – Data Processing Addendum

Last updated October 15, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service, or any other agreement between Instatus, Inc. ("Instatus") and the customer ("Customer") for the Instatus Service (the "Agreement"). It applies automatically to every Instatus customer from the moment they accept the Agreement. No signature is required. If your organization needs a signed copy for its records, you can sign it online.
It covers the EU and UK GDPR, the Swiss Federal Act on Data Protection, US state privacy laws such as the CCPA, and other data protection laws worldwide, and it includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum for international transfers.
Capitalized terms not defined here have the meanings given in the Agreement.
2.1 Roles. Customer is the Controller (or a Processor acting on behalf of its own controller) of Customer Personal Data, and Instatus is its Processor (or subprocessor). Under the CCPA and similar US laws, Customer is the Business and Instatus is its Service Provider or Processor.
2.2 Instatus as an independent controller. Instatus is an independent Controller for the limited personal data it needs to run its own business, such as account owner details, billing records, support conversations, website analytics, fraud and abuse prevention, security logs, and Service Data as defined in the Agreement. That data is covered by our Privacy Policy, not this DPA.
2.3 Details of the Processing. The subject matter, nature, purpose and duration of the Processing, and the types of Customer Personal Data and categories of Data Subjects, are described in Annex I.
3.1 Customer will comply with Data Protection Laws in its use of the Service, and its instructions to Instatus will comply with them too.
3.2 Customer is responsible for the lawfulness of the Customer Personal Data it provides, and for having the notices, consents and other legal bases needed for Instatus to Process it under the Agreement. This includes consent from status page subscribers and from people who receive SMS messages or phone calls through the Service.
3.3 Customer will not submit special categories of personal data (such as health, biometric or genetic data), government ID numbers, payment card data or children's personal data, unless the Agreement expressly allows it.
4.1 Instructions. Instatus will Process Customer Personal Data only on Customer's documented instructions, unless the law requires otherwise, in which case Instatus will tell Customer first unless the law prohibits it. The Agreement, this DPA, and Customer's configuration and use of the Service are Customer's complete instructions. Instatus will tell Customer if it believes an instruction breaks Data Protection Laws.
4.2 Confidentiality. Instatus will ensure that everyone authorized to Process Customer Personal Data is bound by confidentiality obligations, and that access is limited to people who need it to provide, support or secure the Service.
4.3 Security. Instatus will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, including those in Annex II. Instatus may update these measures over time but will not materially reduce the overall level of protection.
4.4 No AI training. Instatus will not use Customer Personal Data to train artificial intelligence models, and will only use AI Subprocessors that are contractually prohibited from doing so.
4.5 US state law commitments. To the extent the CCPA or similar US laws apply, Instatus will not: (a) Sell or Share Customer Personal Data; (b) retain, use or disclose it for any purpose other than the business purposes set out in the Agreement, or outside the direct business relationship between the parties; or (c) combine it with personal data Instatus receives from or on behalf of others, except as the law permits for Service Providers. Instatus will comply with the obligations that apply to it under those laws, provide the same level of privacy protection they require, and notify Customer if it can no longer meet them. Customer may take reasonable and appropriate steps to stop and remedy unauthorized use of Customer Personal Data. Instatus certifies that it understands and will comply with these restrictions.
5.1 Authorization. Customer gives Instatus general authorization to engage Subprocessors. The current list, with each Subprocessor's purpose and location, is on our subprocessors page.
5.2 Obligations. Instatus will enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than this DPA, to the extent applicable to its services. Instatus remains responsible for each Subprocessor's performance of its obligations.
5.3 Notice of changes. Instatus will give at least 30 days' notice before a new Subprocessor begins Processing Customer Personal Data, by updating the subprocessors page and emailing customers who have subscribed to updates. You can subscribe as described on that page. In an emergency, such as replacing a Subprocessor that has failed or become unsafe, Instatus may give shorter notice and will explain why.
5.4 Objections. Customer may object to a new Subprocessor on reasonable data protection grounds by emailing privacy@instatus.com within the notice period. The parties will discuss the objection in good faith, and Instatus may offer an alternative, such as a change to the configuration of the Service that avoids the Subprocessor. If the parties cannot resolve the objection within 30 days, Customer may terminate the affected part of the Service by written notice and receive a refund of prepaid fees for the remainder of the term for that part.
6.1 Instatus will provide features that let Customer access, correct, export and delete Customer Personal Data, such as managing subscribers and team members in the dashboard and through the API.
6.2 If Instatus receives a request from a Data Subject that relates to Custome