Excalidraw

Data Processing Agreement (DPA)

Version: 2026-01-13

This Data Processing Agreement (“DPA”) forms part of the Agreement between Excalidraw s.r.o. (“Processor”) and the customer using the Excalidraw+ Services (“Controller”).

This DPA applies solely to the hosted Excalidraw+ Services. It does not apply to the standalone open-source editor available at excalidraw.com.

1. Definitions

For purposes of this DPA:

  • “Agreement” means the Excalidraw Terms of Service or other written or electronic agreement between the parties governing the use of the Services.
  • “Controller” means the Customer as defined in the Agreement, acting as the controller of Customer Personal Data under Data Protection Laws.
  • “Customer” means the entity or individual entering into the Agreement with the Processor.
  • “Customer Personal Data” means any Personal Data Processed by the Processor on behalf of the Controller through the Services.
  • “Data Protection Laws” means all laws applicable to the Processing of Personal Data under this DPA, including the EU GDPR, UK GDPR, and Swiss data protection law.
  • “EEA” means the European Economic Area.
  • “Personal Data”, “Processing”, “Process”, “Processes”, “Data Subject”, and “Supervisory Authority” have the meanings given in the GDPR.
  • “Processor” means Excalidraw s.r.o., acting as the processor of Customer Personal Data under Data Protection Laws.
  • “SCCs” means the Standard Contractual Clauses adopted by the European Commission pursuant to Implementing Decision (EU) 2021/914.
  • “Services” means the hosted Excalidraw+ subscription service and any related features, functionality, or support provided by the Processor under the Agreement.
  • “Subprocessor” means any third party engaged by the Processor to Process Customer Personal Data on behalf of the Controller.

2. Roles of the Parties

The Controller acts as the controller of Customer Personal Data.

The Processor acts as the processor of such data on behalf of the Controller under this DPA.

3. Instructions from the Controller

3.1 The Processor will Process Customer Personal Data solely on the Controller’s documented instructions, including as necessary to:

    •    provide, maintain, and secure the Services;

    •    deliver customer support;

    •    ensure service reliability;

    •    comply with legal obligations.

3.2 The Controller determines the accuracy, legality, and nature of Customer Personal Data submitted to the Services.

3.3 The Services are not intended for Processing special categories of Personal Data under Article 9 GDPR. The Processor does not monitor or access the content of drawings and Processes such content only incidentally and on behalf of the Controller.

DORA requirement (Article 30)

How Excalidraw meets this requirement

Description of ICT services
Article 30(2)(a)

Excalidraw+ enables teams to create, edit, store, synchronize, export, and share drawings, diagrams, and visual documentation.

Descriptions of functionality, technical requirements, and customer responsibilities are available in the Terms of Use, Privacy Policy, and product documentation. Personal-data processing is addressed in the DPA and its annexes.

Locations for data hosting and processing
Article 30(2)(b)

Excalidraw+ stores customer data in the United States. Excalidraw personnel access to customer personal data is restricted to the European Union, as described in our DPA.

A current list of subprocessors is maintained in our Trust Center.

Excalidraw will notify customers by email in advance of planned changes to hosting or processing locations. Subprocessor changes are notified in accordance with our DPA.

Availability, authenticity, integrity, and confidentiality of data
Article 30(2)(c)

Excalidraw maintains security measures to protect personal and non-personal customer data, including:

  • SOC 2 Type II compliance (certified via external audit)
  • Encryption in transit and at rest
  • Access controls and least-privilege principles
  • Secure software development and vulnerability management
  • Monitoring and logging
  • Backup and recovery procedures

Our security measures for personal data are further described in our DPA and its annexes.

SOC 2 Type 1 and Type 2 reports are available through our Trust Center.

Access, recovery, export, and deletion of customer data
Article 30(2)(d)

Workspace administrators can export their workspace’s drawings at any time through workspace settings, including after subscription cancellation. After workspace deletion, self-service export is unavailable; customers may contact support@excalidraw.com for assistance, subject to data still being available.

Upon termination, insolvency, resolution or discontinuation of its business operations, Excalidraw will ensure access, recovery and return of personal and non-personal customer data in an easily accessible format, through self-service export or alternative means where necessary.

Service level descriptions
Article 30(2)(e)

Excalidraw+ availability and service interruptions are addressed in our Terms of Use. Continuous availability is not guaranteed.

Customers may contact support@excalidraw.com for assistance. Users and other customer personnel should contact their workspace administrator first for administrative requests. We aim to respond promptly, but response times may vary and are not guaranteed.

Updates and revisions to these service-level descriptions will be communicated to customers by email.

We maintain a public status page.

Incident notification and assistance
Article 30(2)(f)

If an ICT incident affects the customer’s use of Excalidraw+ or the confidentiality, integrity, authenticity or availability of customer data, Excalidraw will:

  1. Notify the customer without undue delay after becoming aware of the incident.
  2. Provide assistance and reasonably requested information needed for the customer’s incident assessments and related regulatory reporting.
  3. Provide relevant updates and reasonably requested information on how the incident was managed and resolved.

This incident assistance is provided at no additional cost. Personal-data breach notifications are also governed by our DPA.

Cooperation with competent authorities

Excalidraw will reasonably cooperate with competent EU financial regulators, supervisory authorities, and resolution authorities regarding matters directly related to the customer's use of Excalidraw+, to the extent such cooperation is required by applicable law and relates to information reasonably available to Excalidraw.

Termination rights
Article 30(2)(h)

Customers may cancel their Excalidraw+ subscription at any time through their account settings, in accordance with our Terms of Use. Cancellation takes effect at the end of the current prepaid subscription period. No minimum advance cancellation notice is required.

Customers may terminate their subscription with immediate effect by written notice to support@excalidraw.com where required by a competent authority or in any of the circumstances specified in Article 28(7) of DORA. This right applies notwithstanding the ordinary cancellation timing above.

Reasonable exit assistance

Upon termination, Excalidraw will:

  • Provide access to and return of customer data as described in the “Access, recovery, export, and deletion of customer data” section above.
  • Handle personal-data retention and deletion in accordance with our DPA.
  • No custom or extended migration support is provided. This does not limit the data-access and return commitments above.

4. Confidentiality and Access Controls

4.1 The Processor ensures that persons authorized to Process Customer Personal Data are subject to appropriate confidentiality obligations.

4.2 Access to Customer Personal Data is strictly limited to authorized personnel located within the European Union, and only where necessary to operate, support, or secure the Services.

4.3 Processor personnel located outside the EU do not have access to Customer Personal Data.

Annexes

The following annexes form an integral part of this DPA: