Data processing agreement
Version 2026-11-10. This agreement applies between the customer (controller) and GoTrust BV, Belgium, which operates monsys.ai (processor). It is accepted in the dashboard under Team, with date, version, user and IP address in the audit log.
1. Subject and duration
Section titled “1. Subject and duration”GoTrust BV processes personal data only to deliver the monsys service: watching systems, reporting problems, producing reports and evidence. The agreement runs as long as the customer has an account and ends with the deletion of the data (section 9).
2. Which data, about whom
Section titled “2. Which data, about whom”| Category | Examples | Data subjects |
|---|---|---|
| Account data | name, e-mail address, role, sign-in times | the customer’s users |
| System data | host names, IP addresses, installed software, services, certificates | no personal data, unless a name is identifiable |
| Sign-in events | user name, source IP, country, time | staff and users of the customer’s systems |
| Websites and platforms | domain names, plugin versions, events | administrators of those sites |
The agent sends aggregated signals, never raw log lines. No special categories of personal data are knowingly processed.
3. Instructions
Section titled “3. Instructions”GoTrust BV processes only on the customer’s written instructions. The dashboard settings and this agreement are those instructions. If an instruction appears to breach the GDPR, GoTrust BV says so immediately.
4. Confidentiality
Section titled “4. Confidentiality”Everyone at GoTrust BV with access to customer data is bound to confidentiality. Access is limited to those who need it to deliver the service or fix an outage.
5. Security
Section titled “5. Security”- Every tenant is separated: every query filters on the tenant and the database enforces it as well (row level security).
- Connections are encrypted (TLS); agents use their own certificate per system.
- Sensitive actions on systems require a signed, short-lived, single-use token (Ed25519).
- Changes in the dashboard are recorded in an audit log.
- Two-step verification is available to every user.
6. Sub-processors
Section titled “6. Sub-processors”Monitoring data is stored on servers in a data centre in the European Union, rented by GoTrust BV. Notifications (push, e-mail) run through own, self-hosted services. There is no other sub-processor for monitoring data and no data is passed to third-party language models. Payments run through Stripe or PayPal; GoTrust BV is itself responsible for those. A new sub-processor is announced at least 30 days in advance; the customer may object and terminate.
7. Data subject rights
Section titled “7. Data subject rights”GoTrust BV assists the customer with data subject requests (access, rectification, erasure) within 10 working days of the customer’s request.
8. Personal data breaches
Section titled “8. Personal data breaches”GoTrust BV notifies a personal data breach without undue delay and at the latest 48 hours after discovering it to the owners of the tenant, with what is known about its nature, scope, consequences and the measures taken.
9. End
Section titled “9. End”After termination GoTrust BV deletes the tenant’s data within 30 days, including from backups, unless the law requires longer retention. On request the customer receives an export first.
10. Audit
Section titled “10. Audit”The customer may request the information needed to demonstrate compliance. An on-site audit is possible by appointment, at most once a year, at the customer’s expense.
Questions: info@gotrust.be.