Coreload: GitHub Actions runners Coreload Data Processing Addendum
Last updated: 6 November 2026.
This addendum is part of the Terms of Service between Coreload LLC ("Coreload", the processor) and the customer (the controller, or a processor acting for its own customer). It applies to personal data inside Customer Data that data protection law, including the EU and UK GDPR, protects.
1. Scope and instructions
1.1 Coreload processes Customer Data only to run the customer's jobs and sandboxes, on the customer's documented instructions: the Terms of Service, this addendum and the customer's use and configuration of the service. If Coreload believes an instruction breaks data protection law, it tells the customer.
1.2 Subject matter and duration: running the customer's work, for as long as the Terms of Service last. Categories of data and of data subjects: whatever personal data the customer's code, build inputs and outputs contain, which the customer decides. The service is not designed for special categories of personal data.
2. How Coreload processes Customer Data
- Every VM serves one customer only, and its disk and memory are destroyed with it. Files a job chooses to save for later jobs are kept as the Privacy Policy says, readable only by the same customer's jobs. A hosted-CI job runs in a fresh VM that is destroyed when the job ends. A sandbox VM lives until the customer destroys it or its time limit ends.
- Coreload does not store the customer's secrets, and does not keep copies of hosted-CI job logs or artifacts. The sandbox service keeps each sandbox command's output in its memory, for the customer to read, until newer output needs the space or the service restarts.
- Operational records about jobs (ids, timings, organization and repository names, outcomes) are Coreload's own records, described in the Privacy Policy.
3. Confidentiality and security
3.1 Everyone at Coreload who can reach Customer Data is bound to keep it confidential.
3.2 Coreload keeps at least these technical and organizational measures:
- isolation: every hosted-CI job in its own single-use VM, and every sandbox in its own VM;
- least privilege: the GitHub App holds only the permissions the security documentation lists; production is changed only through reviewed automation; and the read access used to diagnose the service (its logs and state) is limited to named roles;
- network controls: per-VM and per-machine egress limits, and refused mail and mining ports;
- keys: the GitHub App's private key is held in a managed key service, which signs with it and never releases it; a machine stores only its own TLS and identity keys, and any key of a customer's that it needs is fetched only for that customer's running jobs and kept in memory;
- monitoring: alarms on the service's failures, which page Coreload.
4. Subprocessors
4.1 The customer authorizes Coreload to use the subprocessors below. Coreload binds each to data protection terms at least as protective as this addendum, and remains responsible for them.
| Subprocessor | What it does for Coreload | Data it handles | Where |
|---|---|---|---|
| A bare-metal hosting provider based in the European Union (name available on request) | Rents the bare-metal machines that the job VMs run on | Everything a job processes, while it runs | France and Canada |
| Amazon Web Services | Runs the control plane: job dispatch, state, usage records and service logs | Job records: ids, timings, organization and repository names | United States |
| GitHub | Delivers jobs to the runners through the customer's own installation | Job events and runner registration | As GitHub's own terms say |
| Stripe | Payment processing | Billing contact and payment details (Coreload keeps the card's fingerprint, never its number) | As Stripe's own terms say |
| Email, and a public mirror of Docker Hub images that jobs pull | Messages to Coreload; which public images a job pulls, from Coreload's shared addresses | As Google's own terms say | |
| Cloudflare | Hosts Coreload's website and its domain, and stores the files jobs save for later jobs | Those saved files, encrypted, deleted 30 days after they are written | European Union for the saved files; as Cloudflare's own terms say for the website |
| PostHog Inc. | Product analytics and session recordings of our website, docs and dashboard | Visitors' page views, clicks and masked session recordings, after consent; no Customer Data | United States |
| Dub Technologies, Inc. (dub.co) | Short-link redirects and click counts | Each click's time, country, device and browser type; no Customer Data | United States |
| Mintlify, Inc. | Hosts Coreload's documentation at docs.coreload.com | Docs visitors' requests; no Customer Data | As Mintlify's own terms say |
The full list, with each provider's name, is available on request to hello@coreload.com.
4.2 Coreload publishes any new or replacement subprocessor on this page at least thirty days before it starts processing Customer Data. A customer may object in writing within that period, on reasonable data protection grounds. If the parties cannot resolve the objection, the customer may end the Terms of Service before the change takes effect, and, if it has bought paid credit, its unused paid credit is refunded.
5. Breaches
Coreload tells the customer without undue delay after becoming aware of a breach of security that leads to the accidental or unlawful loss, destruction, alteration, disclosure of or access to Customer Data, with the information data protection law requires as it becomes available.
6. Assistance and information
6.1 Coreload helps the customer, as far as it reasonably can given what it processes, to answer data subjects' requests and to carry out data protection impact assessments and consultations with authorities, at the customer's cost where the help goes beyond what the service already provides.
6.2 Coreload meets its information and audit duties by providing its security documentation, and answers to the customer's reasonable written questions, on request. Where data protection law or the Standard Contractual Clauses require more, an audit is at the customer's cost, on at least thirty days' written notice, during business hours, no more than once a year unless a supervisory authority requires it or there are indications of non-compliance, by an auditor bound to confidentiality, and without access to other customers' data.
7. Deletion
Customer Data in a VM (other than files a job saved for later jobs, which expire as the Privacy Policy says) is destroyed with the VM: a hosted-CI VM when its job ends, a sandbox when the customer destroys it or its time limit ends. When the Terms of Service end, Coreload destroys the customer's remaining sandboxes. Coreload's own records expire on the periods the Privacy Policy gives.
8. International transfers
Where Customer Data protected by the EU GDPR leaves the European Economic Area for a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in its Decision 2021/914 apply, and are incorporated here by reference: Module Two where the customer is a controller, and Module Three where it is a processor. In them, the optional clause 7 does not apply; clause 9 option 2 (general authorization) applies, with the notice period of 4.2; clause 11's optional wording does not apply; clauses 17 and 18 choose the law and courts of the Netherlands; the competent supervisory authority is the one clause 13 determines; and the annexes are filled by this addendum (the parties are those named above; the data, the purpose and the duration are in section 1; the measures are in section 3; the subprocessors are in section 4). For the UK GDPR, the UK International Data Transfer Addendum to those clauses applies by reference, and for Swiss data the clauses apply with the references adapted to Swiss law. Coreload takes on no obligation beyond what those clauses and data protection law require, except as this addendum states.
9. Order of precedence
If this addendum and the Terms of Service conflict about personal data, this addendum wins; if the Standard Contractual Clauses conflict with either, the clauses win. The Terms of Service's limits of liability apply to this addendum, except where the clauses or the law do not allow them.