Data processing agreement

Version 2026-10-26.3, dated 2026-10-26. A countersigned PDF copy is available on request. Amendment in this version (26 October 2026): the last paragraph of section 4 names card payment with 3-D Secure, Apple Pay and Google Pay through Stripe as the only way to pay; invoice and bank transfer are no longer offered. Earlier amendment of 11 October 2026: the last paragraph of section 4 named payment by card beside invoice and bank transfer; the list of sub-processors is unchanged. Earlier amendment: section 4 (sub-processors) was amended on 6 October 2026. It also names the alert emails and workspace invitations delivered through Resend and its delivery reports, Google (Gemini) as a further sub-processor for the optional column help, and the lookups of CPE names at the National Vulnerability Database. 1. Subject and duration The processor, Neithra Technologies – Fabian Lorenz, Thaler Weg 2a, 51647 Gummersbach, processes personal data on behalf of the customer (controller) for the duration of the subscription, solely to provide the workspace. 2. Nature, purpose and categories • Data subjects: the customer’s employees and contractors using the workspace; vulnerability reporters; contacts of manufacturers, suppliers, authorised representatives and customer operators entered by the customer. • Data: names, work email addresses, activity records (who changed what, when); reporter name, email and organisation if provided; structured identities and contact details and free-text content of reports, product records and documents, including customer-supplied support content where it is processed on the customer’s instructions. • Purpose: operating the customer’s compliance record, including the activity log the customer keeps for market surveillance purposes. 3. Obligations of the processor Instructions, including those concerning international transfers, may be given in text form to the contact in the legal notice. Where Union or Member State law requires other processing, we inform the customer beforehand unless that law prohibits this on important grounds of public interest. The processor informs the customer without delay if it considers an instruction to infringe data protection law. Processing only on documented instructions; confidentiality of all persons authorised to process the data; the technical and organisational measures in section 6; assistance with data subject requests and with the customer’s obligations under Art. 32–36 GDPR; return or deletion of the data at the end of the service at the customer’s choice, as set out in section 11; making available all information necessary to demonstrate compliance and allowing audits under section 9. 4. Sub-processors The customer authorises the following sub-processors. Changes are announced at least 30 days in advance by email to the workspace owner; the customer may object on reasonable grounds. • netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany (data centre Nuremberg, Germany) — hosting of the server that runs the application, its database and backups; region EU (Germany). • Cloudflare, Inc., San Francisco, USA — DNS and Cloudflare Tunnel. Every request to the workspace passes through Cloudflare’s network, which terminates the encrypted connection and forwards the request to the server; content therefore transits Cloudflare but is not stored there by us. Transfer mechanism: the EU standard contractual clauses, as incorporated in Cloudflare’s Data Processing Addendum. • Plus Five Five, Inc. (Resend), San Francisco, USA — delivery of the Article 14 case reminders a member switches on (step, due time and a link to the case), of the alert emails to the security contact, owners and administrators of the workspace (product, title and dates of a vulnerability report, a critical finding or an Article 14 case; never the identity of a reporter) and of workspace invitations, sent from Resend’s region in Ireland (EU). Resend reports back whether an email was delivered or refused; that report is stored without address and content. Account emails (address confirmation, password reset) go through the same provider under our own responsibility (section 9 of the privacy notice). Transfer mechanism: the EU standard contractual clauses, Module Three (processor to processor). • Anthropic, PBC, San Francisco, USA — generation of AI-expanded document drafts. Transfer occurs only when a member clicks “AI draft”; that click is the customer’s documented instruction. Data transferred: the product record and organisation details listed in section 8 of the privacy notice — no vulnerability-report or member-profile records are loaded for this purpose, but customer-entered structured and free-text fields, including an approved policy, can contain personal data. Anthropic processes the data under its Commercial Terms and Data Processing Addendum; under those terms API inputs and outputs are not used to train models. Transfer mechanism: the EU standard contractual clauses, Module Three (processor to processor), as incorporated in Anthropic’s Data Processing Addendum, together with the supplementary measures described there. We do not rely on an adequacy decision for this transfer. Column help for component lists: Google Ireland Limited, Dublin, Ireland, and Google LLC, USA (Gemini), reached through our own central Neithra Technologies service, are used as a further sub-processor only for a workspace in which an owner or administrator has explicitly allowed column help in the settings; that permission is the customer’s documented instruction and its approval of this sub-processor for that purpose, and it can be withdrawn there at any time. Data transferred: the headings of the columns of an uploaded component list that the fixed rules did not recognise and at most five example rows of those columns, with recognisable email addresses, telephone numbers and web addresses replaced by placeholders beforehand; a name or an unusually written number in a cell can remain. Transfer mechanism: Google’s data processing terms with the EU standard contractual clauses; Google LLC is certified under the EU–US Data Privacy Framework. Without that permission no data is sent to Google for this purpose. This paragraph and the description of the emails above were added on 6 October 2026. Customers pay through Stripe by credit card with 3-D Secure, Apple Pay or Google Pay. Billing and card payment data are processed under our own responsibility as described in section 5 of the privacy notice; the payment provider, the accounting provider and banks do not receive workspace content for that purpose. OSV.dev (Google LLC) receives only package identifiers for vulnerability matching and no personal data; the National Vulnerability Database (NIST, USA) receives only CPE names of components for the same purpose and no personal data. 5. International transfers Production data and backups are held in EU (Germany). Where a sub-processor processes data outside the EU/EEA, the transfer mechanism is stated per sub-processor in section 4 — an adequacy decision (EU–US Data Privacy Framework) or the EU standard contractual clauses with supplementary measures. 6. Technical and organisational measures • Tenant isolation: customer access to workspace records and support cases is scoped to the authorised organisation. Separately authenticated operator access is restricted to service administration and support. • Encryption in transit (TLS); deployment-specific encryption at rest and key management must be recorded in the verified security schedule before processing begins. • Passwords stored as salted scrypt hashes; sessions in httpOnly cookies with expiry. • Recorded workspace activities and role-based access within the workspace; operator access is separately restricted. • Exports are available in open formats. Backup frequency, encryption, retention, restore testing and erasure after restoration are documented in the verified security schedule; backups must have a defined expiry and must not restore erased data into use. • Production administration is restricted to authorised personnel; the access register, authentication controls and review schedule are recorded in the verified security schedule. Workspace logins are protected by password and session cookie; multi-factor authentication for workspace logins is not offered at present. 7. Notification of personal data breaches The processor notifies the customer without undue delay and at the latest within 48 hours after becoming aware of a personal data breach affecting the customer’s data, with the information required under Art. 33(3) GDPR as far as available. 8. Sub-processor flow-down The processor imposes on every sub-processor, by written contract, data protection obligations equivalent to those in this agreement (Art. 28(4) GDPR) and remains fully liable to the customer for the performance of the sub-processor’s obligations. 9. Audits The processor provides information necessary to demonstrate compliance and allows and contributes to audits, including inspections, by the customer or a mandated auditor. Routine reviews should use available documentation and remote access where sufficient, with reasonable notice and confidentiality safeguards. Frequency, notice, format and cost arrangements must not prevent audits required by law or justified by a suspected breach, material incident or supervisory-authority request; these may require prompt or on-site review. Costs, if any, are agreed reasonably without making statutory audit rights conditional on payment. 10. Duties of the customer The customer is the controller for the content of its workspace. It informs its employees and contractors who use the workspace, and the security researchers who report through its intake page, about the processing (Art. 13 and 14 GDPR); it operates a functional security mailbox so that reporters can reach it; it keeps free-text fields factual and enters personal data only where necessary; and it removes members who no longer need access. Whether a member requests an AI draft is the customer’s decision (section 4). 11. Return and deletion at the end of the service Art. 28(3)(g) GDPR leaves the choice between return and deletion with the customer. This is how that choice is exercised here, described as the system actually works. For 60 days after the end of the contract the workspace record stays available for export in open formats (CSV, JSON, Markdown). Within that window the customer takes what it needs; that export is the return of the data. The customer can instruct deletion at any time through the contact in the legal notice. We verify the instruction and perform an operator-reviewed erasure, normally within 30 days, subject to applicable legal deadlines and specifically documented exceptions. Archiving or deactivating an account does not itself delete the data. After the 60-day export window, we review and delete remaining workspace content within a further 30 days unless a documented lawful basis requires retention; the absence of a further instruction does not authorise indefinite retention. Remaining backup copies are restricted from normal use and expire under the verified security schedule in section 6. If a backup is restored, recorded erasures are reapplied before the restored system is used. We confirm the database erasure and separately identify any remaining restricted copies, their expiry and any required sub-processor follow-up; a pending backup action is not reported as completed. Only evidence required for our own legal duties is retained separately, with a recorded basis, purpose and review/expiry date. Invoices are generally retained for eight years under § 14b UStG; other accounting and business-correspondence records follow their applicable statutory category and legal exceptions. A customer’s product-documentation duties do not automatically require us to retain its entire workspace. Data-subject requests and the assistance owed under this agreement remain unaffected. If a login has already been deactivated, an authorised customer can request an operator-assisted export through the contact in the legal notice during the export window. Identity and authority are verified before any data is released.