Data Processing Addendum

1. Definitions and roles

• Personal Data, Controller, Processor, Data Subject, Processing, and Supervisory Authority take the meaning given in the EU GDPR and, where UK GDPR applies, the UK GDPR and the Data Protection Act 2018.
• Controller is the customer organization that determines the purposes and means of the assessment and the Personal Data placed in the service.
• Processor is the entity that processes that Personal Data on the Controller’s documented instructions.
• The Processor acts as a Controller for account administration, support communication, website access requests, security telemetry, and billing — that processing is described in the Privacy Policy and is not governed by this DPA.

2. Scope, subject matter, and duration

This DPA applies for the term of the agreement. Processing is limited to what is necessary to provide, secure, support, and improve the hosted service and to comply with law. Annex I sets out the subject matter, duration, nature and purpose, the types of Personal Data, and the categories of Data Subjects.

3. Documented instructions

• The Processor processes Personal Data only on the Controller’s documented instructions, including for international transfers, unless required to do otherwise by law, in which case the Processor informs the Controller unless the law prohibits that notice.
• The Controller’s configuration of scans, scope, integrations, and retention settings within the service is the Controller’s instruction. The Processor informs the Controller without undue delay if an instruction, in the Processor’s opinion, infringes applicable data-protection law.
• The Controller is responsible for the lawfulness of the Personal Data it submits, for the notices and lawful bases it relies on, and for the accuracy of the scope it authorizes.

4. Confidentiality of personnel

The Processor ensures that personnel authorized to process Personal Data are bound by appropriate confidentiality obligations and receive appropriate training and access controls. Access follows least privilege and is role-scoped.

5. Security measures

The Processor implements the technical and organizational measures set out in Annex II, taking account of the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to Data Subjects. The measures include, without limitation, transport encryption, tenant-scoped access control, role policies, authenticated envelope encryption for integration secrets, hashed tenant API keys, and append-only, hash-chained audit records for security-relevant administrative actions. A plain-language summary is published on the Data Controls page.

6. Subprocessors

• The Controller gives general written authorization for the Processor to engage subprocessors. Annex III lists the subprocessors for the marketing site; the compute, storage, database, queue, and object-storage subprocessors for a customer deployment are named in the order package for that deployment and its region.
• The Processor imposes data-protection obligations on each subprocessor, by contract, that are no less protective than those in this DPA, and remains liable to the Controller for the subprocessor’s performance of those obligations.
• The Processor gives notice of any intended addition or replacement of a subprocessor that processes Controller Personal Data before that change takes effect, so the Controller can object. The mechanism and notice period are stated in the order or, if silent, a change is published on the Subprocessors page before it takes effect.

7. International transfers

• Where processing involves a transfer of Personal Data out of the EEA, the UK, or Türkiye, the Processor ensures an appropriate safeguard is in place.
• For EEA-origin data, the Processor relies on an adequacy decision where one applies, and otherwise enters the EU Standard Contractual Clauses with the relevant party, unmodified.
• For UK-origin data, the Processor relies on the UK International Data Transfer Addendum (or the UK Addendum to the EU SCCs) where required.
• For Türkiye-origin data, the Processor follows the transfer rules issued under KVKK Article 9, including signing the Kurul-issued standard contract without modification and filing it with the Authority (Kurum) within five business days through the prescribed mechanism where that route applies.
• The transfer mechanism for a specific deployment and the relevant safeguards are recorded in Annex IV.

8. Assistance to the Controller

• The Processor assists the Controller, taking into account the nature of processing, with appropriate technical and organizational measures, in fulfilling the Controller’s obligation to respond to Data Subject requests. The Processor does not respond to a Data Subject directly about Controller-controlled assessment content unless instructed or required by law, and refers the request to the Controller.
• The Processor assists the Controller with security of processing, breach notification, data-protection impact assessments, and prior consultations with a Supervisory Authority. Support beyond the standard service may be agreed in the order.

9. Personal-data breach

The Processor notifies the Controller without undue delay after becoming aware of a Personal Data Breach affecting Controller Personal Data, using the coordination process in Annex V. The notification describes, to the extent available, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. The Processor assists with the Controller’s own regulatory notifications and does not notify a Supervisory Authority about Controller Personal Data on the Controller’s behalf unless instructed.

10. Audit and information

• The Processor makes available the information needed to demonstrate compliance with Article 28 and allows for audits, including inspections, conducted by the Controller or an auditor the Controller mandates.
• Audits are scheduled in advance and conducted during business hours, under confidentiality, and in a way that does not compromise the security or confidentiality of other customers’ data. Where possible, the Processor satisfies the request with documentation and configuration evidence before an on-site inspection.

11. Return and deletion

On termination or expiry, the Processor deletes or returns Controller Personal Data at the Controller’s choice, and deletes existing copies unless the law requires storage. The Controller may export findings and evidence during the post-termination window stated in the order. Backups are deleted on the next rotation cycle; the Processor may not restore a backup to active use except to recover the service, in which case the erasure is re-applied. Immutable audit records may be retained to preserve accountability as described in the Data Retention and Deletion page.

12. Liability and conflict

Each party is liable to the other under this DPA on the terms of the agreement, including its liability limits and exclusions, subject to mandatory law. Where this DPA conflicts with an executed standard contractual clause or transfer addendum, the executed transfer instrument prevails for the transfer it governs; otherwise this DPA prevails over the agreement for the subject matter it covers.

Annex I — Processing details

• Subject matter: provision of the hosted application-security assessment service.
• Duration: the term of the agreement, plus the post-termination window and any legal-hold period.
• Nature and purpose: hosting, scanning, analysis, triage, storage, export, support, and securing the service; agent-assisted and AI-assisted analysis only where the Controller enables it.
• Types of Personal Data: controller-supplied assessment content (which may include personal data, credentials, and third-party data the Controller is authorized to process), account and administrator identifiers (name, work email, role), authentication and audit events, and integration configuration metadata.
• Categories of Data Subjects: the Controller’s administrators and users, and any individuals whose personal data appears in the Controller’s targets, source, or findings.
• Sensitive data: the Controller is instructed not to submit special-category data unless it has a lawful basis and a documented need; where submitted, the Processor applies the measures in Annex II.

Annex II — Technical and organizational measures

• Access control: role-scoped and tenant-scoped authorization; least-privilege administration; Enterprise entitlement adds OIDC and SAML single sign-on.
• Tenant isolation: records and service paths bound to an explicit tenant identity; cross-tenant reads tested.
• Encryption: transport encryption for data in transit; authenticated envelope encryption for integration and identity secret material through the configured key-custody backend; tenant API keys stored as hashes.
• Integrity and accountability: append-only, hash-chained audit events for security-relevant administrative actions; finding evidence is not hard-deleted by ordinary finding operations.
• Minimization and redaction: credential redaction on newly-stored agentic input; provider debug output limited to metadata; HTTP debug logs omit query values.
• Availability and resiliency: redundant managed infrastructure for the hosted service, environment separation between development and production, and documented recovery mechanics.
• Erasure: a tenant erasure workflow blocked by an active legal hold, recording an auditable completion event.
• Personnel: confidentiality obligations, role-based onboarding and offboarding, and no routine human review of customer assessment content except support the Controller requests.

Annex III — Approved subprocessors

• Vercel Inc. — Website hosting and content delivery. Processing location: United States, with edge delivery from regional points of presence.
• Cloudflare, Inc. — Bot and abuse protection (Turnstile); optional backup object storage (R2). Processing location: United States, with a global network.
• Google (Google Workspace) — Business email. Processing location: United States and European Union regions used by Google Workspace.

The subprocessors for a customer’s hosted deployment — compute, storage, database, queue, object storage, and any enabled AI provider — are named, with region and role, in the order package for that deployment and are maintained in the deployment-specific subprocessor list. They are not asserted here because they can differ by region and plan.

Annex IV — International transfer mechanisms

• EEA-origin transfers: EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), the module matching the parties’ roles, together with a transfer risk assessment and any supplementary measures the assessment requires.
• UK-origin transfers: the UK International Data Transfer Addendum to the EU SCCs (or the UK Addendum), issued under section 119A of the Data Protection Act 2018.
• Türkiye-origin transfers: KVKK Article 9 route — an adequacy decision where the Board has announced one for the destination, otherwise the Board-issued standard contract signed unmodified and filed with the Authority.
• The specific mechanism, destination, and safeguards for a deployment are recorded in the order package for that deployment.

Annex V — Security incident coordination

• Reporting channel: the Controller’s named technical contact and the Processor’s security contact on the order. The Processor acknowledges a declared incident within the target time on the Support and Service Levels page.
• Information shared: incident identifier, discovery time, affected scope and environments, known data categories, containment status, and a next-update time.
• Coordination: a shared incident channel, joint triage of customer impact, and a single customer-facing statement agreed with the Controller before any external communication about Controller Personal Data.
• Records: the Processor keeps the incident record and the decisions taken as part of its audit trail.

Execution

This DPA is provided for countersignature and can be issued as a signable document, together with the deployment-specific annexes and the executed transfer instruments that apply, for the customer and region concerned. Request it from contact@eresussec.com. The Processor will not present an unsigned standard contractual clause as an executed transfer agreement.