Data Processing Agreement — summary

Instructions and purposes

We process data only for contracted accounts, authorized assessments, evidence, findings, reports, remediation, support and security. We do not sell it, use it for our marketing or train general models on it.

Security measures

• tenant isolation and PostgreSQL FORCE RLS;
• transport encryption and authenticated evidence encryption;
• SSO/MFA, RBAC, least privilege and separation of duties;
• append-only audit, backup/restore and security tests;
• no arbitrary shell and human approval for material changes.

Subprocessors and transfers

We give at least 14 days’ notice before a new subprocessor receives customer data. Processing is EEA-first; transfers require a lawful mechanism, assessment and safeguards.

Breach, audit and deletion

Confirmed entrusted-data breaches are reported without undue delay. We provide compliance evidence and proportionate audit rights. After the standard 30-day export window, data is deleted or anonymized subject to law and the secured backup cycle.