Data Processing Agreement

Data processing terms for business customers. Requires legal review before use.

Overview

This Data Processing Agreement ("DPA") applies when you use Agnostics on a Team or Studio plan and we process personal data on your behalf as a processor.

For other plans, the Privacy Policy and Terms of Service apply. Contact us if you need a signed DPA for a different arrangement.

Roles

You are the controller for personal data you submit to Agnostics, including end-user content sent to targets during scans you initiate.

Agnostics acts as processor when handling that data solely to provide the service.

Processing details

Subject matter: provision of adversarial testing, findings, and release reporting.

Duration: for the subscription term plus retention periods described in the Privacy Policy.

Nature and purpose: storage, execution of scans, generation of findings, support, and security monitoring.

Categories of data subjects: your employees, contractors, and, where applicable, your end users whose data appears in test inputs or scan evidence.

Types of personal data: account data, target configuration, scan inputs and outputs, support communications, and usage metadata.

Instructions

We process personal data only on documented instructions from you, including configuration of targets, scans, and account settings, unless required by law.

Subprocessors

You authorize our use of subprocessors listed on the Subprocessors page. We will provide notice of material subprocessor changes where required.

Security measures

We implement appropriate technical and organizational measures including encryption in transit, encryption at rest for sensitive credentials, role-based access, tenant isolation, and audit logging as described on the Security page.

Data subject requests

We will assist you in responding to data subject requests to the extent required by applicable law and technically feasible, using the Data Requests process.

Security incidents

We will notify you without undue delay after becoming aware of a personal data breach affecting your workspace data, with information required by applicable law.

Deletion and return

Upon termination, we will delete or return personal data according to the Privacy Policy and your deletion requests, except where retention is required by law.

Request a signed copy

Contact us through the Contact page (/contact) with your organization name, plan, and billing contact if you need a countersigned DPA.