Master Service Agreement

VeoWork Timesheets for Azure DevOps Services — Version 1.0, effective 8 October 2026

This Master Service Agreement (the “MSA”) is between:

1. Drudewerk UG (haftungsbeschränkt), with its business address at Cosimastr. 121, 81925 München, Germany, registered in Handelsregister B of Amtsgericht München under HRB 316676 (“Drudewerk” or “Provider”); and
2. the business, public body or other organization identified as the customer in an Order Form (“Customer”).

Each is a “Party” and together the “Parties”. The Service is offered under this MSA only for business or professional purposes, not to consumers.

1. Contract formation and structure

1.1 Contract formation

A contract is formed when Drudewerk and Customer sign or otherwise accept an Order Form that incorporates this MSA, including an online Order Form accepted by a representative authorized to bind Customer. The “Effective Date” is the date specified in that Order Form or, if none is specified, the date on which the last Party accepts it.

An ordinary Authorized User’s in-product acceptance does not by itself bind Customer to fees, subscription duration, renewal or other commercial terms unless that user is authorized to do so. By clicking the in-product acceptance or using the Service after it is displayed, an ordinary Authorized User agrees directly with Drudewerk to comply personally only with the acceptable-use, confidentiality and account-security duties identified in Sections 5, 10.4 and 11. The user does not thereby become responsible for Customer’s other obligations.

1.2 Contract documents

The agreement consists of:

• each Order Form accepted by the Parties;
• this MSA, including Annex A (Service Level Agreement and Service Conditions) and Annex B (Data Processing Agreement and its schedules and exhibits); and
• Documentation expressly incorporated by an Order Form or this MSA.

Trials and free plans form part of the agreement only when Drudewerk expressly offers them to Customer in writing or through an authorized subscription flow.

1.3 Order of precedence

If documents conflict, the following order applies:

1. the EU Standard Contractual Clauses incorporated under Schedule B3, but only for a restricted transfer they govern;
2. Annex B, but only for the processing of personal data;
3. the applicable Order Form;
4. the main body of this MSA;
5. Annex A; and
6. the Documentation.

An Order Form overrides Annex B only if it expressly identifies the DPA provision being changed and the change is lawful. No Order Form may authorize processing prohibited by Section B1.5. Customer purchase orders, procurement portals, email footers and similar unilateral terms are administrative only and do not amend the agreement.

2. Definitions

“Affiliate” means an entity that directly or indirectly controls, is controlled by, or is under common control with a Party, where control means ownership of more than half the voting interests or the power to direct management.

“Authorized User” means a named individual whom Customer permits to use the Service under its account.

“Azure DevOps Services” means Microsoft’s cloud-hosted Azure DevOps service. It does not include Azure DevOps Server or another on-premises deployment.

“Customer Data” means data and content submitted to or stored in the Service, obtained by the Service from one or more Azure DevOps Services organizations connected by Customer, or otherwise processed through the Service for Customer. It excludes Provider Account Data.

“Data Protection Laws” means privacy and data-protection laws applicable to a Party’s processing under the agreement, including the GDPR and laws implementing or supplementing it.

“Documentation” means the user guides, technical documentation, and security materials made available by Drudewerk through the Service, on its website, or through its support channels, in each case as in effect at the time the relevant Service is used.

“Fees” means the charges stated in an Order Form.

“Order Form” means a direct order document, quotation, subscription confirmation or authorized online order accepted by both Parties and identifying the Service ordered.

“Provider Account Data” means business-contact, subscription, billing, support, security and similar data that Drudewerk processes as an independent controller under its Privacy Policy.

“Service” means the VeoWork Timesheets extension and hosted service for Azure DevOps Services, including its web interfaces, application programming interfaces, synchronization, transactional emails, updates and included support.

“Subscription Term” means the subscription period stated in an Order Form, including any renewal period agreed there.

“Third-Party Services” means services not supplied by Drudewerk, including Azure DevOps Services and the Customer’s identity, network, device and email systems.

3. The Service and right to use it

3.1 Provision of the Service

During the Subscription Term and subject to the agreement, Drudewerk will make the Service available for Customer’s internal business purposes. Customer receives a limited, non-exclusive, non-transferable and non-sublicensable right to permit its Authorized Users to access and use the Service and Documentation. The right ends when the applicable subscription ends.

3.2 Named-user licensing

Each license is assigned to one Authorized User. The applicable Order Form specifies the number of named-user licenses, the Azure DevOps Services organizations covered, and whether one license permits the same Authorized User to use the Service across more than one covered Azure DevOps Services organization. A license does not permit use across multiple Azure DevOps Services organizations unless the applicable Order Form expressly states that it does. If the Order Form does not address multi-organization use, the Parties must agree that scope in writing before such use begins.

Customer may reasonably reassign a license when a person changes role, leaves the organization, is replaced, or no longer needs access. Licenses may not be shared, rotated between concurrent users, or reassigned primarily to avoid purchasing the number of licenses actually required.

Customer will not exceed the named-user quantity or organizational scope stated in the applicable Order Form. If use exceeds either, the Parties will promptly agree an appropriate Order Form adjustment; Drudewerk may restrict the excess use after reasonable notice if they do not resolve it.

3.3 Customer administration

Customer controls its users, roles, Azure DevOps connections, settings, approval workflows, custom attributes, budgets and other configuration. Customer is responsible for determining who is authorized, keeping administrator and API-token access current, and promptly revoking access that is no longer required.

3.4 Trials and free plans

Any trial or free plan is provided only on the scope, capacity and duration Drudewerk expressly states when offering it. Drudewerk may modify or end a trial or free plan on reasonable notice, or immediately to prevent abuse or security risk. Sections intended by their nature to apply to such use, including acceptable use, confidentiality, intellectual property, data protection and liability, remain applicable. Except for mandatory liability, a trial or free plan is provided as available and without service commitments.

4. Customer responsibilities

Customer will:

• provide accurate order and administrator information and keep it current;
• have all rights, notices, lawful bases and permissions needed for Customer Data and Drudewerk’s processing under the agreement;
• issue only lawful instructions and configure the Service consistently with applicable employment, works-council, tax, time-recording, privacy and other laws;
• not knowingly submit or configure the Service to access or synchronize special-category data within the meaning of Article 9 GDPR or personal data relating to criminal convictions and offences within the meaning of Article 10 GDPR;
• use reasonable measures to prevent Authorized Users from intentionally making such data available to the Service and configure comments, custom attributes, connected work items, migration records and support materials accordingly;
• maintain the Azure DevOps Services subscription, permissions and configuration required to use the Service, and comply with the Microsoft terms applicable to Customer’s use of Azure DevOps Services;
• use reasonable security measures for accounts, devices, email, API tokens and integration credentials;
• review exports, calculations, approvals and reports before relying on them for payroll, invoicing, employment or legal purposes; and
• cooperate reasonably with Drudewerk in investigating incidents, suspected misuse and support issues.

Customer is responsible for acts and omissions of its Authorized Users as if they were Customer’s own, except to the extent caused by Drudewerk’s breach.

5. Acceptable use and account security

Customer and each Authorized User must not:

• use the Service unlawfully or infringe another person’s rights;
• introduce malware, probe or circumvent security, attempt unauthorized access, or interfere with the Service or another customer’s use;
• access another tenant’s data or impersonate another person;
• disclose credentials or API tokens, permit account sharing, or defeat named-user licensing;
• intentionally submit or otherwise make available to the Service, or configure the Service to access or synchronize, special-category data within the meaning of Article 9 GDPR or personal data relating to criminal convictions and offenses within the meaning of Article 10 GDPR;
• reverse engineer, decompile or attempt to discover non-public source code except to the limited extent that applicable law prohibits this restriction;
• copy, resell, sublicense, lease or provide the Service as a bureau service unless an Order Form expressly permits it;
• use automated means in a way that materially exceeds documented interfaces or unreasonably burdens the Service;
• remove proprietary notices or use Drudewerk intellectual property outside the rights granted; or
• use the Service or its output to develop or train a competing product in a way that infringes Drudewerk’s rights.

An Authorized User must promptly notify Customer or Drudewerk of suspected account compromise and must keep non-public Service information and Customer Data confidential.

6. Azure DevOps Services and other dependencies

The Service depends on Azure DevOps Services, internet connectivity and other Third-Party Services selected or controlled by Customer. Microsoft is not Drudewerk’s subprocessor merely because Customer directs the Service to interact with Customer’s Microsoft environment. Microsoft remains responsible for Azure DevOps Services under its agreement with Customer.

Drudewerk is not responsible for an outage, change, restriction, data loss or security event caused by a Third-Party Service selected or controlled by Customer or by Customer configuration, except to the extent Drudewerk caused or should reasonably have mitigated the impact under this agreement. Changes by Microsoft to APIs, permissions, extension policies or platform functionality may require Drudewerk to alter, suspend or discontinue affected functionality.

7. Service operations, support and changes

7.1 Support

Support is available by email at [email protected] on German business days from 09:00 to 17:00 Europe/Berlin. Drudewerk handles support on a best-effort basis, taking into account severity, available information and operational impact. Unless an Order Form expressly adds a separate signed commitment, there is no guaranteed response or resolution time.

7.2 Maintenance and security work

Drudewerk may perform scheduled or emergency maintenance. Where reasonably practicable, Drudewerk will give advance notice of planned work likely to cause material interruption. Emergency maintenance may occur without advance notice where needed to protect the Service, customers or third parties. Maintenance affects the uptime calculation only as stated in Annex A.

7.3 Uptime SLA

During each paid Subscription Term, Drudewerk commits to a Monthly Uptime Percentage of at least 99.5% for the Core Hosted Functions. Annex A defines the calculation, exclusions, claim procedure and Service Credit available if Drudewerk does not meet that commitment. The uptime SLA does not apply to a trial or free plan and does not create a response-time, resolution-time, latency or recovery-time commitment.

7.4 Changes and retirement

Drudewerk may improve, replace or change features while preserving the Service’s material core function during a paid Subscription Term. Drudewerk will give at least 90 days’ notice before permanently retiring the Service or a material paid feature without a substantially comparable replacement. If retirement materially prevents Customer’s intended use before the end of a prepaid Subscription Term, Customer may terminate the affected Order Form on the retirement date and receive a pro-rata refund of prepaid Fees for the unused period.

The 90-day period does not apply where an earlier change is reasonably required by law, a security threat, a third-party platform change outside Drudewerk’s control, or to prevent material harm. Drudewerk will give as much notice as reasonably practicable and use reasonable efforts to reduce disruption.

8. Orders, Fees and taxes

8.1 Order Form controls commercial terms

The Order Form exclusively defines the named-user license quantity, the Azure DevOps Services organizations covered, whether one license permits the same Authorized User to use the Service across more than one covered Azure DevOps Services organization, Fees, currency, invoicing and payment schedule, invoice due date, Subscription Term, renewal, cancellation procedure and any cancellation notice period. None of those terms has a default under this MSA. If an accepted Order Form omits a necessary commercial field, the Parties must agree it in writing before the affected obligation takes effect.

8.2 Payment

Customer will pay undisputed invoices as stated in the Order Form. If Customer disputes an amount in good faith, it must notify Drudewerk promptly with reasonable detail and pay the undisputed part. Statutory rights concerning late-payment interest and recovery costs remain unaffected.

8.3 Taxes

Fees exclude value-added tax, sales tax and similar indirect taxes unless the Order Form says otherwise. Customer will pay taxes Drudewerk is legally required to charge, except taxes based on Drudewerk’s net income. Customer will provide valid tax and exemption information. If law requires withholding, Customer will make the withholding, provide official evidence and cooperate in seeking available relief.

8.4 No purchase-order terms

A purchase-order number may be included for Customer’s administration, but failure to issue a purchase order does not excuse payment after an Order Form is binding. Terms printed on a purchase order do not apply.

9. Customer Data, export and deletion

9.1 Customer control and license

As between the Parties, Customer retains its rights in Customer Data. Customer grants Drudewerk and its subprocessors a non-exclusive right to host, copy, transmit, transform and otherwise process Customer Data only as needed to provide, secure and support the Service, comply with documented instructions and law, and exercise rights under the agreement.

9.2 Export during the term

The Service provides an in-product Excel export for worklogs. On request to support, Drudewerk will also provide a reasonable machine-readable export of other tenant data that Drudewerk can practicably extract, subject to identity and authority verification. An export does not include Drudewerk software, security-sensitive configuration, another customer’s data, or data held only by a Third-Party Service.

9.3 Termination procedure

For 60 days after an Order Form terminates or expires, Customer may request an export. Drudewerk will complete a timely requested export and delete Customer Data from active systems no later than the end of that same 60-day period, unless the Parties agree otherwise or law requires retention. Customer should request export early enough to resolve format or authorization questions within that period.

9.4 Aggregated operational information

Drudewerk may derive statistics that do not identify Customer, an Authorized User or another person and cannot reasonably be linked back to Customer. Drudewerk may use those anonymous statistics to operate, secure and improve the Service. Drudewerk does not use Customer Data to train machine-learning or generative-AI models.

10. Intellectual property and feedback

10.1 Drudewerk property

Drudewerk and its licensors retain all rights in the Service, Documentation, software, designs, interfaces, methods, know-how, trademarks and improvements. Except for the limited rights expressly granted, no right transfers to Customer.

10.2 Customer property

Customer and its licensors retain all rights in Customer Data and Customer trademarks. Nothing in this MSA transfers ownership of Customer Data to Drudewerk.

10.3 Feedback

If Customer voluntarily provides ideas or feedback, Drudewerk may use them without restriction or payment, provided Drudewerk does not identify Customer or disclose Customer Confidential Information without permission. This does not transfer Customer Data or Customer-owned inventions unrelated to the feedback.

10.4 Restrictions

Customer and Authorized Users may not use Drudewerk names, marks, source materials or proprietary interfaces except as expressly permitted by the agreement, Documentation or law.

11. Confidentiality

11.1 Confidential Information

“Confidential Information” means non-public information disclosed by or for a Party that is marked confidential or should reasonably be understood as confidential given its nature and the circumstances. Customer Data is Customer Confidential Information. Non-public software, security information, pricing and product plans are Drudewerk Confidential Information.

Confidential Information does not include information that the recipient can document: is lawfully public without breach; was already lawfully known without a duty of confidentiality; was lawfully received from a third party without restriction; or was independently developed without use of the discloser’s information.

11.2 Protection and permitted use

The recipient will use Confidential Information only to perform or exercise rights under the agreement, protect it with at least reasonable care, and disclose it only to personnel, Affiliates, advisers and subcontractors who need it and are bound by confidentiality duties no less protective in substance. The recipient is responsible for their compliance.

11.3 Required disclosure

The recipient may disclose Confidential Information when legally compelled. Where lawful and practicable, it will give prior notice and reasonable assistance so the discloser can seek protection. It will disclose only what is legally required.

11.4 Duration and remedies

These duties apply during the agreement and for five years afterward, except that trade secrets and personal data remain protected as long as their nature or law requires. Each Party may seek appropriate injunctive or other relief for threatened or actual misuse.

12. Privacy and security

The Privacy Policy explains Drudewerk’s controller processing. Annex B applies where Drudewerk processes personal data on Customer’s behalf and is incorporated into every Order Form. Drudewerk will maintain the technical and organizational measures in Exhibit B4, taking into account the nature, scope, context and purposes of processing and the risks.

Customer acknowledges that no system is completely secure. Each Party will promptly provide information reasonably needed to address a security incident and will not make misleading statements about the other Party’s systems or responsibility.

Security vulnerability reports should be sent to [email protected]. Unless Drudewerk expressly publishes separate bug-bounty terms, Drudewerk does not offer payment or other rewards for vulnerability reports, and submitting a report does not create any entitlement to compensation. Reporting a vulnerability does not authorize testing, scanning, access or other activity prohibited by Section 5 or applicable law.

13. Warranties and disclaimers

13.1 Mutual authority

Each Party warrants that it has authority to enter into the agreement. Customer warrants that the representative accepting an Order Form has authority to bind Customer and that Customer’s instructions and use will comply with law.

13.2 Service warranty

Drudewerk warrants that, during a paid Subscription Term, the Service will materially conform to its Documentation when used as authorized, and that Drudewerk will provide the Service with reasonable skill and care. Except for a failure to meet the uptime commitment, which is governed by Annex A, Customer’s remedy for a reproducible breach is correction or re-performance within a reasonable time. If Drudewerk cannot materially cure the breach, Customer may terminate the affected Order Form and receive a pro-rata refund of prepaid Fees for the unused period.

13.3 Exclusions

The warranty does not apply to issues caused by Customer Data, unauthorized or unsupported use, Customer systems, Third-Party Services selected or controlled by Customer, failure to follow Documentation, or a trial or free plan. Subject to the express uptime commitment and Service Credit in Annex A, and except for express warranties and mandatory statutory rights, the Service is provided as available. Drudewerk does not warrant uninterrupted or error-free operation, that every defect will be corrected, or that calculations and exports can replace Customer’s professional, payroll, accounting, employment-law or tax review.

14. Third-party intellectual-property claims

14.1 Drudewerk protection

Drudewerk will defend Customer against a third-party claim alleging that Customer’s authorized use of the unmodified Service infringes that third party’s patent, copyright, trademark or trade secret, and will pay damages and reasonable costs finally awarded or included in a settlement Drudewerk approves.

Drudewerk has no obligation to the extent a claim arises from Customer Data, Customer instructions, unauthorized use, a modification not made by Drudewerk, continued use after notice of an infringement remedy, or combination with items not supplied or specified by Drudewerk where the claim would not otherwise arise. Drudewerk may obtain a right to continue use, modify or replace the affected item, or terminate it and refund prepaid Fees for the unused affected period.

14.2 Customer protection

Customer will defend Drudewerk against a third-party claim arising from Customer Data, Customer’s unlawful instructions, or Customer’s or an Authorized User’s unauthorized use of the Service, and will pay damages and reasonable costs finally awarded or included in a settlement Customer approves, except to the extent caused by Drudewerk’s breach.

14.3 Procedure

The protected Party must give prompt notice, reasonable cooperation and control of the defence to the protecting Party. A delay reduces the obligation only to the extent it materially prejudices the defence. The protecting Party may not settle a claim in a way that admits fault by, imposes non-monetary duties on, or fails to fully release the protected Party without its consent, not to be unreasonably withheld.

15. Liability

15.1 Liability outside the contractual caps

Nothing excludes or limits liability for intent or gross negligence; injury to life, body or health; fraud or fraudulent concealment; an expressly assumed guarantee; claims under the German Product Liability Act; or any other liability that cannot lawfully be excluded or limited. Mandatory rights under applicable data-protection law remain unaffected.

Liability under this Section 15.1 remains subject to the requirements, defences and statutory limitations of applicable law. The uptime commitment and Service Credit under Annex A do not constitute an expressly assumed guarantee.

15.2 Slight negligence

For slight negligence, a Party is liable only for breach of an essential contractual duty whose performance enables proper execution of the agreement and on which the other Party may ordinarily rely. That liability is limited to damage that was typical and reasonably foreseeable when the relevant Order Form was concluded and is subject to the General Cap in Section 15.4. In all other cases, liability for slight negligence is excluded to the extent permitted by law.

15.3 Causation and mitigation

Subject to mandatory law, each Party is liable only for loss it caused. The injured Party must take reasonable steps to mitigate avoidable loss and may not recover more than once for the same loss, including under different claims or remedies. In assessing recoverable data-restoration loss, the Service’s agreed export and backup arrangements and Customer’s reasonable opportunities to export data will be taken into account, without reducing Drudewerk’s express obligations.

15.4 Aggregate monetary caps

Subject to Section 15.1, each Party’s aggregate monetary liability arising out of or in connection with the agreement during a Liability Period, regardless of the legal basis of a claim, is limited by this Section across all Order Forms. Each consecutive 12-month period beginning on the date Customer’s first Order Form incorporating this MSA takes effect is a “Liability Period”; if the agreement ends before the current 12-month period does, that final Liability Period is the shorter period ending with the agreement.

For all liability other than the categories subject to the Enhanced Cap below, the “General Cap” is EUR 10,000 per Liability Period.

For liability arising from: (a) a breach of Section 11; (b) a breach of Section 12 or Annex B, including the applicable confidentiality, data-protection and security obligations; or © a Party’s obligations under Section 14, the “Enhanced Cap” is EUR 25,000 per Liability Period.

Amounts applied against the General Cap also count toward the Enhanced Cap, and the aggregate of all liability subject to the caps in this Section in a Liability Period may not exceed the Enhanced Cap. Monetary amounts counted against the applicable cap include damages, settlements, reimbursements, amounts awarded as costs and reasonable external costs incurred in carrying out a defense obligation under Section 14. A series of related events is treated as one event and allocated to the Liability Period in which the first related event occurred.

Service Credits under Annex A and refunds of prepaid Fees expressly required by the agreement are contractual fee adjustments or repayment obligations, are not damages, and do not count toward these caps or become unavailable because a cap has been exhausted. The caps do not limit Customer’s obligation to pay Fees or either Party’s right to seek non-monetary relief. They do not limit any liability identified in Section 15.1, any right or liability that cannot lawfully be limited under Annex B or applicable Data Protection Laws, or the rights of Data Subjects or Supervisory Authorities. Applicable Standard Contractual Clauses prevail to the extent they prohibit or conflict with a limitation in this Section.

15.5 Representatives

The permitted exclusions and limitations also apply to a Party’s employees, directors, agents and subcontractors. This Section does not change the allocation of responsibility in the DPA or the Standard Contractual Clauses where those terms must prevail.

16. Term, suspension and termination

16.1 Term and renewal

This MSA begins on the Effective Date and continues while an Order Form remains in effect. The Subscription Term, any renewal, cancellation method and notice period exist only as specified in the Order Form.

16.2 Suspension

Drudewerk may suspend affected access where reasonably necessary to address a material security risk, unlawful use, an acceptable-use breach, overdue undisputed Fees, or a threat to the Service or another customer. Unless urgent action is necessary, Drudewerk will first give notice and a reasonable opportunity to cure. Suspension will be proportionate, limited to the affected scope where practical, and lifted promptly when the reason is resolved. Fees continue during a suspension caused by Customer.

16.3 Termination for cause

Either Party may terminate an affected Order Form or this MSA if the other Party materially breaches and does not cure within 30 days after written notice, or within 10 days for overdue undisputed Fees. A Party may terminate immediately if the other Party finally ceases business, enters insolvency proceedings that are not dismissed where applicable, or cannot lawfully continue the agreement.

If Customer terminates for Drudewerk’s uncured material breach, Drudewerk will refund prepaid Fees for the unused terminated period. If Drudewerk terminates for Customer’s breach, accrued and committed Fees remain payable to the extent permitted by law.

16.4 Effect of termination

Access ends at termination except for the 60-day export procedure in Section 9.3. Each Party will return or delete the other’s Confidential Information on request, subject to the DPA, routine backups and legal retention. Provisions that by their nature should survive do so, including payment, confidentiality, ownership, liability, dispute, export/deletion and data-protection terms.

17. Compliance with law

Each Party will comply with laws applicable to its own performance, including anti-bribery, sanctions and export-control laws. Customer will not permit use by a sanctioned person or from an embargoed territory where prohibited. Drudewerk may refuse or suspend performance to the extent reasonably necessary to comply with binding law, after notice where legally permitted.

18. Customer name and public statements

Drudewerk may identify Customer by name and display Customer’s unaltered logo in a factual customer list. Customer may opt out at any time by emailing [email protected], after which Drudewerk will stop new use and remove online use within a reasonable time.

Testimonials, case studies, quotations and press releases naming Customer require Customer’s prior approval. Neither Party may imply the other’s endorsement or partnership.

19. General terms

19.1 Assignment and subcontracting

Neither Party may assign the agreement without the other’s prior consent, not to be unreasonably withheld, except to an Affiliate or in connection with a merger, reorganization or sale of substantially all relevant business or assets, provided the assignee assumes the obligations and is not a direct competitor of the non-assigning Party. Drudewerk may use subcontractors but remains responsible for its contractual obligations and must comply with the DPA for subprocessors.

19.2 Force majeure

Neither Party is liable for delay caused by events beyond its reasonable control, excluding payment obligations. The affected Party will notify the other, use reasonable efforts to reduce the impact and resume performance. If a material interruption continues for more than 60 days, either Party may terminate the affected Order Form; Customer receives a pro-rata refund of prepaid Fees for the unused terminated period.

19.3 Notices

Legal, security and DPA notices to Drudewerk must be sent to [email protected]. Notices to Customer may be sent to the legal, billing or administrator contact in the Order Form. Notice is effective when received; email is considered received on the next business day unless the sender receives a delivery failure. Routine support belongs at [email protected].

19.4 Changes to online terms

Drudewerk may update online terms with at least 30 days’ notice. A change materially adverse to Customer takes effect for an existing paid subscription only on its next renewal, unless Customer expressly agrees sooner. Drudewerk may make an earlier change where urgently required by law or security, provided it does not materially reduce Customer’s existing contractual rights or Service functionality during the current Subscription Term. If an urgent change unavoidably causes such a reduction, Customer may terminate the affected Order Form and receive a pro-rata refund of prepaid Fees for the unused period.

19.5 Entire agreement, waiver and severability

The agreement is the entire agreement about its subject and replaces prior proposals and understandings. A waiver must be in writing and applies only to the stated instance. If a provision is invalid, the remainder continues; the invalid provision will be replaced to the extent legally possible by a valid provision closest to its commercial purpose. No rule construing ambiguity against the drafter applies.

19.6 Relationship and third-party rights

The Parties are independent contractors. The agreement creates no partnership, agency, employment or fiduciary relationship. Except for persons protected under Sections 14 and 15.5 and data subjects’ rights under the SCCs, no third party receives enforcement rights.

19.7 Electronic execution and language

Order Forms may be accepted electronically and in counterparts. The English version governs; a translation is for convenience unless mandatory law requires otherwise.

20. Governing law and venue

German law governs the agreement without its conflict-of-laws rules and excluding the UN Convention on Contracts for the International Sale of Goods. Where legally permitted, the courts at Drudewerk’s registered seat have exclusive jurisdiction. Mandatory venues and the jurisdiction provisions of applicable Standard Contractual Clauses remain unaffected.

Annex A — Service Level Agreement and Service Conditions

A1. Scope

This Annex describes the operational conditions included with VeoWork Timesheets and establishes the uptime service level agreement for each paid Subscription Term. It does not apply to a trial or free plan. Unless an applicable Order Form expressly changes a provision of this Annex, the uptime commitment applies without needing to be repeated in the Order Form.

This Annex does not establish a response-time, resolution-time, latency or recovery-time commitment.

A2. Supported service

The Service supports Azure DevOps Services. Customer must maintain a compatible browser, internet access, a valid Microsoft environment and required Azure DevOps permissions. Azure DevOps Server and other on-premises deployments are not supported.

Drudewerk may publish or communicate supported browser and platform requirements through Documentation. Customer must install required extension updates and maintain supported configurations.

A3. Maintenance and release management

Drudewerk uses reasonable care when deploying changes and may use gradual rollouts, rollback procedures and emergency fixes. Planned maintenance likely to materially interrupt normal use will be communicated to Customer’s administrator contact by email or through the Service at least 48 hours in advance to qualify as Excluded Minutes. No more than four hours of planned maintenance in a calendar month qualify as Excluded Minutes; unavailable time above that limit is included in the uptime calculation under Section A5.

Reasonably necessary emergency or security maintenance may occur at any time. Drudewerk will notify Customer as soon as reasonably practicable, and the time reasonably required for that work qualifies as Excluded Minutes.

A4. Support process

Support requests must be sent to [email protected] with a description, impact, steps to reproduce where available, and relevant redacted diagnostics. Support hours are German business days, 09:00–17:00 Europe/Berlin. Support is best effort. No response-time or resolution-time guarantee applies.

Drudewerk may prioritize issues according to impact and may ask Customer to provide reasonable cooperation, reproduce the issue, install a correction, or test a workaround. Support does not include custom development, data entry, training, legal advice, support for third-party products or recovery from Customer’s unsupported changes unless an Order Form says otherwise.

A5. Monthly uptime commitment and calculation

“Core Hosted Functions” means the Service’s web interface, application programming interfaces and essential synchronization functions used for normal time entry, approval and reporting. It excludes support and transactional-email delivery.

“Measurement Minutes” means all elapsed minutes during the part of a calendar month in which the applicable paid Subscription Term is active, measured in the Europe/Berlin time zone. “Excluded Minutes” means Measurement Minutes affected by an exclusion in Section A6. “Eligible Minutes” means Measurement Minutes less Excluded Minutes.

A “Downtime Minute” is a full continuous minute within Eligible Minutes during which a failure of the Service, including a failure of a hosting or infrastructure provider selected by Drudewerk, materially prevents the affected Customer from normally using at least one Core Hosted Function through supported methods. Performance degradation counts only when it has that effect.

“Monthly Uptime Percentage” means: (Eligible Minutes minus Downtime Minutes) divided by Eligible Minutes, multiplied by 100. The calculation uses full precision when compared with the commitment and may be displayed rounded to four decimal places. Drudewerk commits to a Monthly Uptime Percentage of at least 99.5% for the Service provided to Customer under each applicable Order Form in each calendar month. If there are no Eligible Minutes in a calendar month, no Monthly Uptime Percentage or Service Credit is calculated for that month.

Drudewerk’s server-side monitoring is the primary evidence for the calculation. Drudewerk will reasonably consider Customer-provided timestamps, errors, logs and other relevant evidence when evaluating a claim.

A6. Excluded Minutes

The following do not count as Downtime Minutes to the extent they cause the unavailability:

• planned, emergency or security maintenance qualifying under Section A3;
• Azure DevOps Services, Microsoft identity or another Third-Party Service selected or controlled by Customer;
• Customer networks, devices, systems, configuration, credentials, permissions, API limits or Customer Data;
• internet connectivity or DNS outside Drudewerk’s control;
• Customer’s or an Authorized User’s act, omission, unauthorized or unsupported use, or failure to follow Documentation or a reasonable corrective instruction from Drudewerk;
• suspension permitted by the MSA; or
• a force-majeure event under Section 19.2.

A minute affected by more than one exclusion is counted only once as an Excluded Minute, and an Excluded Minute cannot also be a Downtime Minute.

An outage of a hosting or infrastructure provider selected by Drudewerk is not excluded merely because that provider is a third party. A supplier failure does not qualify as force majeure merely because the supplier is outside Drudewerk’s direct control.

A7. Service Credit and claim procedure

“Applicable Monthly Service Fees” means the recurring Fees attributable to the affected Service and calendar month, net of agreed discounts and excluding taxes, professional services and other one-time charges. Recurring Fees prepaid for multiple months are allocated evenly across those months unless the applicable Order Form states a different monthly allocation. Fees for a partial calendar month are prorated by calendar day.

If the Monthly Uptime Percentage is below 99.5%, Customer may claim a “Service Credit” equal to 10% of the Applicable Monthly Service Fees. Only one Service Credit is available under an applicable Order Form in a calendar month, regardless of the number or duration of incidents, and the total credit for that month will not exceed 10% of the Applicable Monthly Service Fees.

Customer must submit its claim to [email protected] within 30 days after the end of the affected calendar month. The claim must identify Customer and the applicable Order Form, describe the affected Core Hosted Functions, provide the dates, times and time zone of the claimed Downtime Minutes and observed errors, and include reasonably available supporting evidence. Customer must have paid all due and undisputed amounts under the affected Order Form when submitting the claim and when the Service Credit is applied.

Drudewerk will reasonably review the claim against the calculation and exclusions in this Annex. An approved Service Credit will be applied only against the next invoice or renewal for the affected Service. It is non-transferable, has no cash value, cannot be refunded or paid out and expires when the affected Order Form terminates or expires.

The Service Credit is a contractual fee adjustment, not damages, and is not subject to or counted toward the monetary caps in Section 15.4. It is Customer’s sole and exclusive monetary compensation for a failure to meet the uptime commitment, whether or not the affected Order Form later terminates. This does not limit mandatory rights or Customer’s right to terminate for an uncured material breach and receive the associated pro-rata refund under Section 16.3. A claim based on an independent breach of another express obligation, including Section 11 or Section 12 and Annex B, remains governed by Section 15, but Customer may not recover more than once for the same loss.

Annex B — Data Processing Agreement

B1. Scope and status

This Annex B is a data processing agreement under Article 28 GDPR and comparable laws. It applies worldwide whenever Drudewerk processes Personal Data on Customer’s behalf in providing the Service.

In this Annex, “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing” and “Supervisory Authority” have the meanings in applicable Data Protection Laws. “Customer Personal Data” means Personal Data that Drudewerk processes on Customer’s behalf under this Annex. “GDPR” includes the EU GDPR; references to it include equivalent UK GDPR obligations where relevant. “Subprocessor” means a processor engaged by Drudewerk to process Customer Personal Data.

Customer is Controller and Drudewerk is Processor when Customer determines the purposes and means. If Customer processes Personal Data for another controller, Customer is a Processor and Drudewerk is its Subprocessor. Each Party will comply with the obligations applicable to its role.

B2. Customer instructions

Customer instructs Drudewerk to process Personal Data:

• to provide, operate, secure, support and improve the contracted Service;
• according to Customer’s use, configuration and documented requests;
• as described in this MSA, the applicable Order Form and Schedule B1; and
• to make transfers and engage Subprocessors as authorized by this Annex.

Drudewerk will process Personal Data only on those documented instructions, including for international transfers, unless Union, Member State or other applicable law requires processing. In that case Drudewerk will inform Customer before processing unless law prohibits notice for important public-interest reasons.

If Drudewerk believes an instruction infringes applicable Data Protection Laws, it will inform Customer without undue delay and may suspend the affected processing until the instruction is confirmed, modified or withdrawn. Customer is responsible for the lawfulness, accuracy and completeness of its instructions and for giving required notices and obtaining required rights.

B3. Processing details and duration

The subject matter, nature, purpose, categories of Personal Data and Data Subjects are in Schedule B1. Processing continues for the Subscription Term and the 60-day termination procedure, plus the ordinary backup expiry and any period during which law requires isolated retention.

B4. Confidentiality and personnel

Drudewerk will ensure that persons authorized to process Personal Data are bound by confidentiality obligations, receive access only as needed for their duties and receive appropriate privacy and security guidance. Drudewerk personnel access production systems only from within the EEA. Access is reviewed and removed promptly when no longer required.

B5. Security

Taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing and risk to individuals, Drudewerk will maintain appropriate technical and organizational measures under Article 32 GDPR. The current measures are described in Exhibit B4.

Drudewerk may update measures as technology and risks evolve, provided the overall level of protection is not materially reduced during a Subscription Term. Customer is responsible for assessing whether the Service and measures meet Customer’s requirements and for securing matters under Customer’s control.

B6. Personal Data Breach

Drudewerk will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice will include information then reasonably available concerning the nature of the breach, affected data and individuals, likely consequences, measures taken or proposed, and a contact point. Drudewerk may provide information in phases and will reasonably assist Customer with investigation, mitigation and legally required notifications.

Notice is not an admission of fault. Customer is responsible for notifying authorities and Data Subjects unless applicable law assigns that duty to Drudewerk. Drudewerk will not notify Customer of unsuccessful attacks that do not result in a Personal Data Breach, except where legally required.

B7. Data Subject requests

Taking into account the nature of processing, Drudewerk will assist Customer through appropriate technical and organizational measures, insofar as possible, to respond to requests to exercise Data Subject rights. If Drudewerk receives a request relating to Customer Personal Data, it will refer the requester to Customer and not respond substantively unless Customer instructs it or law requires it.

B8. Compliance assistance

Considering the nature of processing and information available, Drudewerk will reasonably assist Customer with obligations under Articles 32 to 36 GDPR, including security, breach assessment, data-protection impact assessments and prior consultation. Assistance beyond the Service’s standard functionality may be charged at mutually agreed rates where the need is not caused by Drudewerk’s breach.

Drudewerk will maintain information necessary to demonstrate compliance with Article 28 and applicable processor duties and will make it available as described in Section B12.

B9. Subprocessors

Customer gives Drudewerk general written authorization to engage the Subprocessors in Schedule B2. Drudewerk will:

• impose written data-protection obligations providing substantially the protection required by this Annex;
• remain responsible to Customer for each Subprocessor’s performance of those obligations;
• maintain the current list in Schedule B2 at https://veowork.io/msa; and
• publish notice there at least 30 days before a new Subprocessor begins processing Customer Personal Data, except where urgent replacement is necessary to protect availability, security or comply with law, in which case notice will be as early as practicable.

Customer may object during the notice period on reasonable data-protection grounds, explaining those grounds in writing. The Parties will work in good faith on a commercially reasonable alternative. If none is reasonably available, Customer may terminate only the materially affected Service before the new Subprocessor begins processing and receive a pro-rata refund of prepaid Fees for the unused terminated period. This is Customer’s exclusive remedy for a justified Subprocessor objection, without limiting mandatory rights.

Microsoft is not a Drudewerk Subprocessor for Customer’s Azure DevOps Services environment. Customer selects and contracts with Microsoft independently and instructs the interaction.

B10. International transfers

Drudewerk may process Personal Data and use Subprocessors globally as described in Schedule B2. Where a transfer is restricted under Data Protection Laws, Drudewerk will use an adequacy decision, the 2021 EU Standard Contractual Clauses, an applicable approved certification framework, or another valid mechanism, and supplementary measures where required.

Schedule B3 incorporates transfer terms for a restricted transfer between Customer and Drudewerk. Transfers by Drudewerk to its own Subprocessors are governed by Drudewerk’s contracts with those Subprocessors, not by a separate SCC signature between Customer and the vendor.

B11. Return and deletion

Customer may use the in-product Excel worklog export and request a reasonable machine-readable export of other tenant data through support. Following termination, Customer has the 60-day combined export-and-deletion window in Section 9.3.

No later than 60 days after termination, Drudewerk will, at Customer’s choice stated in a timely instruction, return the agreed export and delete Personal Data from active systems, unless applicable law requires retention. If Customer does not request return, Drudewerk will delete. Residual copies of automatic backups expire through the ordinary backup cycle. Legally retained data will be isolated, protected and processed only for the legally required purpose.

At Customer’s written request, Drudewerk will provide written confirmation of deletion. Return and deletion do not require Drudewerk to disclose security-sensitive material, other customers’ information or proprietary software.

B12. Information and audits

Drudewerk will first provide reasonably available documentation needed to demonstrate compliance, which may include security descriptions, completed questionnaires, contractual vendor information and independent reports available to Drudewerk. Customer must keep that material confidential.

If documentary review is reasonably insufficient, Customer may conduct one audit in any 12-month period, and additional audits after a Personal Data Breach or where a Supervisory Authority or applicable law requires. The audit must:

• be conducted by Customer or an independent qualified auditor that is not a Drudewerk competitor;
• give at least 30 days’ notice unless urgency or an authority requires less;
• occur during normal business hours, avoid unreasonable disruption and comply with security requirements;
• be limited to systems and records relevant to Customer Personal Data; and
• not expose another customer’s data, privileged material or information that would compromise security.

Customer bears its audit costs and reimburses Drudewerk’s reasonable costs for non-routine assistance, unless the audit identifies a material breach by Drudewerk, in which case Drudewerk bears its reasonable internal costs and will promptly remediate. Nothing limits a Supervisory Authority’s lawful powers.

B13. Government requests

Drudewerk will review legally binding government demands for Customer Personal Data, challenge an unlawful or disproportionate demand where reasonable, disclose only what is legally required, and notify Customer before disclosure unless prohibited. If notice is prohibited, Drudewerk will use reasonable efforts to seek permission to notify.

B14. U.S. service-provider and contractor terms

To the extent U.S. state privacy law treats Drudewerk as a service provider, contractor or processor, Drudewerk will:

• process Personal Data only for the limited and specified business purposes in the agreement and Customer’s instructions;
• not sell or share Personal Data, use it for cross-context behavioral advertising or targeted advertising, or retain, use or disclose it outside the direct business relationship except as permitted by law;
• not combine it with personal data received from another person or collected from Drudewerk’s own consumer interaction except where law permits for the contracted business purpose;
• provide the same level of privacy protection required of the applicable role, assist with consumer requests and allow reasonable steps to verify compliance;
• notify Customer if Drudewerk determines it can no longer meet an applicable obligation; and
• permit Customer, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use.

Each Party certifies that it understands and will comply with the restrictions applicable to it. Terms such as “sell”, “share”, “service provider”, “contractor” and “targeted advertising” have the meanings in the applicable state law.

B15. Liability, precedence and term

The MSA’s liability provisions apply to this Annex except where applicable Data Protection Laws or the SCCs require otherwise. If this Annex conflicts with the main MSA on processing Personal Data, this Annex controls; if the SCCs conflict, the SCCs control for the governed transfer.

This Annex automatically terminates after Drudewerk has deleted or returned all Personal Data as required, except for terms that must survive and data lawfully retained.

Schedule B1 — Processing Details

B1.1 Subject matter and purposes

Drudewerk provides hosted time recording, reporting, budgeting, workflow, approval, migration, export, security, limited route statistics, transactional-email and support functions. Processing includes collection, retrieval, recording, organization, structuring, storage, consultation, display, calculation, analysis, aggregation, synchronization, transmission, export, restriction, encryption and deletion.

B1.2 Frequency and duration

Processing occurs continuously or intermittently as Customer and Authorized Users use or configure the Service, for the duration stated in Section B3.

B1.3 Categories of Data Subjects

• Customer employees, workers and contractors;
• Azure DevOps users and directory-group members made available by Customer;
• Customer administrators, account owners, project administrators and API users;
• managers, approvers and budget owners;
• Customer support, billing, legal, security and other business contacts; and
• other individuals identified in connected work items, timesheet comments, custom attributes, migration records or support materials chosen by Customer.

B1.4 Types of Personal Data

Depending on Customer’s configuration and the content made available to the Service, the Service may process Personal Data of the following types. A listed data element is Personal Data only to the extent that it relates to or can reasonably be linked to an identified or identifiable individual:

• Azure DevOps identifiers and descriptors, names, display names, email addresses where available, organization and project membership, directory groups, roles, managers and access assignments;
• organizational and Service-configuration metadata, including organization, project, process, team, area, iteration, field and work-item-type names and identifiers;
• work-item identifiers, titles, types, states, assignments, selected fields, links and hierarchy;
• worklogs, dates, durations, activity types, comments, billable status and amounts;
• budgets, custom attributes and options, submissions, approvals, approvers, closed periods and audit events;
• encrypted Microsoft Entra refresh tokens, encrypted Azure DevOps personal access tokens, integration status, scope and expiry metadata;
• VeoWork Timesheets API-token name, scope, creator, timestamps, expiry, revocation and cryptographic verifier;
• encrypted migration credentials and staged source data for users, roles, activity types, approvals, budgets, worklogs and work items;
• transactional-email recipient and actor names, recipient addresses, organization, reporting period, workflow status, action links and delivery data;
• support correspondence, attachments and diagnostics supplied by Customer;
• limited route-statistics data: generic Service routes without query strings or hashes, referrers, timestamps, browser, operating system, device type, screen size, language, approximate location, and rotating pseudonymous session and visit identifiers. Umami receives the visitor’s IP address transiently to derive limited location and session information but does not store it; and
• pseudonymous user and organization identifiers, request identifiers, timestamps, network and device information, synchronization status, security events, errors and redacted diagnostic logs.

B1.5 Prohibited special-category and criminal-conviction data

The Service is not designed or authorized for intentional processing of special-category data within the meaning of Article 9 GDPR or personal data relating to criminal convictions and offenses within the meaning of Article 10 GDPR. Intentional processing of such data is outside the Service’s design and Customer’s documented instructions under this Annex. No Order Form may authorize it.

If such data is inadvertently made available to the Service, Customer must promptly remove it where possible and, where Drudewerk’s assistance is required, notify Drudewerk and provide lawful documented instructions to restrict or delete it. Drudewerk will reasonably assist Customer and may restrict the affected processing while the issue is resolved. Inadvertent receipt does not expand the agreed scope of the Service. Drudewerk will comply with its applicable obligations under this Annex and Data Protection Laws, including security, confidentiality and Personal Data Breach obligations, while it processes such data.

B1.6 Customer instructions and contacts

The MSA, Order Form, Service configuration and documented support requests constitute instructions. Customer’s administrator and privacy contacts identified in the Order Form are authorized to issue operational instructions. Instructions materially outside the Service may require a written change and reasonable additional Fees.

Schedule B2 — Subprocessors

Subprocessor	Purpose and data	Processing locations	Transfer approach
Cloudflare, Inc. and applicable Cloudflare contracting affiliates	hosting, delivery and protection; observability and inbound email routing; Service traffic, queued data, configuration, logs and mail in transit	EEA, United States and Cloudflare’s global network and support locations	Cloudflare DPA; adequacy or valid certification framework where applicable; EU SCCs and supplementary measures for other restricted transfers
PlanetScale, Inc.	Databases, operations, cluster logs and automated backups; Customer Data stored by the Service	Primary production cluster and backups in AWS Frankfurt, Germany; provider support and subprocessors may operate in the United States and other countries	PlanetScale DPA; EU SCCs, adequacy decisions and supplementary measures as applicable
Umami Software, Inc.	Privacy-minimized authenticated Service route statistics and Service improvement; generic routes without query strings or hashes, referrers, timestamps, technical browser and device data, approximate location, rotating pseudonymous session and visit identifiers, and transient IP processing without IP storage	Umami Cloud EU service region; provider administration, support and subprocessors may involve the United States and other countries	Umami DPA; 2021 EU SCCs and supplementary measures as applicable
Sand Dune Mail Limited, trading as SMTP2GO	Transactional email delivery, abuse prevention and delivery logs; recipient details, message metadata and service-email content	EU API endpoint used by Drudewerk; SMTP2GO is based in New Zealand and uses infrastructure and subprocessors in multiple locations	New Zealand adequacy where applicable; contractual onward-transfer safeguards and EU SCCs for non-adequate locations as required
The applicable Google Workspace contracting entity, including Google Cloud EMEA Limited or another Google affiliate	Support and general mailboxes, correspondence, attachments and related security and administration data	EEA and Google’s global processing and support locations, depending on configuration and service terms	Google data-processing terms; adequacy or valid certification framework where applicable; EU SCCs and supplementary measures for other restricted transfers

Drudewerk uses SMTP2GO’s EU API endpoint but does not represent that all SMTP2GO account data or downstream processing is confined to the EEA. PlanetScale database content and automated backups are configured in AWS Frankfurt, but vendor administration and support can involve other locations. Drudewerk staff production access remains EEA-only.

Schedule B3 — Restricted Transfers

B3.1 EU Standard Contractual Clauses

If and only to the extent a transfer of Personal Data from Customer to Drudewerk is a restricted transfer requiring appropriate safeguards under Chapter V GDPR, the Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/914 (the “EU SCCs”) are incorporated by reference and completed as follows:

• Module Two applies where Customer is a controller and Drudewerk is a processor. Module Three applies where Customer is a processor and Drudewerk is a subprocessor.
• Customer is the data exporter and Drudewerk is the data importer. Their names, addresses, contacts and activities are those in the Order Form, this MSA and Schedule B1. By accepting the Order Form, each Party is deemed to sign the EU SCCs on the Effective Date.
• Clause 7, the docking clause, applies.
• Clause 9 uses Option 2, general written authorization, with the 30-day notice period in Section B9.
• The optional language in Clause 11 does not apply.
• For Clause 17, Option 1 applies and the law is German law.
• Under Clause 18, the courts are the competent German courts at Drudewerk’s registered seat, unless the EU SCCs require another EU Member State forum.
• The competent Supervisory Authority for Annex I.C is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), subject to Clause 13’s allocation based on the exporter’s establishment and affected Data Subjects.
• Annex I.A and I.B are completed by the Party details, Section B1, and Schedule B1. Annex II is Exhibit B4. Annex III is Schedule B2.

The EU SCCs remain unmodified and prevail over inconsistent terms for the restricted transfer. Nothing in this Schedule converts a transfer that is not legally restricted into a restricted transfer.

B3.2 United Kingdom

For a transfer restricted by the UK GDPR, the then-current International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner’s Office is incorporated. The Parties select the EU SCC modules and complete the tables using Section B3.1, Schedule B1, Schedule B2 and Exhibit B4. The exporter may end the Addendum in accordance with its mandatory termination provision if an approved revision materially changes it. References to Member State law, courts and supervisory authorities are adapted to the United Kingdom as required by the Addendum.

B3.3 Switzerland

For a transfer restricted by the Swiss Federal Act on Data Protection, the EU SCCs apply with these adaptations: references to the GDPR include the corresponding Swiss law; references to EU or Member State law include Swiss law where applicable; the competent authority is the Swiss Federal Data Protection and Information Commissioner where Swiss law governs; Data Subject references include individuals protected by Swiss law; and Swiss courts provide an additional place of jurisdiction where required. The selected module and schedules otherwise follow Section B3.1.

B3.4 Vendor transfers

This Schedule governs restricted transfers between the Parties. Drudewerk’s transfers to a Subprocessor are governed by Drudewerk’s data-processing terms with that Subprocessor and the mechanisms summarized in Schedule B2.

Exhibit B4 — Technical and Organizational Measures

Drudewerk maintains the following measures appropriate to the Service and risks. They describe controls, not a guarantee that an incident can never occur.

B4.1 Governance and access

• documented assignment of security and privacy responsibilities;
• least-privilege access based on operational need;
• multi-factor authentication for sub-processor services privileged access;
• periodic access review and prompt offboarding or access removal following personnel or role changes;
• confidentiality commitments and security guidance for personnel; and
• EEA-only production access by Drudewerk staff.

B4.2 Endpoint and credential security

• encrypted and screen-locked work endpoints with supported software and security updates;
• secrets stored outside source code in controlled secret-management facilities;
• unique accounts and controlled administrative access;
• Azure DevOps synchronization credentials encrypted using AES-GCM before storage;
• migration credentials encrypted, normally removed at completion, cancellation or failed cleanup, and technically capped to expire no later than 7 days after creation; and
• API-token secrets shown only at creation, with only a cryptographic verifier and token metadata retained.

B4.3 Tenant and database protection

• separate per-tenant databases for Customer Data, supported by a limited shared service catalog where operationally necessary;
• production databases and automatic backups configured in AWS Frankfurt through PlanetScale;
• TLS for data in transit and vendor-managed encryption at rest;
• database access mediated through controlled service bindings and credentials;
• database logs retained for 7 days; and
• automatic backups retained for at least 2 days but no more than 30 days.

B4.4 Application and network security

• Cloudflare edge protections and encrypted HTTPS transport;
• authentication tied to Azure DevOps identity and scoped Service authorization;
• authorization checks for tenant, project and role boundaries;
• input validation and controlled application programming interfaces;
• dependency maintenance, peer review and automated testing before or alongside releases; and
• separation of development activities from production credentials and Customer Data to the extent practicable.

B4.5 Logging, monitoring and resilience

• operational, security and error logging designed to redact authorization headers, credentials and tokens;
• Cloudflare application logs retained for up to 7 days;
• use of pseudonymous identifiers in diagnostics where practical;
• queueing and retry mechanisms for appropriate asynchronous tasks;
• automated database backups and provider infrastructure redundancy; and
• restoration and operational recovery procedures proportionate to the Service, without a contractual recovery-time commitment; the uptime commitment and remedy are stated exclusively in Annex A.

B4.6 Incident and supplier management

• procedures to identify, contain, investigate, remediate and document security incidents;
• escalation and customer-notification processes consistent with Section B6;
• review of material suppliers’ security, privacy terms and transfer mechanisms before or during engagement;
• written processing terms with Subprocessors; and
• change management for material infrastructure and Subprocessors.

B4.7 Data minimization and lifecycle

• Service access limited to Azure DevOps scopes and data needed for enabled functions;
• credential and token expiry, revocation and cleanup mechanisms;
• in-product Excel export for worklogs and support-assisted machine-readable export for other tenant data;
• active-system deletion within the 60-day termination procedure and subsequent backup expiry; and
• no submission of Customer Data to generative-AI services and no use of Customer Data to train machine-learning or generative-AI models.

Drudewerk does not claim ISO certification, SOC attestation or a fixed annual penetration-testing program. If those assurances become available, Drudewerk may provide them separately without changing this exhibit.