Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between AIPTx ("Processor") and the customer ("Controller") for the provision of penetration testing services. This DPA reflects the parties' commitment to comply with applicable data protection laws, including the General Data Protection Regulation (GDPR).

• Personal Data: Any information relating to an identified or identifiable natural person.
• Processing: Any operation performed on Personal Data, including collection, storage, use, and deletion.
• Data Subject: An identified or identifiable natural person whose Personal Data is processed.
• Sub-processor: Any third party engaged by the Processor to process Personal Data.

The Processor will process Personal Data only for the following purposes:

• Providing penetration testing and vulnerability assessment services
• Generating security reports and findings
• Account management and customer support
• Service improvement and analytics (aggregated, anonymized data only)

The following categories of Personal Data may be processed:

• Contact information (name, email, phone number)
• Professional information (job title, company name)
• Technical data (IP addresses, user agents, logs)
• Account credentials (encrypted passwords)
• Billing information (payment details processed by third-party providers)

The Processor agrees to:

• Process Personal Data only on documented instructions from the Controller
• Ensure personnel authorized to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist the Controller in responding to Data Subject requests
• Notify the Controller without undue delay of any Personal Data breach
• Delete or return all Personal Data upon termination of services
• Make available all information necessary to demonstrate compliance

The Processor implements the following security measures:

• Encryption at rest (AES-256) and in transit (TLS 1.3)
• Multi-factor authentication for all personnel
• Role-based access control and least privilege principle
• Regular security audits and penetration testing
• SOC 2 Type II certified infrastructure
• ISO 27001 certified information security management
• 24/7 security monitoring and incident response
• Regular employee security training

The Controller authorizes the Processor to engage the following categories of Sub-processors:

• Cloud infrastructure providers (hosting and storage)
• Payment processors (billing and invoicing)
• Customer support tools (ticketing systems)
• Analytics providers (aggregated, anonymized data only)

A current list of Sub-processors is available upon request. The Processor will notify the Controller of any intended changes to Sub-processors, providing the Controller an opportunity to object.

The Processor will assist the Controller in fulfilling Data Subject requests including:

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object

When Personal Data is transferred outside the European Economic Area (EEA), the Processor ensures appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Additional technical and organizational measures as needed

In the event of a Personal Data breach, the Processor will:

• Notify the Controller within 72 hours of becoming aware
• Provide details of the breach, affected data, and remediation steps
• Cooperate with the Controller in investigating and mitigating the breach
• Document all breaches and maintain records for audit purposes

The Controller has the right to audit the Processor's compliance with this DPA. The Processor will:

• Provide access to relevant documentation upon reasonable request
• Allow on-site audits with reasonable advance notice
• Provide SOC 2 and ISO 27001 audit reports

Upon termination of the agreement or upon request:

• Personal Data will be deleted within 30 days
• Controller may request data export before deletion
• Certain data may be retained as required by law
• Certification of deletion provided upon request

Each party's liability under this DPA is subject to the limitations set forth in the main service agreement. The Processor is liable for damages caused by processing that violates GDPR or this DPA.

This DPA remains in effect for the duration of the main service agreement. Obligations regarding data deletion and confidentiality survive termination.

For questions about this DPA or to exercise audit rights:

• Data Protection Officer: [email protected]
• Legal: [email protected]
• Address: San Francisco, CA, USA