Data processing agreement
How we process the personal data you keep on our services: who does what, security measures, sub-processors and how to ask for a signed copy.
How Coritan LLC processes the personal data you keep on our services, and how to ask for a signed copy.
Last updated 19 October 2026
A data processing agreement sets out how a company that holds personal data for you may use that data and how it must protect it. You may need one when you keep personal data about other people on our services, such as your customers’ details in a database, a mailbox or a bucket.
Who does what
For the personal data you keep on our services, you decide why and how it is processed, and Coritan LLC processes it for you. These terms are part of our agreement with you. How we handle the personal data we collect about you as our client is in our privacy policy.
What we do with the data
- We store it, run the services you ordered on it, copy it as your snapshots, backups and settings say, and send it where you tell a service to send it.
- We do not read it, sell it or use it for anything else, except as the law requires or to keep the service safe. The checks on mail from free mailboxes, in the privacy policy, are an example.
Security measures
- We store passwords as one-way hashes. Two-factor authentication with an authenticator app is available for every account, with recovery codes for a lost phone.
- You can end any session or API key at any time, and an ended session can no longer reach your account within 10 seconds.
- An API key has only the permissions and addresses you give it.
- coritan.com tells browsers to reach it over HTTPS only.
- Our staff work in an admin console that answers only at its own address. They sign in with staff accounts that are separate from customer accounts, a role limits what each person can see and change, and an audit log records the changes they make.
The Trust page describes each measure in full.
Where your data is
You choose the location of a server or a bucket when you order it, from the locations we offer at that time.
Sub-processors
These are the kinds of company we use to process the personal data on our services:
- Hosting and network providers that run the machines, links and facilities our services use.
- A delivery partner that carries the mail sent through our shared sending pool.
- A domain registrar, for the domains you register through us.
- Payment processors, which see billing details and not the data on your servers.
We change this list on this page when it changes.
Requests and incidents
When someone asks you for a copy of their personal data, to correct it or to delete it, you can do most of that in the dashboard. Write to privacy@coritan.com when you need our help.
We tell you by email once we confirm that personal data you keep on our services was exposed, and we tell you what we know.
When you leave
When you close your account, the privacy policy says what we delete and what the law makes us keep.
Ask for a signed copy
To have Coritan LLC sign a copy of these terms for your account, write to privacy@coritan.com and say which account it is for.
A product you buy through our sales team, such as bare metal servers or colocation, comes with a service agreement of its own, which sets how it covers personal data. Talk to sales about it.
