Effective 6 October 2026
Data Processing Agreement
The processing terms that apply when IAMCastle handles Microsoft Entra evidence on behalf of a customer organisation.
1. Parties and application
This Data Processing Agreement forms part of the agreement between the customer organisation and IAM CASTLE LIMITED, company number 17263388, registered office 4 Cobden Terrace, John Street, Rochester, United Kingdom, ME1 1TF. It applies when IAMCastle processes personal data on the customer's behalf through IAMCastle Auditor and takes precedence over the Terms for that processing.
2. Roles and processing
The customer is controller and IAMCastle is processor for Microsoft Entra evidence collected and processed to provide the service. IAMCastle is an independent controller for its own account administration, billing, fraud prevention, platform security, legal compliance and business records. The processing includes read-only collection, normalisation, snapshot comparison, before-and-after evidence creation, tenant-scoped hash chaining, storage, search, alerting, reporting and export.
3. Data and individuals
Data may concern customer employees, workers, contractors, guests, administrators, group members, device users and other identities represented in the customer's Entra tenant. It may include names, work identifiers and email addresses, directory attributes, account state, group and role relationships, device and application relationships, actors, timestamps, sign-in outcomes, old and new values, and Microsoft request or correlation identifiers. Special-category and criminal-offence data are not intentionally required.
4. Documented instructions
IAMCastle processes customer personal data only on documented customer instructions expressed through the agreement, authorised configuration and support requests, or where UK law requires processing. Where lawful, IAMCastle will inform the customer before legally required processing and will notify the customer if an instruction appears to infringe applicable data protection law.
5. Confidentiality and security
IAMCastle ensures authorised personnel are bound by confidentiality and limits access according to duties. Measures include Microsoft SSO, platform-admin MFA, server-side tenant resolution, Admin and Read Only roles, read-only Graph permissions, TLS, provider-managed encryption at rest, tenant-scoped storage and queries, service authentication, audit logging, private temporary exports, session expiry and SHA-256 evidence hash chaining.
6. Subprocessors
The customer gives general authorisation for IAMCastle to use subprocessors needed to provide the service. Current key providers are Microsoft Azure for UK South primary hosting, database and private export storage; Microsoft Entra ID and Graph for authentication and evidence collection; Azure Communication Services for operational email; Stripe for subscription billing; and Google Analytics for consented public website analytics only. IAMCastle remains responsible for their contracted data-protection obligations and will give at least 30 days' notice of a material new or replacement subprocessor, allowing reasonable objection on data-protection grounds.
7. International transfers
IAMCastle will not make a restricted transfer unless permitted by UK data protection law. Where required, it will use an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another approved safeguard, together with the required data protection test and supplementary measures. Safeguard information is available through hello@iamcastle.io subject to security and confidentiality restrictions.
8. Individual rights
Taking account of the nature of processing, IAMCastle will use appropriate measures to help the customer respond to requests to exercise data-protection rights. If IAMCastle receives a request concerning customer-controlled Entra evidence, it will normally refer the request to the customer and will not respond on the customer's behalf unless authorised or legally required.
9. Personal data breaches
IAMCastle will notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data and will provide available information about its nature, likely consequences and containment or remediation. IAMCastle will reasonably assist the customer with security, breach assessment, data-protection impact assessments and regulator consultation.
10. Retention, return and deletion
Customer evidence may be retained for up to seven years from collection. Retention may end earlier following account expiry or closure, an authorised deletion instruction, or an agreed special request. At the end of processing, and subject to the customer's choice, IAMCastle will provide an available standardised export and delete or return customer personal data unless UK law requires continued storage. Deletion is subject to verified authority, reasonable technical processing time, legal or dispute holds and backup ageing. Temporary export links expire after 24 hours and associated private Blob objects are scheduled for deletion after two days.
11. Information and audits
IAMCastle will provide information reasonably necessary to demonstrate compliance with its processor obligations and permit a reasonable audit no more than once in 12 months, plus following a substantiated material breach or regulator request. Current independent reports and questionnaires should be used first where sufficient. Audits must protect other customers, confidentiality and service security and minimise disruption.
12. Customer responsibilities
The customer is responsible for lawful instructions, a lawful basis, required transparency to its tenant users, authority to connect its Microsoft tenant, appropriate account permissions, and its response to data-subject or regulator requests as controller. The customer must not intentionally configure the service to process special-category or criminal-offence data without an agreed lawful and supported basis.
13. Term and liability
This DPA applies while IAMCastle processes customer personal data. Liability is governed by the agreement's approved liability provisions except where data protection law prohibits a limitation. Nothing relieves either party of its direct statutory responsibilities. The laws and courts of England and Wales apply unless a signed order states otherwise.
14. Contact
DPA, subprocessor, transfer, audit, return and deletion enquiries should be sent to hello@iamcastle.io. This published DPA is incorporated when the customer accepts the IAMCastle Terms or an order form refers to it.