Data processing agreement

1. When this applies

When you become a customer, the source code, SBOMs, configuration and documentation you give us — we call them customer materials — may contain personal data: the names and addresses of your engineers in commit metadata, identifiers in test fixtures, contacts in a configuration file. For that data you are the controller and we are the processor, and these terms govern what we may do with it.

Our own business data — the enquiry you sent us, your billing details, your portal accounts — is not covered here. For that we are the controller and our privacy notice applies.

2. What we process, and why

3. We act on your instructions

We process personal data only on your documented instructions: the agreement, this document, the statement of work and any written instruction from your point of contact. If we think an instruction breaks data protection law, we tell you. We process in the European Union and do not move your data outside it without your written authorisation.

4. Who can see it

Access is limited to the named people assigned to your engagement, with individual accounts and logged access. Everyone with access is bound by confidentiality.

5. How we protect it

• Your source code is processed on a single dedicated company machine at our premises in France: full-disk encryption, one named user, no inbound connectivity. It is not personal equipment, it is not shared with anyone else's work, and no sub-processor and no server ever receives your code.
• EU hosting, in France, for everything else, with encryption in transit and at rest and encrypted nightly backups whose restore we test.
• One organisation per tenant on every table, with an automated test that proves one customer cannot read another's rows.
• Least-privilege repository tokens that you issue and can revoke; we store references, not credentials, and we drop them at the end of the engagement.
• An append-only audit log, hash-chained so a change to it is visible, and a checksum on every stored artefact.
• A named engineer signs every deliverable before you can see it.
• Working logs are redacted before they are written, and no customer material goes into our own system telemetry.
• We run our own product through the pipeline we sell you and publish the result.

6. Helping you answer requests

If one of your people asks you for their data, most of the answer is already in your portal: a summary of what we hold, a full export as a zip with a checksum for every file, and an erasure request. A request that reaches us directly is forwarded to you without undue delay, and we help you answer it. We also help with your obligations on security, breach notification and impact assessments; work beyond reasonable effort is charged at the rate in your statement of work.

7. Sub-processors

You authorise the sub-processors on our published list at the date you sign. That list is the one under "Sub-processors" in our privacy notice; the signed version repeats it as a schedule, with each provider's region, the data it sees and, for a model provider, the no-training term. We give you at least 30 days' notice before adding or replacing one, and you may object in writing on reasonable data-protection grounds; if we cannot agree, either of us may end the affected statement of work without penalty. Each sub-processor is bound by written terms equivalent to these, and we stay responsible to you for what they do.

Model providers. We engage one only where its terms say inputs and outputs are not used to train its models and the processing happens in an EU region. The term, with its reference and the date we checked it, is recorded in the schedule to your agreement. See how we use AI.

8. Sending data outside the EU

We process your data in the European Union and do not move it outside the EU or the EEA without your written authorisation. Where a sub-processor is a company headquartered outside the EU but processes in an EU region — a US cloud provider's Paris region, for example — we rely on its commitment to process there and, for any residual access from outside the EU, on the safeguard named in the schedule: the European Commission's standard contractual clauses or an adequacy decision.

If a court or an authority outside the EU ever requires us to hand over or transfer your data, we tell you, unless the law forbids us to.

9. Keeping and deleting

We delete customer materials — clones, uploaded SBOMs and their component inventories, scan findings, control mappings, threat models and unsigned drafts, with their stored artefacts — 30 days after the services end, unless you ask us in writing before that date to return them or keep them longer. The end of the services is recorded as a dated entry in your audit log, which is what starts the clock.

We keep, because you or the law needs them: signed deliverables and their sign-off records, acceptance certificates, your decision log, invoices and contracts, and the audit log itself. Backups expire on their own schedule and are restored only for disaster recovery.

The deletion job runs daily, records what it deleted in your audit log, and can be run first in a mode that reports what it would delete without deleting anything. We certify a deletion in writing on request.

10. If there is a breach

We notify you without undue delay after becoming aware of a personal data breach affecting your materials, to the contacts in your statement of work, with what we know at the time and more as we learn it. We do not notify a supervisory authority or your users on your behalf, and we accept no instruction or mandate to do so: those notifications are yours to make, in your own name, and what we tell you is there so that you can make them.

11. Audits

We give you what you need to check that we comply: this document, our record of processing, the sub-processor list, our security documentation and the audit log for your organisation. You, or an auditor bound by confidentiality who is not a competitor of ours, may audit us once a year on 30 days' notice, during business hours, at your cost, without disrupting the services. A remote audit by questionnaire and document review is the normal form.

12. Contacts

Ours: dpo@daskalos-apps.com. Yours: the privacy contact named in your statement of work.

13. Liability

What we are answerable for under these terms is limited by Article 14 of the services agreement, except where the GDPR says otherwise — Article 82, which makes a processor answerable directly to a data subject — and except so far as French law does not allow the limit. The limit cannot put a data subject's own claim out of reach, and it is not meant to.

14. Term and law

These terms apply for as long as we process personal data for you, and survive the end of the agreement until deletion under section 9. French law governs them, alongside the GDPR and the French loi Informatique et Libertés.

Schedules attached to the signed version

1. The authorised sub-processors, with region, data and — for model providers — the no-training term. It is the list published under "Sub-processors" in our privacy notice, fixed at the date you sign.
2. The technical and organisational measures, expanded from section 5.
3. Your own instructions for the engagement: repositories and branches in scope, contacts, any pseudonymisation you want, any extended retention.

Ask us for the full signable version at any point in a conversation; we send it with the master services agreement and the statement of work.