Data Processing Addendum

1. Roles

For personal data you submit through the Service about your own users and team, you are the controller and we are the processor. For account and billing data about you, we are a controller and our Privacy Policy applies.

2. Scope of processing

Subject matter

Provision of the VibeLock platform.

Duration

The term of your subscription, plus the retention periods stated in the Privacy Policy.

Nature and purpose

Scanning your application at your instruction, and hosting, storage, transmission and display of scan, finding and evidence data about your application, and generation of documents.

Types of personal data

Names, email addresses, role assignments, the name, email address and request type of anyone who sends a privacy request through your trust page, and any personal data you choose to enter into free-text fields. Personal data that appears in responses your application returns to a scan, such as a name on a public page or the first rows of a database table that answers without an account, which we read in memory and do not keep; and personal data contained in code at the commit read by the isolated scanner, which is processed in memory and discarded.

Categories of data subject

Your team members, people who send a privacy request through your trust page, any individual referenced in a security or privacy record you create, end users of your application, and contributors to your repository.

3. Our obligations

Your documented instructions are these Terms and this addendum, the way you configure the Service, including the connections and scan settings you choose, and any further written instructions we agree. We will:

• Process personal data only on your documented instructions, including for transfers, unless required otherwise by law, in which case we will inform you unless legally prohibited.
• Ensure personnel authorised to process personal data are bound by confidentiality.
• Implement appropriate technical and organisational measures under Article 32, as described in the Security section of the Privacy Policy and on our security page.
• Assist you, taking into account the nature of processing, with data subject requests, and with your obligations under Articles 32 to 36 including breach notification and data protection impact assessments.
• Notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting your data, with the information available to us at that time and updates as the picture develops, including, as they become known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will not notify your data subjects or any authority about a breach of your data on your behalf without your agreement, unless the law requires us to.
• At the end of the provision of services, at your choice, return your personal data through the export in account settings and delete it, within 30 days, and remove it from backups as they expire in the normal cycle. We confirm deletion in writing on request. Anything the law requires us to keep is protected and used only for that purpose.
• On request, give you a summary of our own privacy impact assessments of the Live URL scan and the repository read.
• Make available information necessary to demonstrate compliance and allow for audits, as set out below.
• Immediately inform you if, in our opinion, an instruction infringes the GDPR, the UK GDPR or other applicable data protection law, as required by the final paragraph of Article 28(3).

We do not use personal data processed on your behalf for our own purposes, and we do not use it, or permit our subprocessors to use it, to train machine learning models.

You will not instruct us to process protected health information, payment card data or personal data of children. VibeLock is not your business associate under HIPAA. The Service is not designed to receive these categories, and a scan does not keep the values it reads.

3a. Technical and organisational measures

The measures below are the Article 32 measures referred to above. They are stated here so this addendum is complete on its face rather than pointing at a page that may change. We will not materially reduce the overall protection these measures provide during the term.

Encryption in transit

TLS for all connections.

Encryption at rest

AES-256 across the database and object storage.

Application-layer encryption

Vulnerability records are encrypted above the database layer, so a database compromise alone does not expose readable findings.

Tenant isolation

Row level security is enabled on every table, so one account cannot read another account data.

Access control

Role-based permissions, multi-factor authentication available to all users and required for administrative accounts, session expiry and revocation, and new device and location alerting.

Secret handling

Secret values found in your application or code are never stored. Only the type and location of an exposed secret are held.

Code isolation

Code is read only inside a single-use scanner in the European Union, in memory, with an outbound allow list, and is discarded when the scan ends. The web application and database never hold it, and it is never sent to an AI model.

Scan minimisation

Values read from your application during a scan are dropped in memory; only names of tables, columns and buckets, row counts and the finding are stored.

Logging and monitoring

Sensitive actions are recorded in an audit log with actor, action and timestamp.

Vulnerability management

Dependencies are monitored for known vulnerabilities and critical issues are patched on a defined timeline.

Resilience

Managed database backups.

4. Subprocessors

You give general authorisation for us to engage subprocessors. The current list is published on our Subprocessors page. We will give at least 30 days notice, by email to the account owner and on the Subprocessors page, before adding or replacing a subprocessor, and you may object on reasonable data protection grounds, in which case we will work with you in good faith or you may terminate the affected service and receive a refund of any prepaid fees for the period after termination.

We impose data protection obligations on subprocessors no less protective than those in this addendum, in a written contract, as Article 28(4) requires, and remain liable for their performance.

5. International transfers

Where a transfer is covered by an adequacy decision, including the EU-US Data Privacy Framework and its UK Extension and Swiss-US counterpart for certified recipients, that decision is the transfer mechanism.

Otherwise, where we process personal data subject to EU, UK or Swiss law outside those territories, the European Commission Standard Contractual Clauses (Decision 2021/914) are incorporated into this addendum by reference, with you as data exporter and us as data importer, Module Two (controller to processor). The UK International Data Transfer Addendum applies to UK transfers, and the Swiss amendments apply to Swiss transfers. Where an onward transfer to a subprocessor occurs, Module Three applies as appropriate.

We carry out and maintain a transfer impact assessment for each corridor where we rely on the Standard Contractual Clauses, in line with European Data Protection Board recommendations on supplementary measures, and we reassess when a subprocessor, corridor or adequacy decision changes. A copy is available on request.

On data protection matters this addendum prevails over the Terms, and the Standard Contractual Clauses prevail over both.

6. Audit

On reasonable written request, no more than once in any twelve month period unless required by a supervisory authority, we will provide information reasonably necessary to demonstrate compliance with this addendum. Where an on-site audit is legally required, or the information we provide is not enough to show that we meet this addendum, the parties will agree scope and timing in advance, it will be conducted during business hours without unreasonably disrupting our operations, and the auditor must be bound by confidentiality and must not be our competitor. None of this limits an audit or inspection by a supervisory authority.

7. Liability

Each party liability under this addendum is subject to the limitations and exclusions in the Terms of Service.