Legal
Jetstone data processing terms
Version 2026-10-30
These terms apply when Black Shard Pty Ltd ("Black Shard") processes personal information on behalf of the business that holds a Jetstone workspace ("the customer"). They form part of the Jetstone subscription terms at /legal/terms/.
1. Roles
1.1 The customer decides which devices and accounts Jetstone watches and which actions it may take. Black Shard processes the resulting data only to provide Jetstone to the customer.
1.2 Black Shard handles the customer's account, billing and support data for its own purposes under the Jetstone privacy policy at /legal/privacy/.
2. Instructions
Black Shard processes customer data only on the customer's documented instructions. The workspace configuration, policy preset and Microsoft 365 consent are those instructions, together with these terms.
3. Confidentiality and access
3.1 Customer data is held in a workspace separated from every other workspace by row-level security in the database and a workspace prefix in storage.
3.2 Black Shard staff reach a workspace only through an audited support view, signed in with single sign-on, and only to answer a support request or investigate a fault.
4. Security
Black Shard keeps the controls described in the Jetstone residency statement and the Black Shard trust page in place: encryption in transit and at rest, private network endpoints for every data store, keys held in a hardware security module, per-device certificates for every agent, and audit records that are chained so tampering shows.
5. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft Corporation (Azure) | Hosting, storage, the incident write-up model | Australia East |
| Stripe, Inc. | Billing | United States |
| Apple Inc. and Google LLC | Push notifications for the mobile app, carrying no customer data beyond an opaque id | United States and other locations |
Black Shard gives the customer 30 days' notice by email before adding or replacing a sub-processor. The customer may cancel if it objects.
6. Breaches
Black Shard tells the customer without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting customer data, with what is known and what is being done. Black Shard helps the customer meet its own obligations under the Notifiable Data Breaches scheme.
7. Return and deletion
When the workspace closes, the customer can export its records for 30 days. Black Shard then deletes the workspace's records, except raw device telemetry, which is held in storage that cannot be altered or deleted for 12 months from receipt and is deleted when that period ends, and billing records Black Shard must keep by law.
8. Audit
Black Shard answers the customer's reasonable written security questions once a year and provides the summary of its most recent external penetration test once one exists.