Legal · DPA v1.0-beta · 12 October 2026

Data Processing Addendum

This DPA is part of every Lilo agreement — it is incorporated by reference into the Beta Agreement, so it is already in force the moment a workspace is created. We will countersign your own copy on request: hello@angilabs.com.

Plain-language version, v1.0-beta. A qualified legal review is scheduled before general availability; if that review changes anything, the change log at the bottom will say exactly what and when.

1. Roles

For device telemetry an MSP connects: the MSP’s end-client is the controller, the MSP is the processor, and AngiLabs is a sub-processor. For an internal IT team’s own fleet, AngiLabs processes directly for that customer.
For the customer’s own account data (company, user emails, billing, usage), AngiLabs is the controller, as the Privacy Policy describes.
The customer warrants it has the authority and lawful basis for the telemetry it connects — including, for MSPs, that end-client agreements permit this processing.

2. What we process, and only on your instructions

Data: device inventory and telemetry (hostnames, models, serials, health signals, alert history), the identifiers that come with them, and workspace user accounts. Data subjects: your staff and, for MSPs, your end-clients’ staff.
Purpose: operating Lilo for your workspace — scoring, lifecycle planning, reporting. Nothing else. We process only on your documented instructions (using the product is the instruction), never for advertising, profiling or resale.
Confidentiality: everyone with access is bound by confidentiality obligations.

3. Security measures

Tenant isolation enforced at the database layer (PostgreSQL row-level security, enabled and forced, with the application role unable to bypass it).
TLS in transit; integration credentials and 2FA secrets encrypted at rest; 12-character minimum passwords; authenticator-app 2FA; account lockout.
Support access to a workspace only through customer-granted, time-boxed, scoped permission — read-only by default, every action logged with dual attribution, revocable live.
Append-only audit and consent logs; administrative access is MFA-gated and logged.

4. Sub-processors

Current list: angilabs.com/legal/subprocessors. You authorize that list generally.
We give 30 days’ notice before adding or changing a sub-processor (via the email on your account); you may object on reasonable data-protection grounds, and if we cannot resolve it you may terminate and take your data with you.
Your RMM (for example SuperOps) is your vendor, not our sub-processor — we read from it on your instruction.

5. International transfers

Production data is hosted in the European Union (Contabo, Germany). Administrative access from South Africa is limited, MFA-gated and logged.
For EU/UK personal data, the EU 2021 Standard Contractual Clauses (Module 2 controller→processor and Module 3 processor→processor, as applicable) are incorporated into this DPA, with the UK Addendum where UK GDPR applies.
For South African customers, this DPA provides the contractual protection POPIA section 72 requires for cross-border transfers.

6. If something goes wrong

We notify you of a personal-data breach affecting your workspace without undue delay and within 48 hours of becoming aware, with what we know, what we are doing, and a named contact (incidents: security@angilabs.com) — so you can meet your own 72-hour clock if one applies.
We assist with data-subject requests (access, deletion, export) and with your DPIAs, at no charge during beta.

7. When we part ways

Export of your tenant data in machine-readable form, on request, any time.
Full deletion of your tenant within 30 days of termination (backups purge within 90), confirmed in writing on request.
Audit rights: security documentation and questionnaires first; an independent audit as the escalation path, at your cost, with reasonable notice.
Liability under this DPA follows the cap in the main agreement.

Change log

2026-10-12 — v1.0-beta published and incorporated into the Beta Agreement.