Skip to content
CostReveal
Menu

Data Processing Agreement

Last updated September 25, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Shobha Gupta, trading as CostReveal, a sole proprietorship based in Gurugram, India ("CostReveal", the processor), and the customer (the controller). It applies wherever CostReveal processes personal data on the customer's behalf, and is written to meet Article 28 of the GDPR and equivalent laws. Customers who need a countersigned copy can request one from privacy@costreveal.com.

Details of the processing

  • Subject matter and purpose: providing the CostReveal service, which attributes the customer's AI, cloud and API spend.
  • Duration: for as long as the customer uses the service, and until the data is deleted under this DPA.
  • Nature: collection from connected providers, storage, analysis, display to authorized users, and deletion.
  • Data subjects: the customer's users of CostReveal, and people who may appear in connected billing and usage data, such as in resource tags.
  • Categories of data: names, work email addresses, roles, sign in and audit records, IP addresses and browser details, and any personal data contained in connected billing and usage records. CostReveal is not designed for special categories of personal data, and customers should not connect them.

Our obligations

CostReveal will:

  • Process personal data only on the customer's documented instructions, which are these terms and the customer's use of the service, unless the law requires otherwise, in which case we will tell the customer first where allowed.
  • Ensure that everyone authorized to process the data is bound by confidentiality.
  • Apply the technical and organizational measures described below.
  • Help the customer respond to requests from data subjects, and with security, breach notification, impact assessments and consultations with authorities, taking into account the nature of the processing.
  • Tell the customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting the customer's data, with the information the customer needs to meet its own obligations.
  • Make available the information needed to show compliance with this DPA, including by answering the customer's reasonable security questionnaires.

Security measures

  • Isolation of each customer's data by PostgreSQL row level security, enforced on every table that holds customer data, with an application role that cannot bypass it.
  • Encryption of stored provider credentials and identity provider certificates with AES-256-GCM, and encryption of data in transit with TLS.
  • Password hashing with Argon2id, two step verification, and SAML single sign on for Enterprise organizations.
  • Least privilege roles for the customer's users, and read only, reason logged inspections for CostReveal staff.
  • An append only audit trail of access and configuration changes.
  • Defined retention periods, and deletion of expired sessions, links and records.

Subprocessors

The customer authorizes CostReveal to use subprocessors to host and operate the service. CostReveal binds each subprocessor to data protection terms no less protective than this DPA and remains responsible for its performance. The current list is available on request from privacy@costreveal.com. We will give at least 30 days' notice of a new subprocessor, during which the customer may object on reasonable data protection grounds. If we cannot resolve the objection, the customer may end the affected service and receive a refund of prepaid fees for it.

International transfers

Where personal data is transferred out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (module two, controller to processor), and the UK addendum where it applies, are incorporated into this DPA.

Deletion and return

When the agreement ends, the customer can export its data for 30 days. After that, CostReveal deletes the customer's personal data, unless the law requires it to be kept.

Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service. If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of personal data.