Data Processing Addendum
Processor terms for platform data, with Standard Contractual Clauses.
Last updated: 4 October 2026 · Effective: 4 October 2026
Roles
For platform data, you are the controller and we are the processor. We process personal data only on your documented instructions and for the purpose of providing the Platform and Services.
Scope of processing
Subject matter: AI-usage security telemetry and console data. Data subjects: your workforce/endpoint users. Data types: machine/user attribution, AI-tool metadata, key presence (not values), audit logs, AI execution traces your applications choose to send, as detailed in the Trust Center. If you turn on the optional in-browser DLP extension, the text a person is about to submit is evaluated in memory and not stored; the decision, the destination site and the kinds of data found are recorded. We do not process special-category data by design.
Security measures
Encryption in transit (TLS 1.2+) and at rest; RBAC and MFA; least-privilege access; tenant isolation; secret masking at collection; audit logging; and, optionally, fully in-VPC processing with no egress.
Subprocessors
The current list is published on our Sub-processors page (also summarized in the Trust Center). We will give you notice of changes, that is, of any new subprocessor before it begins processing your data, and offer you the right to object. In-VPC deployments use no external data subprocessors.
Data-subject requests
We assist you in responding to access, deletion, correction and portability requests, and forward any request we receive directly to you.
Breach notification
We notify you without undue delay and within 72 hours of confirming a personal-data breach affecting your data, with the information you need to meet your own obligations. Contracted breach-notification target: without undue delay and within 72 hours of confirmation, with a root-cause summary to follow
Service and incident commitments
Alongside breach notification, the commitments below apply to the service.
| Commitment | What this site states today | Contracted target |
|---|---|---|
| Breach notification | Customers are notified of a confirmed personal-data breach affecting their data without undue delay and within 72 hours of confirmation (DPA), with a root-cause summary to follow. | without undue delay and within 72 hours of confirmation, with a root-cause summary to follow |
| Uptime | Uptime and SLA terms for Discover + Warn and Discover + Warn + Block are set in the order form. | target 99.9% monthly availability for the managed service, not yet independently measured; the contracted commitment is in the order form |
| Recovery (RPO and RTO) | Encrypted database backups with point-in-time recovery; restore drills are planned. | database: Multi-AZ PostgreSQL with point-in-time recovery to within about five minutes and 7-day backup retention (RPO about five minutes). No RTO figure is published yet; recovery objectives are agreed per tier in the order form |
| Incident response times | Defined incident runbook. Vulnerability reports are acknowledged within 2 business days. | severity-based response targets are set per plan in the order form, with 24x7 handling of Severity 1 incidents on the Premier support plan; confirmed incidents affecting your data are notified within 72 hours |
Deletion & return
On termination we make your data available for export for 30 days, then delete it (and instruct subprocessors to do the same) unless retention is legally required.
Request it here and we’ll return an executable copy.
See the AI on your fleet in about a week.
Run the sensor across your estate and receive an AI risk report and an AI Bill of Materials. The assessment is free and carries no commitment.