This document is an operational draft and requires review by qualified counsel before you rely on it as a binding policy. Missing legal-entity fields are left blank on purpose.
Legal entity fields (company name, address, jurisdiction) are not configured. This draft uses placeholders instead of inventing a company.
Data Processing Addendum
Operator: Weblicious AB. Support: support@sslcertificates.io.
Roles
You are the controller of account and hostname data you submit. sslcertificates.io is the processor for that customer data. Let’s Encrypt is an independent controller/CA for ACME validation data they receive.
Instructions
We process data to provide the API: store orders, serve challenges, renew, revoke, and deliver webhooks you configure.
Security
Encryption in transit, encrypted secret storage, hashed API tokens, and organization isolation as described on /security.
Subprocessors
Current list. This draft DPA is not signed until legal entity fields and counsel review are complete.
International transfers
Data region is the application host. No additional region pin is sold in this release.