Data Processing Addendum (DPA)
A contractual framework for processing data between Customer and CyberAgest
1. Scope & Processing Roles
This Data Processing Addendum ('DPA') supplements the CyberAgest Terms of Service between Customer ('Data Controller') and CyberAgest ('Data Processor'). It governs the automated processing, confidentiality, and technical protection of target telemetry, application diagnostics, and security findings. It is not a certification claim.
2. Security Standards & Data Confidentiality
CyberAgest treats security findings, infrastructure telemetry, and customer assets as confidential data. Transport and storage controls are applied according to the operational configuration; verifiable technical evidence is published separately from this agreement.
3. Authorized Sub-processor Framework
Customer authorizes CyberAgest to utilize the following essential infrastructure sub-processors:
Hetzner
Hosting and server infrastructure
Cloudflare
Edge protection and Turnstile verification
Microsoft Clarity
Product analytics when enabled
Zoho Mail
Transactional email delivery
Paddle
Subscription billing
Authorized scan egress
Dedicated, disclosed scanning addresses when used
4. 72-Hour Security Incident Breach Notification Commitment
In the event of a confirmed security incident impacting Customer telemetry or assets, CyberAgest will notify Customer's Data Protection Officer in writing within 72 hours of verification. The notification will describe the nature of the breach, affected data categories, estimated impact, and corrective actions taken.
Annex A — Details of Processing Activities
1. Subject Matter & Duration:
The performance of continuous automated vulnerability scanning, attack path simulation, and compliance mapping for the duration of the Subscription Term.
2. Nature & Purpose of Processing:
Ingestion of infrastructure endpoints, passive DNS mapping, port enumeration, HTTP header inspection, and vulnerability payload testing requested by Data Controller.
3. Categories of Customer Data:
Target Hostnames, IP Addresses, API Endpoint Configurations, Network Banners, Vulnerability Telemetry Logs, and User Account Credentials.
Annex B — Technical & Organizational Security Measures (TOMs)
1. Encryption & Confidentiality
- Transport and storage encryption according to the approved operational configuration.
- TLS and header grades are published only with dated scan evidence.
2. Access Control & Isolation
- Logical row-level isolation (PostgreSQL RLS) between workspaces.
- Hardware Passkey (WebAuthn) and TOTP Multi-Factor Enforcement.
3. Availability & Resilience
- Daily encrypted backups.
- Continuous cluster monitoring, health checks, and edge DDoS protection.
4. Auditing & Testing
- Immutable audit trail logging for all administrative & API actions.
- An independent penetration test is planned for Q4 2026.
Data Protection Officer (DPO)
To request a fully executed custom DPA agreement for your legal department:
[email protected]