Legal & Policies

Introduction

WALT Labs is committed to protecting the privacy and security of the data entrusted to us. To operate the Cloud Companion platform and our business, we engage a limited number of third-party service providers ("Data Processors" or "Sub-processors") that may process personal data and customer content on our behalf. This page provides transparency about who those providers are, what they process, and the safeguards in place — and sets out our own Data Processing Addendum (DPA) describing how WALT Labs processes your data as a processor.

Data residency — you can opt out of US storage. By default, Cloud Companion data is hosted in the United States. Customers with EU or UK data-residency requirements may opt out of US storage and elect EU data residency, under which core billing and analytics data is stored in EU regions and EMEA billing is handled through our EMEA (EU/UK) systems. To enable EU residency, contact your WALT Labs account manager. Where data is transferred internationally, we rely on Standard Contractual Clauses and the EU–US Data Privacy Framework — see the Data Processing Addendum below.

A. Corporate & Business Sub-processors

B. Cloud Companion Product Sub-processors

These providers process customer content and personal data as part of delivering the Cloud Companion platform (billing & spend analytics, invoicing, security findings, the AI assistant, notifications and identity). WALT Labs remains responsible for their compliance under the DPA below.

Google Workspace access (BYO Workspace customers): where a customer enables the Google Workspace admin features, WALT Labs accesses that customer's own Workspace directory data (users, groups, licences) via domain-wide delegation, read-only. This is access to the customer's own Google environment, not onward transfer to a new processor.

AWS (AWS-BYOS customers): where a customer uses AWS billing ingestion, WALT Labs reads billing/cost & usage reports from the customer's own AWS S3 bucket using credentials the customer provides. This is the customer's own environment, not a WALT Labs sub-processor.

C. Where Your Data Is Stored (by feature)

Not all Cloud Companion data is stored in the same place. The table below shows where each feature's data resides for US customers and for EMEA customers (or any customer who elects EU data residency). Where data is stored in the US for an EMEA customer, it is protected by Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework (see DPA §6).

In short: for EMEA customers, your billing, spend analytics, cost recommendations, invoicing, and Workspace backups are stored in the EU. Core account/identity, platform configuration data, and the AI assistant are currently hosted in the United States for all customers, under the safeguards described in the DPA below.

WALT Labs Data Processing Addendum (DPA)

This Addendum forms part of the Terms of Service / Master Services Agreement between WALT Labs (WALTLabs.io, LLC or the WALT Labs entity identified in your Agreement, "WALT Labs", "Processor") and the customer ("Customer", "Controller") and governs WALT Labs' processing of Customer personal data through Cloud Companion. This Addendum is incorporated into the Agreement and applies automatically — no separate signature is required. A countersigned copy is available on request for customers who need one for their records.

1. Roles of the parties

The Customer is the Controller (or processor, where acting on behalf of its own end customers) of the personal data it submits to Cloud Companion. WALT Labs acts as Processor and processes such data only on the Customer's documented instructions, as set out in this Addendum and the Agreement, except where required by law.

2. Subject-matter, nature and purpose of processing

WALT Labs processes Customer personal data to provide the Cloud Companion platform, including: cloud billing and spend analytics, invoicing and reseller billing, cost recommendations, security findings and monitoring, the AI assistant, notifications, and account/identity management.

3. Categories of data subjects

The Customer's authorised users and administrators; the Customer's own billing/finance contacts; and individuals whose details appear in the Customer's cloud billing, configuration, or Workspace directory data.

4. Categories of personal data

• Account & contact details — names, email addresses, phone numbers (2FA)
• Cloud billing & spend data, and GCP/AWS configuration/usage data
• Invoice and payment records (via QuickBooks Online)
• Security findings and scan results
• Organisation/tenant metadata and entitlements
• Google Workspace directory data (users, groups, licences) — for Workspace-enabled customers
• AI assistant prompts and conversation content

No special-category (sensitive) personal data is intentionally processed. Cloud Companion is not designed to process payment card data.

5. Sub-processors

The Customer authorises WALT Labs to engage the sub-processors listed in Sections A and B above. WALT Labs will give at least thirty (30) days' notice before adding or replacing a sub-processor (consistent with Terms of Service §26), during which the Customer may object on reasonable data-protection grounds. WALT Labs imposes data-protection obligations on each sub-processor no less protective than those in this Addendum and remains liable for their performance.

6. Data location, residency options and international transfers

Customer data is hosted in Google Cloud in the United States by default. Customers may opt out of US data storage and elect EU data residency, under which core billing and analytics data is stored in EU regions and EMEA billing is processed through WALT Labs' EMEA (EU/UK) systems. To enable EU residency, contact your WALT Labs account manager.

The "Where your data is stored" table in Section C sets out, feature by feature, what is stored in the EU versus the United States. In summary, for EMEA/EU-residency customers, billing and spend analytics, cost recommendations, invoicing, and Google Workspace backups are stored in the EU, while account/identity, core platform configuration data, and the AI assistant are hosted in the United States under the safeguards below. Where personal data is transferred out of the EEA, UK or Switzerland, WALT Labs relies on a valid transfer mechanism — the EU Standard Contractual Clauses (together with the UK International Data Transfer Addendum and Swiss addendum where applicable) and/or the EU–US Data Privacy Framework where the sub-processor is certified — supported by the sub-processors' own DPAs (for example, the Google Cloud DPA). The applicable Standard Contractual Clauses are incorporated into this Addendum by reference.

7. Security measures

WALT Labs maintains appropriate technical and organisational measures, including: encryption in transit and at rest (via Google Cloud), role-based access control and least-privilege service accounts, secrets managed in Google Secret Manager, two-factor authentication, network isolation, and centralised logging and monitoring. A summary of measures is available on request.

8. Confidentiality

WALT Labs ensures that personnel authorised to process Customer personal data are bound by appropriate confidentiality obligations.

9. Assistance to the Controller

Taking into account the nature of processing, WALT Labs assists the Customer with: responses to data-subject rights requests; data-protection impact assessments; and consultations with supervisory authorities, to the extent the Customer cannot reasonably do so itself through the platform.

10. Personal data breach notification

WALT Labs notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, and provides information reasonably available to assist the Customer's own notification obligations.

11. Audit

WALT Labs makes available information reasonably necessary to demonstrate compliance with this Addendum and, subject to reasonable notice, confidentiality and frequency limits, allows for audits (including via third-party certifications and reports).

12. Return and deletion

On termination or expiry, WALT Labs deletes or returns Customer personal data in accordance with the Agreement and applicable retention obligations, save where storage is required by law.

13. Duration

This Addendum applies for as long as WALT Labs processes Customer personal data under the Agreement.

14. Government and law-enforcement access requests

If WALT Labs receives a legally binding request from a public authority to disclose Customer personal data, it will — unless legally prohibited — notify the Customer and direct the authority to the Customer. WALT Labs will challenge requests that are unlawful, overbroad, or in conflict with EU/UK data-protection law, and will disclose only the minimum data legally required.

15. Customer (Controller) responsibilities

The Customer is responsible for ensuring it has a lawful basis to provide the personal data it submits, that its instructions comply with applicable law, and for the accuracy of that data. The Customer's use of Cloud Companion, including any data-residency election, forms part of its documented processing instructions.

16. Relationship to the Agreement

This Addendum forms part of, and is subject to, the Agreement — including its limitations and exclusions of liability. In the event of conflict on data-protection matters, this Addendum prevails over the rest of the Agreement; the Standard Contractual Clauses prevail over both where they apply.

Contact Us

If you have questions about our Data Processors or this DPA, please contact:

Email: info@waltlabs.io
Address: 20008 Champion Forest Dr Ste 103, Spring, TX 77379
Data Protection Officer: info@waltlabs.io