Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into between you (the “Controller”) and VulnVerify (the “Processor”) and governs the processing of personal data carried out by VulnVerify on the Controller's behalf as part of providing the VulnVerify external vulnerability scanning and vulnerability-intelligence service (the “Service”).

For the avoidance of doubt: when VulnVerify acts as a data controller in its own right (e.g. processing the Controller's billing data, or its own threat-intelligence research data), this DPA does not apply — that processing is governed by our Privacy Policy.

Subject matter: Provision of the VulnVerify service to the Controller, including authentication, search, alerting, external vulnerability scanning of domains the Controller has verified and authorized, and reporting on vulnerabilities affecting the Controller's domain(s).

Duration:The term of the Controller's subscription, plus up to 30 days following termination for orderly deletion of personal data, other than the security audit-log entries described in Annex II and section 9. Issued scan-report files, which print the name and job title of the person who authorized the scan, are personal data within that deletion: they are deleted when the domain they concern is removed or the account is deleted. The only record of an issued report that is kept after that is its verification entry — the file's SHA-256 fingerprint, the domain name, the issue date, the kind of scan and its finding counts — which contains no personal data.

Nature and purpose: Storing user account data (name, work email, hashed password) and authenticating users; logging usage activity for security and product purposes; running the scans the Controller authorizes and storing their results, reports and the record of each authorization; sending transactional emails relating to the service.

Categories of data: Identification data (name, email), authentication credentials (hashed), professional context (job title, employer domain), usage data (search queries, watchlist, alerts), technical data (IP address, user-agent, approximate region), scan authorization records (the name and job title of the person who authorized scanning of a domain, and when), and scan results. Scan results describe the Controller's systems and are not expected to contain personal data beyond what the short, redacted evidence excerpt attached to a finding may incidentally include.

Categories of data subjects: Employees of the Controller who use the service; persons named in a scan authorization record as having authorized scanning on the Controller's behalf (their name and job title), who may be a contractor or service provider rather than an employee; and individuals whose personal data appears incidentally in the evidence excerpt of a scan result — such as the Controller's staff, customers or end users whose details are exposed on a scanned host. We do not knowingly process data of children under 16.

VulnVerify agrees to:

• Process personal data only on documented written instructions from the Controller (the Terms of Service and configurations in the application count as such instructions).
• Ensure that personnel authorized to process the personal data are bound by confidentiality obligations.
• Take all measures required pursuant to Article 32 GDPR (security of processing) — see Annex II.
• Assist the Controller, by appropriate technical and organisational measures, in fulfilling the Controller's obligations to respond to data-subject requests and data-breach notifications.
• Make available to the Controller all information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller (no more than once per 12-month period, with 30 days' written notice, at the Controller's expense).
• Promptly inform the Controller if an instruction infringes the GDPR or other applicable data-protection provisions.

The Controller authorises VulnVerify to engage sub-processors under the conditions set out in this DPA. The current list of sub-processors is:

• Vercel Inc. (USA) — application hosting, CDN, storage of issued scan-report files, and cookieless page-view and page-speed telemetry (Web Analytics, Speed Insights).
• Supabase Inc. (USA) — managed Postgres database.
• Contabo GmbH (Germany, EU) — hosts the scan runner: the server that sends the authorized scans of the Controller's verified domains from the address published on /scanning, and returns their results to VulnVerify while a run is in progress.
• Resend Inc. (USA) — transactional email delivery.
• Stripe (USA) — subscription payment processing.
• Apollo.io — business-contact data used solely to identify who to notify about a vulnerability affecting their organisation. Never used for Controller data. See Privacy Policy §7.
• BounceBan — deliverability verification for those disclosure addresses.
• Instantly.ai — delivery of vulnerability-disclosure notices. Never used for Controller or transactional email.
• Google LLC (Google Workspace) — VulnVerify mailboxes and internal documents.
• PostHog Inc. (USA) — product analytics.
• Upstash Inc. (USA) — short-lived abuse-prevention counters, keyed on the caller's IP address for signup, sign-in, password reset, email verification, domain ownership verification emails, unsubscribe, the contact form and the public domain check, and on an internal account identifier when a user confirms their password to change it or to delete their account, or re-checks a domain's ownership proof. No Controller content — names, email addresses, searches, watchlists or report text — is sent.
• Anthropic PBC (USA) — automated review of researcher-written vulnerability reports and extraction of findings from source material. Never used for Controller account data, searches, watchlists or scan results, and not used to train any model.

VulnVerify will notify the Controller of any intended changes concerning the addition or replacement of sub-processors (30 days in advance) and give the Controller an opportunity to object. If the Controller objects and the parties cannot reach agreement, the Controller may terminate the affected Service with pro-rata refund.

Where VulnVerify transfers personal data outside the European Economic Area, the United Kingdom, or any other jurisdiction with adequate data-protection laws, the transfer is governed by the EU Commission's Standard Contractual Clauses (Decision (EU) 2021/914), Module 2 (controller-to-processor), which are incorporated into this DPA by reference. For UK transfers, the UK International Data Transfer Addendum applies in addition.

Annex I (parties and processing), Annex II (technical and organisational measures), and Annex III (sub-processors) of the SCCs are deemed completed by the corresponding sections of this DPA and our Privacy Policy.

VulnVerify implements the following measures to ensure a level of security appropriate to the risk:

• Encryption: TLS 1.2+ for all data in transit; AES-256 for data at rest in the managed database.
• Authentication: bcrypt password hashing with cost factor 12; account lockout after repeated failed attempts; optional Google OAuth and (planned) SSO.
• Access control: Multi-tenant data segregation is enforced in every customer query: an account can read vulnerability data only for the registrable domain of the work email it signed up with, plus any registrable domain the account has proven it controls by a DNS TXT record, a file served over HTTPS from that domain, or a confirmation link sent to a role mailbox (such as admin@ or hostmaster@) at that domain. A domain that has only been claimed, and not proven, grants no access. Admin access is restricted to named individuals.
• Monitoring: Audit logging of security-sensitive events, retained for as long as we operate the Service (see Privacy Policy §8). Uptime monitoring of the production application and its critical internal endpoints.
• Backups: The production database is operated by our managed database sub-processor and backed up under the schedule and retention window of our plan with that provider; the schedule and window currently in force are available to the Controller on request to legal@vulnverify.com. We do not hold an independent backup copy and we do not operate a scheduled restore-drill programme; both are on our roadmap and this Annex will be updated when they exist.
• Patching: Dependency updates and upstream security advisories are acted on as part of our regular release process, and every change must pass typecheck, lint and an automated test suite before it ships. We do not operate an automated CVE-feed scanner and we do not commit to a fixed patching deadline.
• Incident response: Personal-data breach notification to affected Controllers within 72 hours of awareness (section 8), and suspected incidents take priority over other work. We do not yet maintain a formally documented incident-response runbook.

The Service provides self-service mechanisms for end-users to update their own details and to delete their account. For access, portability, restriction and objection requests, email privacy@vulnverify.com; we respond within 30 days. Where the Controller receives a request that cannot be fulfilled through these mechanisms, VulnVerify will, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible.

VulnVerify will not respond directly to data-subject requests regarding Controller data without the Controller's prior instruction (other than to acknowledge receipt and redirect the requester to the Controller).

VulnVerify will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data, and in any event within 72 hours. The notification will include: nature of the breach, categories and approximate numbers of data subjects and records concerned, likely consequences, and measures taken or proposed to address the breach.

At the choice of the Controller, VulnVerify will return all personal data to the Controller or delete it (and delete existing copies) at the end of the provision of services relating to processing, unless retention is required by applicable law or the data forms part of a security audit-log entry. Security audit-log entries are retained as described in Annex II and section 8 of our Privacy Policy: the entry survives, unlinked from the account it concerned, with the IP address and user-agent recorded at the time still on it, and an entry recording an action VulnVerify staff took on an account may still name the email address it was taken against. Removing a domain, or deleting the account, deletes that domain's scans, their findings and the PDF files of the reports issued from them (which print the authorizer's name and job title); if the storage provider cannot be reached at that moment, VulnVerify deletes the remaining files by hand. The one record of an issued report that remains is its verification entry — the file's SHA-256 fingerprint, the domain name, the issue date, the kind of scan and its finding counts — which holds no personal data and is kept so that anyone the Controller gave the report to can still confirm VulnVerify issued it. The Controller may export its findings data as CSV from the Service at any time during the term on plans that include export, and may request a full copy of its personal data at any time by emailing privacy@vulnverify.com.

Each party's liability under or in connection with this DPA is subject to the limitations of liability set out in the Terms of Service. To the maximum extent permitted by law, each party indemnifies the other for any damages, claims, or liabilities arising out of its own breach of this DPA.

This DPA is deemed accepted upon the Controller's acceptance of the Terms of Service. For customers requiring a counter-signed copy, email legal@vulnverify.com with your legal-entity name and address and we will return a signed PDF within 5 business days.

Disclaimer: This page is a standard-form starting point. For high-value contracts or regulated industries, your in-house counsel should review and negotiate specific terms; VulnVerify is happy to engage on edits.