Data Processing Agreement (DPA)

1. Scope and Roles

This Data Processing Agreement ("DPA") forms part of the agreement between AuditWard, LLC ("we", "us", "our") and the customer accepting our Terms of Service ("you", "Customer"). It governs our processing of personal data contained in scan data, scan artifacts, credentials or other context you supply for scans, configuration metadata and security event data from AWS accounts you connect, and pull request and merge request diffs and code from GitHub repositories and GitLab projects you connect ("Customer Data") under Article 28 of the General Data Protection Regulation ("GDPR").

For Customer Data, you act as the data controller (or as a processor on behalf of your own customers) and AuditWard acts as your data processor. This DPA does not apply to data for which AuditWard is itself a controller, such as your account registration details, billing records, and scan authorization audit logs, which are governed by our Privacy Policy.

Subject Matter and Duration

The subject matter of the processing is the provision of automated QA testing, security auditing, cloud configuration checking, AWS threat detection, and pull request security review services. Processing continues for the duration of your agreement with us. The nature and purpose of the processing, the types of personal data, and the categories of data subjects are determined by the targets you submit for scanning and may include personal data appearing on scanned web applications, in scan findings and evidence, and in credentials you provide for authenticated scans. For AWS accounts you connect, the data processed is configuration metadata such as account and region identifiers, resource identifiers, IAM user names and their sign-in and access key dates, and the settings our checks evaluate (for example MFA status, logging, and encryption settings), and the data subjects are your personnel and other users of that AWS account.

For GitHub repositories you connect, the data processed is the diff of each pull request and a copy of the repository at that pull request's commit, which the review reads and searches. The data subjects are your personnel, contributors to those repositories, and anyone else named in that code.

For GitLab projects you connect, the data processed is the diff of each merge request, a copy of the project at the merge request's latest commit, which the review reads and searches, and the GitLab user ID and username of the account you connect. The data subjects are your personnel, contributors to those projects, and anyone else named in that code.

Threat Detection Data

If you connect an AWS account on a plan that includes threat detection, Customer Data also includes security event data we read from that account: Amazon GuardDuty findings and CloudTrail records of account activity such as console sign-ins and permission changes. This data includes source IP addresses and the country they map to, and IAM user, role and session names, which can contain email addresses. It can identify your personnel and other people who access that account, so we process it as personal data on your behalf. We keep each threat finding and its history for 365 days after it was last updated and then delete it. We delete it sooner if you disconnect the AWS account or delete your organization. Evidence exports you create list threat findings by type, severity and dates only, without IP addresses or names, and keep that copy as described in section 9.

2. Processing on Documented Instructions

We process Customer Data only on your documented instructions, including with regard to transfers of personal data to a third country, unless we are required to process it by European Union or Member State law to which we are subject. In that case, we will inform you of the legal requirement before processing, unless that law prohibits such disclosure on important grounds of public interest.

Your instructions are given through your use of the service: initiating, configuring, and cancelling scans via the dashboard, the API, or the MCP server, supplying answers and credentials when a scan requests input, connecting and disconnecting AWS accounts, connecting and disconnecting GitHub repositories and GitLab projects for pull request review, and managing your account and data. The Terms of Service, the Acceptable Use Policy, and this DPA constitute your complete documented instructions. We will inform you if, in our opinion, an instruction infringes the GDPR or other applicable data protection law.

3. Confidentiality

We ensure that all persons authorized to process Customer Data, including employees and contractors, have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to Customer Data is limited to personnel who require it to provide, support, or secure the service.

4. Security Measures (Article 32)

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of Customer Data in transit using TLS.
• Encryption of scan credentials, access controls, and short-lived, access-controlled links for scan artifacts (screenshots, videos, reports).
• Read-only access to AWS accounts you connect, which you grant and can revoke at any time. We do not ask for or store your AWS access keys.
• Hosting on Amazon Web Services (AWS) infrastructure in the United States, protected by AWS physical and network security controls.
• Access controls restricting Customer Data to authorized personnel, with periodic access reviews.
• Hashed storage of account passwords and API/MCP access tokens; raw tokens are never stored.
• Logging and audit trails for scan authorizations and account activity.

We may update these measures from time to time, provided the updates do not materially reduce the overall level of protection of Customer Data.

5. Sub-Processors

You grant us general written authorization to engage sub-processors to process Customer Data on your behalf. The sub-processors we currently engage, including Amazon Web Services (cloud infrastructure, storage, processing of configuration metadata and security event data from AWS accounts you connect, and AI model inference via Amazon Bedrock for scan analysis and pull request review), Postmark (transactional email), and Stripe (payment processing), are listed on our public Sub-Processors page.

We will provide you with written notice via email at least 30 days before a new sub-processor begins processing Customer Data. You may object to a new sub-processor on reasonable, data-protection-related grounds within 30 days of the notice. If we cannot reasonably provide the service without the sub-processor you object to, you may terminate the affected service. We impose data protection obligations on each sub-processor by way of contract that are no less protective than those set out in this DPA, and we remain fully liable to you for the performance of each sub-processor's obligations.

6. Assistance with Data-Subject Rights

Taking into account the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as this is possible, in fulfilling your obligation to respond to requests from data subjects exercising their rights under Chapter III of the GDPR, including access, rectification, erasure, restriction, portability, and objection. To have scan sessions, findings, and artifacts deleted, or for assistance with other requests, email contact@platform.auditward.com and we will respond within 30 days. If a data subject contacts us directly about Customer Data, we will refer the request to you and will not respond except on your documented instructions or as required by law.

7. Personal Data Breach Notification

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects. Taking into account the nature of the processing and the information available to us, we will assist you in meeting your obligations under Articles 33 and 34 of the GDPR. You remain responsible for notifying supervisory authorities and data subjects where required.

8. Audits and Inspections

We will make available to you all information necessary to demonstrate compliance with our obligations under Article 28 of the GDPR and this DPA, and will allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you. Audits are subject to reasonable advance notice, must not unreasonably disrupt our operations, and may be satisfied in the first instance by written responses, documentation, and third-party audit reports or certifications covering our processing practices, where such materials reasonably demonstrate compliance. Each party bears its own costs of an audit.

9. Deletion and Return of Data

Upon termination of your agreement with us, deletion of your account or organization, or your documented request, we will, at your choice, delete or return all Customer Data, including scan data, findings, reports, and artifacts, and delete existing copies, unless European Union or Member State law requires storage of the personal data. Deletion is completed within 30 days. When an admin deletes an organization, we keep it locked for 7 days so any of its admins can restore it, and then delete it. Scan authorization audit logs (records of who authorized which scan and when) are retained for legal compliance purposes as permitted by Article 28(3)(g) of the GDPR, as described in our Privacy Policy. When you disconnect an AWS account, we stop reading it and delete its stored check results, its threat findings, and the exceptions you set for its checks. Issues raised from its configuration checks stay in your issue history, marked resolved, until you delete the project or your organization.

We hold pull request diffs and repository copies only while a review runs and do not keep them afterward. Review records are deleted when you disconnect GitHub, when the app is uninstalled on GitHub, or when your organization is deleted. Findings we post to GitHub stay there: you can delete a pull request comment, and a check stays with its commit.

We hold merge request diffs and project copies only while a review runs. Review records are deleted when you stop reviewing a project, disconnect GitLab, or delete your organization. Disconnecting deletes our stored GitLab tokens, which ends our access, and asks GitLab to revoke them and delete the webhooks we created. The record of your GitLab account, including its tokens, is deleted when it is disconnected. Findings we post to GitLab stay there: you can delete a merge request note, and a status stays with its commit.

Evidence exports you created before a disconnect keep their copy of that account's check results and exceptions, along with the type, severity and dates of its threat findings. An export also holds the email addresses of team members named in it, such as who approved an exception. Each evidence export is deleted 400 days after you create it, or sooner if you delete it, its project or your organization. While your organization can create evidence exports, admins can delete any export and members can delete the exports of projects they can access. Otherwise, you can ask us to delete an export.

10. No Training on Customer Data (Article 28(10))

Customer Data, including scan data, cloud configuration metadata, repository code, findings, evidence, artifacts, and credentials, is not used for training, fine-tuning, or benchmarking any AI or machine-learning models, and is not otherwise reused for our own purposes, without your explicit, separate, written consent. We acknowledge that any such use would, under Article 28(10) of the GDPR, make AuditWard a controller in respect of that processing and would require a separate lawful basis and a separate agreement with you. Absent such consent and agreement, no such processing takes place. Sub-processors providing AI model inference for scan analysis and pull request review are contractually restricted from using Customer Data to train or improve their models. Configuration metadata and security event data from AWS accounts you connect are not sent to any AI model.

11. International Data Transfers

Customer Data is stored and processed on AWS infrastructure in the United States. Where the GDPR applies to Customer Data, transfers to us and our sub-processors in the United States are made under the European Commission's Standard Contractual Clauses (2021) as incorporated in the AWS GDPR Data Processing Addendum and the equivalent addenda of our other sub-processors listed on the Sub-Processors page. You warrant that you have a lawful basis for transferring personal data contained in Customer Data to us for processing outside the European Economic Area, and you authorize the onward transfers described in this section.

12. Governing Law, Term, and Amendment

This DPA is governed by the laws of the State of Delaware, United States, except to the extent the GDPR or other mandatorily applicable data protection law requires otherwise. This DPA takes effect when you accept the Terms of Service at signup, which constitutes acceptance of this DPA, and remains in force for as long as we process Customer Data on your behalf. We may update this DPA from time to time; material changes will be communicated via email to registered users at least 30 days before they take effect and posted on this page with an updated revision date. In the event of a conflict between this DPA and the Terms of Service with respect to the processing of personal data, this DPA prevails.

13. Contact

If you have questions or concerns about this DPA or our processing of Customer Data, email us at contact@platform.auditward.com.