Data Processing Addendum

Instructions: Process personal data only on documented instructions from the Controller, including with regard to transfers of personal data, unless required by EU or Member State law.

Confidentiality: Ensure that persons authorised to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.

Security: Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including TLS 1.3 in transit and AES-256 at rest, role-based access controls, and regular security assessments.

Sub-processors: Not engage sub-processors without prior written authorisation of the Controller. General authorisation is granted for the sub-processors listed in Section 4 of this DPA. The Processor will inform the Controller of intended changes and give the Controller the opportunity to object.

Data subject rights: Assist the Controller, by appropriate technical and organisational measures, in fulfilling the Controller's obligation to respond to requests for exercising data subjects' rights under Chapter III of GDPR.

Security assistance: Assist the Controller in ensuring compliance with GDPR Articles 32–36 (security, breach notification, impact assessments) taking into account the nature of processing and information available to the Processor.

Deletion or return: At the choice of the Controller, delete or return all personal data at the end of the provision of processing services and delete existing copies unless EU or Member State law requires storage.

Audit rights: Make available to the Controller all information necessary to demonstrate compliance with GDPR Article 28 and allow for and contribute to audits and inspections conducted by the Controller or a mandated auditor.

Encryption in transit: TLS 1.3 for all data in transit between clients, platform, and infrastructure.

Encryption at rest: AES-256 for all stored data including scan results, account data, and audit logs.

Access controls: Role-based access control (RBAC) and multi-factor authentication for internal systems. Production access limited to authorised personnel on a need-to-know basis.

Credential handling: Authentication credentials supplied for scan runs are encrypted with AES-256-GCM, stored server-side for the scan duration only (maximum 24 hours), then automatically and permanently deleted. Credentials are never exposed to the client, never logged, and never included in reports.

Data isolation: Scan data is isolated per customer account. Cross-customer data access is technically prevented.

Audit logging: All access to customer data is logged and retained for security monitoring.

Vulnerability management: Regular security assessments of the Processor's own infrastructure.

Incident response: Documented procedures with severity-based escalation and 72-hour GDPR breach notification commitment.

Infrastructure: Personal data stored and processed through Supabase's Frankfurt-region infrastructure (within the EU). Frontend hosting via Cloudflare Pages and Workers under Standard Contractual Clauses.