Data Processing Addendum.

01 · Overview

This page summarises the SecurityVault Data Processing Addendum ("DPA") so legal and procurement teams can assess it before requesting the executable document. The DPA is incorporated into our customer agreement by reference and applies whenever SecurityVault processes personal data on a customer's behalf. In any conflict, the executed DPA controls over this summary.

02 · Roles & scope

• Customer tenant data — the customer is the controller (or a processor acting for its own controllers); SecurityVault is the processor. Under India's DPDP Act, the customer is the Data Fiduciary and SecurityVault the Data Processor.
• User accounts — the customer onboards and offboards its own users, typically through its single sign-on, and decides what is kept. User account data (name, email, single sign-on identifiers, roles) is customer tenant data: the customer is the controller and Data Fiduciary, SecurityVault the processor and Data Processor. Users can remove their own name in the application; every other change or deletion is made by the customer's administrators.
• Billing data and our business contacts — SecurityVault is an independent controller (Data Fiduciary), as described in the privacy notice.
• Scope of processing — hosting, scan orchestration, findings correlation, policy evaluation, evidence sealing, and support, strictly per documented customer instructions. Processing purposes, categories, and durations are fixed in Annex I of the DPA.

03 · Core terms (GDPR Article 28)

• Documented instructions only — we process tenant personal data solely per the agreement and customer configuration; we notify you if an instruction appears to violate law.
• Confidentiality — we ensure that persons authorised to process tenant personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Security — technical and organisational measures are fixed in Annex II, including encryption in transit (data is encrypted in transit with TLS, both over public networks and between our internal services), encryption at rest and tenant isolation. Current detail: security page.
• Breach notification — we notify affected customers without undue delay and within 72 hours of confirming a personal-data breach, with the facts needed for your own regulatory notifications.
• Assistance — we assist with data-subject requests, DPIAs, and consultations with supervisory authorities.
• Audit — a summary of our security controls is published in the trust centre, with further detail provided under NDA on request. Customers may audit directly where their regulator requires it.
• Deletion — on termination, or earlier on the customer's written request, and after dual administrator approval, the customer's tenant enters a 30-day recovery window: it is locked, and it can be restored in full on the customer's request. When the window ends, all customer data is permanently and completely deleted from production systems: user accounts, configuration, findings, evidence, audit records, stored files, and the credentials and keys held for the tenant. Only an erasure record that contains no customer data is kept, to prove the deletion. Backups expire on a rolling cycle, so deleted data leaves database backups within 15 days and every other backup within 30 days of the deletion. Records we must keep by law are kept only for the legally required period. Written confirmation is available on request.

04 · International transfers

Tenant data is hosted in India by default; self-hosted deployments keep data in the customer's own environment. Where personal data leaves the EEA, UK, or Switzerland, transfers rest on the EU Standard Contractual Clauses (Module 2, controller-to-processor; Module 3 where you act as processor), the UK International Data Transfer Addendum, and the Swiss FDPIC amendments — all incorporated in the DPA — plus the supplementary technical measures documented in our transfer impact assessment, available on request.

05 · Subprocessors

The current subprocessor list, with purpose and region for each, is published at securityvault.io/subprocessors. Material changes are announced at least 30 days in advance; customers may object on reasonable data-protection grounds, and if we cannot resolve the objection you may terminate the affected service with a pro-rata refund. Every subprocessor is bound by written terms equivalent to the DPA.

06 · DPDP addendum (India)

For customers subject to India's Digital Personal Data Protection Act, 2023, the DPA includes a DPDP addendum: SecurityVault processes personal data only under the customer's valid contract as Data Processor, implements reasonable security safeguards, notifies the customer of personal-data breaches so the Data Fiduciary can meet its obligations to the Data Protection Board and affected Data Principals, deletes data when the specified purpose is served, and supports grievance redressal timelines. Our India-facing contacts are listed under Your privacy choices.

07 · How to execute

The DPA is incorporated by reference into your SecurityVault agreement and applies automatically; no separate signature is required. A countersigned copy is available on request: email legal@securityvault.io from your corporate domain with your legal entity name and the agreement it attaches to. Questions about our processing can go to our privacy and data protection team at dpo@securityvault.io.