Trust Center

Data protection

How personal data are processed, where they live, and what happens when you decide to leave.

Data Processing Agreement and EU Data Act Addendum

Part A is the GDPR processing agreement; Part B covers Monokee’s obligations as a provider of a data processing service under Regulation (EU) 2023/2854 — switching, portability, interoperability and safeguards against third-country governmental access.

  • Sub-processors, processing locations and transfer mechanisms, named
  • Switching: 30 days’ notice, 30-day transitional period, 30-day retrieval — and no switching or egress charges
  • An exhaustive list of what can be exported, in which format, and what cannot
  • Annex B-4: how the risk of US CLOUD Act access is assessed, mitigated and reviewed
Download PDF863 KB

Cloud — SaaS and Dedicated SaaS

For the platform operated by Monokee, in both the shared and the single-tenant model.

SaaS Service Management

Operations, backup, business continuity and disaster recovery: who runs what, the availability commitment, and the recovery objectives that apply to each kind of failure.

  • Availability 99.794%, measured monthly
  • RPO and RTO of no more than 2 hours; a single component failure is handled with no data loss
  • Backups at least every 2 hours, replicated to an independent provider, retained 14 days, restore-tested quarterly
  • Incident notification within 1 hour, updates every 2 hours, post-incident report within 5 business days
Download PDF265 KB

Support and Maintenance — Bug Fixing and CVE

Defect correction and vulnerability management for the cloud platform, including the application of fixes to production, which is Monokee’s responsibility in this model.

  • Response times: 2 business hours for Severity 1, 4 for Severity 2; Premium support extends cover to 24/7
  • Zero-day: mitigation within 24 hours, correction within 2 days of a fix being available
  • Critical and High vulnerabilities corrected within 30 calendar days
  • Security advisories to your designated contacts, and a "not affected" statement on request for any public CVE
Download PDF290 KB

On-premises

For the platform installed in your own environment, where operation stays with you.

Support and Maintenance — Bug Fixing and CVE

The same defect and vulnerability commitments for an on-premises installation. Monokee releases the corrections; installing them is yours.

  • The same response times and the same remediation targets as the cloud models
  • Corrections delivered as Hotfix, Patch or Maintenance Release, with release notes and installation instructions
  • Vulnerabilities found through NVD and vendor advisories, the CISA KEV catalog, SCA against the SBOM of each release, and code analysis
  • SBOM of the supported versions provided on request
Download PDF282 KB

Annual Support and Maintenance Service

The optional service in which Monokee also installs the corrections in your environment, rather than only releasing them.

  • Covers the Monokee application components, the front-end, and the MongoDB and Redis instances distributed or certified by Monokee
  • Installation first in test, then in production, in windows agreed with you and with a rollback procedure
  • Response within 1 hour for a critical incident, 4 hours otherwise, during the coverage window
  • A change of major version is quoted separately and is not part of the annual fee
Download PDF253 KB