Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the Customer (controller) and Defline SRL (processor). It applies where we process personal data on the Customer's behalf in providing OpenPerimeter, and implements Article 28 of the GDPR (Regulation (EU) 2016/679). It takes effect when the Customer accepts the Terms; no separate signature is needed. A countersigned copy is available on request.
1. Scope of processing
| Subject matter and purpose | Providing the Service: discovering and testing the Customer's verified internet-facing systems; storing and presenting results; workflows for findings, gap assessment, incidents, suppliers and reports; notifications; evidence export. |
|---|---|
| Duration | The term of the Customer's account, plus up to 30 days for deletion afterwards. |
| Nature of processing | Collection by automated scanning and user input, storage, organisation, retrieval, display, transmission (alerts, questionnaires), export and deletion. |
| Data subjects | The Customer's users and invited members; employees and other individuals named in incident records, assessment notes or uploaded evidence; supplier contacts and questionnaire respondents; individuals whose data appears in public technical records of the Customer's systems (for example names in certificates or hostnames). |
| Categories of data | Names, work email addresses and roles; free-text content and documents the Customer enters or uploads; technical data such as hostnames, IP addresses, certificates and service banners; audit-trail records. |
| Special categories | None intended. The Customer should not upload special categories of data (GDPR Art. 9) or data on criminal convictions. |
2. Processor obligations
We will:
- process the personal data only on the Customer's documented instructions — these Terms, this DPA and the Customer's use of the Service's settings — unless EU or Member State law requires otherwise, in which case we will inform the Customer first where the law allows; and tell the Customer if we believe an instruction breaches data protection law;
- ensure that people authorised to process the data are bound by confidentiality;
- take the technical and organisational security measures required by GDPR Art. 32, as described in Annex 1;
- use sub-processors only as set out in section 3;
- help the Customer, taking into account the nature of the processing, to respond to data subject requests — largely self-service through the Service — and pass on any request we receive directly;
- help the Customer meet its obligations under GDPR Art. 32–36 (security, breach notification, data protection impact assessments, prior consultation), taking into account the information available to us;
- at the end of the Service, delete the personal data — after the Customer has had the chance to export it — within 30 days, unless EU or Member State law requires us to keep it;
- make available the information needed to demonstrate compliance with this DPA, and allow and contribute to audits as set out in section 5.
3. Sub-processors
The Customer gives general authorisation for us to use sub-processors. The current list is below. We will announce any addition or replacement at least 30 days in advance by email or in the Service; the Customer may object on reasonable data-protection grounds, and if we cannot address the objection the Customer may terminate the affected Service without penalty. We impose data-protection obligations on each sub-processor equivalent to this DPA and remain responsible for its performance.
| Sub-processor | Processing | Location and safeguards |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting of the application, database and stored files (AWS Lightsail) | EU — Frankfurt, Germany (eu-central-1) |
| Cloudflare, Inc. | DNS, TLS termination, content delivery and DDoS protection for the website | Global edge network; EU Standard Contractual Clauses and EU-US Data Privacy Framework |
| SMTP2GO | Delivery of alert, invitation and notification emails | Sent through the EU region (mail-eu.smtp2go.com); provider based in New Zealand, which has an EU adequacy decision |
Systems the Customer connects (for example Microsoft Entra ID) are the Customer's own providers, not our sub-processors; we access them only with the credentials and permissions the Customer grants.
4. Personal data breaches
We will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer data. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available.
5. Audits
On request we will provide information reasonably necessary to demonstrate compliance, including a description of our security measures and the Service's audit and evidence exports. Where that is not sufficient, the Customer (or an independent auditor bound by confidentiality) may audit our compliance once per year with at least 30 days' notice, during business hours and without disrupting other customers. Each party bears its own costs, unless the audit reveals a material breach by us.
6. International transfers
Customer data is hosted in the EU. We will not transfer it to a country outside the EEA unless the transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), with supplementary measures where needed.
7. Liability and precedence
Liability under this DPA is subject to the limitations in the Terms, except where GDPR does not allow them. If this DPA and the Terms conflict on the processing of personal data, this DPA prevails.
Annex 1 — Technical and organisational measures
- Encryption: TLS for all traffic to the Service; secrets for MFA and integrations encrypted at rest; passwords stored as salted scrypt hashes.
- Access control: each Customer's data isolated by organisation; role-based access (owner, member); optional TOTP multi-factor authentication with recovery codes; administrative access to production restricted to named personnel over key-based SSH; deployments through a restricted, single-purpose key.
- Integrity and accountability: hash-chained audit trail of user actions per organisation; uploaded evidence stored under random names with SHA-256 digests and served only as downloads.
- Availability and resilience: hosting in an EU data centre; DDoS protection by our content delivery provider; automated deployment with tests before release.
- Network hardening: only HTTPS and SSH exposed; unknown hosts receive no content; server version disclosure disabled.
- Data minimisation: supplier security ratings use public information only; integrations store aggregate results (for example MFA coverage counts) rather than user records; server logs kept for 30 days.
- Testing safety: active testing only of systems whose control the Customer has proven; shared infrastructure and third-party services excluded from port scanning.
Operator: Defline SRL, Sighisoarei 16, Cluj-Napoca, Romania, trade register no. J12/5570/21/12/2023, VAT RO49325536. Contact: [email protected]. Effective 2026-10-17.