Register of Processing Activities
Published under UK GDPR Article 30 — Last updated: 14 August 2026
Data Controller Details
- Controller Name
- AgentOS Ltd
- Territory
- United Kingdom
- Data Protection Contact
- privacy@agentos.com
- Applicable Legislation
- UK GDPR; Data Protection Act 2018
What is this document?
UK GDPR Article 30 requires organisations that process personal data to maintain a written record of all processing activities. This Register of Processing Activities (ROPA) documents each distinct processing activity carried out by AgentOS Ltd, including its purpose, legal basis, data categories involved, data subjects affected, recipients, retention periods, international transfer mechanisms, and security measures applied. This document is reviewed and updated whenever a new processing activity is introduced or an existing one materially changes.
Personal Data Breach Notification Procedure (UK GDPR Art. 33)
AgentOS Ltd operates a documented incident response procedure in compliance with UK GDPR Article 33. In the event of a personal data breach likely to result in risk to individuals, we will notify the ICO within 72 hours of detection. Our breach detection sources, severity classification matrix, DPO escalation procedure, 72-hour ICO notification decision tree, and affected-user notification template are documented in our Incident Response Runbook, which is available on request at privacy@agentos.com — the same channel this page offers for executed DPAs. The runbook is maintained in a private repository, so there is no public link that would resolve for a reviewer. Breach incidents are automatically triaged by the breachIncidentTriage workflow — see processing activity PA-010 below. To report a suspected breach, contact privacy@agentos.com immediately.
Processing Activities
PA-001
User Account Registration & Authentication
- Purpose
- Create and manage user accounts; authenticate users when they sign in to the service.
- Legal Basis
- Contract (Art. 6(1)(b))
- Data Categories
- Full name
- Email address
- Profile image URL (when supplied by the identity provider)
- Central identity-provider account identifier (OIDC subject) and the associated sign-in tokens, encrypted at rest
- Data Subjects
- Landlords and their organisation members
- Recipients / Sub-processors
- SaaS Factory central identity provider (SF Auth) — performs all authentication; this Service holds no password
- Neon Inc. (database)
- Vercel Inc. (hosting)
- Upstash Inc. / Vercel KV (distributed rate limiting — raw user IDs and raw IP addresses as rate-limit keys)
- Retention Period
- Duration of account + 30 days post-deletion
- International Transfers
- Neon (US — SCCs/IDTA); Vercel (US/EU edge — SCCs/IDTA); Upstash (US — SCCs/IDTA). SaaS Factory platform components (SF Auth): transfer basis not asserted — see the platform note in the sub-processor register below.
- Security Measures
- AES-256-GCM at rest for sensitive fields; TLS 1.2+ in transit. This Service stores NO password and performs no password verification — authentication is delegated in full to the SaaS Factory central identity provider (SF Auth) over OIDC. Sign-in sessions are 8-hour JWTs with a revocation list. Rate-limit keys contain the RAW user id or RAW IP address (they are not hashed) and expire on a short automatic TTL.
PA-002
HMRC MTD Quarterly Income Tax Submissions
- Purpose
- Collect National Insurance Numbers and HMRC OAuth tokens; submit quarterly income and expense updates to HMRC under the Making Tax Digital for Income Tax Self Assessment (MTD ITSA) regime.
- Legal Basis
- Legal Obligation (Art. 6(1)(c)); Contract (Art. 6(1)(b))
- Data Categories
- National Insurance Number (NINO) — encrypted at rest in this Service, and sent in the request path of every HMRC call
- HMRC OAuth access and refresh tokens — held in the SaaS Factory Tether credential vault; this Service does not store or refresh them
- Financial transaction data (income & expenses)
- Property portfolio data
- HMRC Fraud Prevention Header data (Gov-Client-* / Gov-Vendor-*) — device, browser and connection metadata about your session, transmitted to HMRC as a statutory requirement
- Data Subjects
- Landlords subject to MTD ITSA
- Recipients / Sub-processors
- HMRC (statutory recipient — UK)
- SaaS Factory connections proxy + SF Tether credential vault — every HMRC request is routed through it and it holds the HMRC OAuth credential
- Neon Inc. (database)
- Vercel Inc. (hosting)
- Retention Period
- NINO: Duration of account. Financial records & submissions: 7 years (HMRC statutory requirement).
- International Transfers
- HMRC: UK (no transfer). Neon (US — SCCs/IDTA); Vercel (US/EU edge — SCCs/IDTA). SaaS Factory platform components (connections proxy / SF Tether): transfer basis not asserted — see the platform note in the sub-processor register below.
- Security Measures
- NINO encrypted at rest with AES-256-GCM; decrypted on-demand only; never logged. The Service supports a dedicated NINO key, but where one is not provisioned it falls back to the same master key used for the other encrypted fields (src/lib/nino.ts), so a single key currently protects every classification rather than each having its own. This Service never contacts HMRC directly and never holds an HMRC token — every request (NINO in the request path, submission body, and the Gov-Client-* headers) transits the SaaS Factory connections proxy, which injects and refreshes the OAuth credential from the SF Tether vault.
PA-003
Property Portfolio Management
- Purpose
- Store, display, and manage landlord property addresses and portfolio details to associate financial transactions and MTD submissions with the correct property.
- Legal Basis
- Contract (Art. 6(1)(b))
- Data Categories
- Property addresses
- Property descriptions
- Portfolio metadata
- Data Subjects
- Landlords
- Recipients / Sub-processors
- Neon Inc. (database)
- Vercel Inc. (hosting)
- Retention Period
- Duration of account; 7 years for records linked to HMRC submissions
- International Transfers
- Neon (US — SCCs/IDTA); Vercel (US/EU edge — SCCs/IDTA)
- Security Measures
- Row-level security (RLS) on database; RBAC enforced at every API endpoint; TLS 1.2+ in transit
PA-004
AgentOS Letting Agent Data Import
- Purpose
- Import property, tenancy, and financial transaction data from the landlord's letting or estate agent via the AgentOS API to pre-populate the MTD service.
- Legal Basis
- Contract (Art. 6(1)(b))
- Data Categories
- Tenant names and tenancy dates
- Rental income and agent fee data
- Property addresses
- Data Subjects
- Landlords; tenants (limited transaction/tenancy metadata)
- Recipients / Sub-processors
- AgentOS Ltd (data source — UK)
- SaaS Factory connections proxy + SF Tether credential vault — every AgentOS API request is routed through it and it holds the AgentOS API key
- Neon Inc. (database)
- Vercel Inc. (hosting)
- Retention Period
- 7 years from transaction date (HMRC statutory requirement)
- International Transfers
- AgentOS: UK (no transfer). Neon (US — SCCs/IDTA); Vercel (US/EU edge — SCCs/IDTA). SaaS Factory platform components (connections proxy / SF Tether): transfer basis not asserted — see the platform note in the sub-processor register below.
- Security Measures
- The AgentOS API key is held in the SaaS Factory Tether vault and injected by the connections proxy — this Service does not store it. Tenant data minimised to names and dates; RLS on database.
PA-005
Open Banking Data Import via TrueLayer
- Purpose
- With user consent, connect to the landlord's bank account via the TrueLayer Open Banking API to import bank transaction data for reconciliation with property income and expenses.
- Legal Basis
- Contract (Art. 6(1)(b)); Consent (Art. 6(1)(a)) for bank account connection
- Data Categories
- Bank account identifiers and display name (the TrueLayer account id and account label). Account number, sort code, IBAN and balance are fetched LIVE from TrueLayer at render time and are never stored by this Service.
- Bank transaction history (amounts, merchants, dates) — stored
- TrueLayer OAuth access and refresh tokens — held in the SaaS Factory Tether credential vault; this Service does not store or refresh them
- Data Subjects
- Landlords who opt in to Open Banking
- Recipients / Sub-processors
- TrueLayer Ltd (Open Banking provider — UK/EEA)
- SaaS Factory connections proxy + SF Tether credential vault — every TrueLayer request is routed through it and it holds the bank OAuth credential
- Neon Inc. (database)
- Vercel Inc. (hosting)
- Retention Period
- Bank credentials: held in the SF Tether vault until revoked or the account is deleted. Transaction data: 7 years from transaction date.
- International Transfers
- TrueLayer: UK/EEA (no restricted transfer). Neon (US — SCCs/IDTA); Vercel (US/EU edge — SCCs/IDTA). SaaS Factory platform components (connections proxy / SF Tether): transfer basis not asserted — see the platform note in the sub-processor register below.
- Security Measures
- Consent obtained before connection and revocable at any time; the PSD2 consent window is 90 days. Account number, sort code and IBAN are never written to our database — they are read live from TrueLayer through the connections proxy for display only. The bank OAuth credential is vaulted in SF Tether, not held by this Service.
PA-006
Transactional Email Delivery (including the Weekly Financial Digest)
- Purpose
- Send service notifications including HMRC submission confirmations, deadline reminders, bank consent expiry warnings, and system alerts; and send the weekly landlord financial digest summarising the current tax year's position.
- Legal Basis
- Contract (Art. 6(1)(b)); Legitimate Interests (Art. 6(1)(f)) for security alerts
- Data Categories
- Email address
- Name (for personalisation)
- Year-to-date rental income, expenses, and net profit or loss totals in GBP — rendered in the body of the weekly digest email
- Active property count, uncategorised transaction count, quarters submitted, and the next HMRC deadline date — also in the digest body
- Data Subjects
- Landlords and organisation members
- Recipients / Sub-processors
- SaaS Factory platform (SF Core central email relay — every message this Service sends is dispatched through it)
- Resend Inc. (email delivery — US)
- Retention Period
- Email logs retained by Resend per their data retention policy (typically 30 days)
- International Transfers
- Resend: US — SCCs/IDTA applied. SaaS Factory platform components (SF Core email relay): transfer basis not asserted — see the platform note in the sub-processor register below.
- Security Measures
- TLS in transit. The weekly digest email body DOES contain financial figures — year-to-date income, expenses and net profit/loss — so anyone with access to the recipient's mailbox can read them. The digest does not contain the National Insurance Number, bank account numbers, or any OAuth credential.
PA-007
Background Job Orchestration
- Purpose
- Orchestrate scheduled and event-driven background tasks including bank sync, HMRC obligation polling, and quarterly deadline reminders via Temporal Cloud.
- Legal Basis
- Contract (Art. 6(1)(b))
- Data Categories
- Organisation IDs and user IDs (workflow routing metadata)
- Minimal workflow inputs (e.g. submission IDs, dates)
- Data Subjects
- Landlords
- Recipients / Sub-processors
- Temporal Technologies Inc. (workflow orchestration — US)
- Retention Period
- Workflow execution history retained by Temporal Cloud per their data retention policy (default 30 days, configurable per namespace)
- International Transfers
- Temporal Technologies: US — SCCs/IDTA applied
- Security Measures
- Workflow inputs minimised to IDs; no NINO, tokens, or financial data in payloads; Temporal Cloud uses mTLS + API-key authentication, gRPC transport encrypted with TLS 1.3
PA-008
Security Monitoring & Error Tracking
- Purpose
- Detect, record, and alert on application errors, security incidents, and performance anomalies to maintain the security and reliability of the service.
- Legal Basis
- Legitimate Interests (Art. 6(1)(f))
- Data Categories
- IP addresses
- Browser/device metadata
- Stack traces (sanitised — no PII in error messages)
- Error context (e.g. route, action, non-sensitive metadata)
- Data Subjects
- All users
- Recipients / Sub-processors
- SaaS Factory platform (error ingestion — UK/US)
- Retention Period
- Error events: 90 days. Audit logs: 7 years.
- International Transfers
- SaaS Factory platform: UK (no restricted transfer where UK-hosted); Vercel (US/EU edge — SCCs/IDTA).
- Security Measures
- PII scrubbing applied before transmission; NINO and tokens never included in error context; legitimate interests balancing test documented
PA-009
Audit Logging
- Purpose
- Record all data-modifying operations within the service (create, update, delete) for security, fraud prevention, and dispute resolution purposes.
- Legal Basis
- Legitimate Interests (Art. 6(1)(f))
- Data Categories
- User ID and name
- IP address
- Action performed
- Resource type and ID
- Timestamp
- Data Subjects
- Landlords and organisation members
- Recipients / Sub-processors
- Neon Inc. (database)
- Vercel Inc. (hosting)
- Upstash Inc. / Vercel KV (distributed rate limiting — raw user IDs and raw IP addresses as rate-limit keys on audit endpoints)
- Retention Period
- 7 years
- International Transfers
- Neon (US — SCCs/IDTA); Vercel (US/EU edge — SCCs/IDTA); Upstash (US — SCCs/IDTA)
- Security Measures
- Every read of the audit log is scoped to the caller's own organisation by an explicit predicate at the API layer (src/lib/routers/activity.ts); any member of an organisation can read that organisation's entries, not only the owner. The audit table is deliberately EXCLUDED from database row-level security — the platform holds it on a permanent RLS denylist as a shell auth/platform table — so tenant isolation for THIS activity is application-layer only, unlike the property, transaction and submission tables in PA-003 and PA-004, which carry enforced database policies. Entries are not edited in the ordinary course of the service: the only writes after creation are the Art. 17 erasure anonymisation (user id and IP address nulled on request) and the 7-year retention purge. Rate-limit keys contain the raw user id or raw IP address — they are not hashed.
PA-010
Personal Data Breach Incident Management
- Purpose
- Detect, classify, triage, and document personal data breaches in compliance with UK GDPR Article 33. Notify the DPO within the required timeframe to enable 72-hour ICO notification decisions. Record breach incidents as an immutable audit trail.
- Legal Basis
- Legal Obligation (Art. 6(1)(c)) — UK GDPR Art. 33 / DPA 2018
- Data Categories
- Incident metadata (severity, affected data categories, estimated user count)
- Audit log entries for the detected breach
- DPO notification records (email delivery timestamps)
- Data Subjects
- Data subjects potentially affected by the breach; DPO
- Recipients / Sub-processors
- DPO / Data Protection contact (internal)
- ICO (if notification required under Art. 33)
- Affected individuals (if high-risk breach under Art. 34)
- Neon Inc. (audit log storage)
- Resend Inc. (DPO email notification)
- Temporal Technologies Inc. (automated triage orchestration)
- Retention Period
- Breach records: minimum 3 years (ICO enforcement guidance); audit log: 7 years
- International Transfers
- ICO: UK authority (no restricted transfer). Resend (US — SCCs/IDTA); Temporal Technologies (US — SCCs/IDTA); Neon (US — SCCs/IDTA).
- Security Measures
- Breach incident records are append-only audit log entries; DPO notifications sent via encrypted TLS; no NINO or financial data included in breach triage payloads
PA-011
Distributed Rate Limiting
- Purpose
- Enforce per-user and per-IP request rate limits across all authenticated API endpoints to prevent abuse, credential stuffing, and denial-of-service attacks. Rate-limit state is stored in a distributed Redis store (Vercel KV, backed by Upstash) so limits are shared across all serverless function instances.
- Legal Basis
- Legitimate Interests (Art. 6(1)(f))
- Data Categories
- User IDs — written VERBATIM into the rate-limit key (`uid:<user id>`) for authenticated requests
- IP addresses — written VERBATIM into the rate-limit key (`ip:<IP address>`) for unauthenticated requests
- Data Subjects
- All users
- Recipients / Sub-processors
- Upstash Inc. / Vercel KV (distributed rate-limit state store — US)
- Retention Period
- Rate-limit counters expire automatically after 2× the rate-limit window: about 2 minutes on the main API paths (60-second windows), and about 2 hours on the email-verification resend limiter (1-hour window). No long-term retention.
- International Transfers
- Upstash (US — SCCs/IDTA applied via Vercel's DPA with Upstash)
- Security Measures
- The identifier stored in the key is the RAW user id or the RAW client IP address — it is not hashed, and the key can therefore be read back to the identifier it was built from. No names, emails, or financial data are stored alongside it. Keys are scoped `rl:<namespace>:<identifier>`, carry a short automatic TTL, and are transmitted over TLS 1.2+.
Sub-processor Data Processing Agreement Register
All sub-processors are required to enter into a Data Processing Agreement (DPA) with AgentOS Ltd before any personal data is transferred to them. The table below records each sub-processor, their role, data location, and the transfer mechanism used for international transfers outside the UK.
| Sub-processor | Role | Data Location | Transfer Mechanism | DPA Reference |
|---|---|---|---|---|
| Neon Inc. | Managed PostgreSQL database | US (AWS us-east-1) / EU (configurable) | SCCs (Module 2) / UK IDTA | View DPA ↗ |
| Vercel Inc. | Application hosting, edge compute, CDN | US / EU edge PoPs | SCCs (Module 2) / UK IDTA | View DPA ↗ |
| TrueLayer Ltd. | Open Banking connectivity | UK / EEA | UK/EEA — no restricted transfer | View DPA ↗ |
| Resend Inc. | Transactional email delivery | US | SCCs (Module 2) / UK IDTA | View DPA ↗ |
| Temporal Technologies Inc. | Workflow orchestration (background jobs, scheduled tasks) | US | SCCs (Module 2) / UK IDTA | View DPA ↗ |
| SaaS Factory connections proxy / SF Tether | Third-party API gateway and credential vault. Every HMRC and Open Banking (TrueLayer) request this Service makes is routed through it, carrying the National Insurance Number in the request path, the quarterly income and expense figures in the request body, and the HMRC Fraud Prevention Headers. It holds the HMRC and TrueLayer OAuth access and refresh tokens — this Service never stores them. | Not asserted — see the platform note below | Not asserted — see the platform note below | Not asserted — see the platform note below |
| SaaS Factory central identity provider (SF Auth) | Performs all authentication for this Service over OIDC. Receives the sign-in attempt and returns the account identifier, email address, name, and profile image. This Service stores no password and verifies no password. | Not asserted — see the platform note below | Not asserted — see the platform note below | Not asserted — see the platform note below |
| Upstash Inc. / Vercel KV | Distributed rate limiting — stores raw user IDs and raw IP addresses (unhashed) as short-lived rate-limit keys on every authenticated API request | US (AWS us-east-1) | SCCs (Module 2) / UK IDTA (via Vercel DPA with Upstash) | View DPA ↗ |
| AgentOS Ltd. | Letting agent data source (property, tenancy, transactions) | UK | UK — no restricted transfer | DPA incorporated in AgentOS service agreement |
| HMRC | Statutory recipient of MTD quarterly updates | UK | UK — statutory authority, no restricted transfer | View DPA ↗ |
SCCs = Standard Contractual Clauses (UK-approved). IDTA = UK International Data Transfer Agreement. Module 2 = controller-to-processor transfer.
SaaS Factory platform components
The Service is built and hosted on the SaaS Factory platform. Three platform components receive personal data in the course of running the Service and are disclosed here as recipients:
- The connections proxy and the SF Tether credential vault — every HMRC and Open Banking call leaves the Service through the proxy, so the NINO, the quarterly figures and the Fraud Prevention Header data all transit it, and the vault holds the HMRC and TrueLayer OAuth tokens on our behalf (PA-002, PA-005).
- The central identity provider (SF Auth) — every sign-in is performed against it over OIDC; the Service itself holds no password (PA-001).
- SF Core’s central email relay — every email the Service sends, including the weekly financial digest, is dispatched through the relay before it reaches Resend (PA-006).
Their hosting locations, restricted-transfer mechanisms and DPA references are not asserted in this document — they are not established by the Service’s own code and are being confirmed by the controller. For the current position, contact privacy@agentos.com.
Data Subject Rights & Contact
To exercise your rights under UK GDPR (access, rectification, erasure, portability, restriction, or objection), or to request a copy of any executed DPA, please contact our Data Protection lead at privacy@agentos.com. Full details of your rights are set out in our Privacy Policy.