Legal

Data Processing Addendum

Effective Date: 2026-11-05 (Version 2026.2)

Effective Date: November 5, 2026 (Version 2026.2)

This Addendum is between the customer that accepted the DVSentry Terms of Service ("Customer") and [Legal entity name: to be published] ("DVSentry"). It forms part of the Terms and applies automatically; a customer that needs a signed copy can ask at privacy@dvsentry.com.

1. Roles

For personal data inside the systems Customer asks DVSentry to assess (repositories, web applications, cloud accounts, clusters, hosts, AI systems, cost and usage data, Secure Share content), Customer is the controller and Data Fiduciary and DVSentry is the processor and Data Processor.

For the account data of Customer's users (names, email addresses, sign-in records, audit events), DVSentry is an independent controller and Data Fiduciary under its Privacy Policy.

2. Processing details

3. DVSentry's obligations

DVSentry will: process Customer personal data only on Customer's documented instructions, which are the Terms, this Addendum and the configuration Customer chooses in the product; ensure that anyone with access is bound by confidentiality; apply the security measures in section 9; assist Customer, as far as the service allows, with data subject requests, impact assessments and consultations; delete data as in section 8; and make available the information needed to show compliance with this Addendum. DVSentry tells Customer if it believes an instruction breaks data protection law.

4. Sub-processors

Customer gives general authorization for the sub-processors below. DVSentry announces a new sub-processor on this page and by email to Owners at least 30 days before it starts, and Customer may object on reasonable data protection grounds; if the parties cannot agree, Customer may end the affected service and receive a refund of prepaid fees for it.

DVSentry also looks up domains Customer asks it to monitor in public certificate-transparency (SSLMate Cert Spotter) and passive DNS (AlienVault OTX) sources, and downloads public vulnerability feeds; no Customer data is sent to them beyond the domain name looked up.

5. International transfers

Customer data is stored in India. Where the GDPR or UK GDPR applies to a transfer to DVSentry, the parties enter into the EU Standard Contractual Clauses (Module 2 where Customer is a controller, Module 3 where Customer is a processor) and the UK International Data Transfer Addendum, which are incorporated by reference with: clause 7 included; clause 9 option 2 with the notice in section 4; clause 11 optional language omitted; the law and courts of Ireland for clauses 17 and 18; the annexes completed by sections 2, 4 and 9 of this Addendum. DVSentry transfers personal data out of India only as the DPDP Act permits.

6. Personal data breach

DVSentry notifies Customer without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting Customer personal data, with the information then available, and updates Customer as it learns more. DVSentry makes the reports to CERT-In and to the Data Protection Board of India that the law requires of DVSentry itself; Customer remains responsible for the notices the law requires of it as Data Fiduciary.

7. Audits

DVSentry holds no SOC 2 or ISO 27001 certification today. On request, once a year, DVSentry answers a reasonable security questionnaire and provides its current security documentation and the results of its own assessments. Where that is not enough to show compliance, or a regulator requires it, Customer may audit on 30 days' notice, at its own cost, under confidentiality, without access to other customers' data.

8. Deletion and return

During the term Customer can export its reports and evidence. Customer data follows the retention period Customer sets (reports 30 to 365 days, default 90). Repository copies are deleted when each scan ends. When Customer deletes its organization its data is deleted at once; when DVSentry closes an organization it is suspended for 60 days, then deleted, and an encrypted archive is kept for 90 days before it is purged. Encrypted backups roll off within 35 days.

9. Security measures

10. Liability and order of precedence

The limitation of liability in the Terms applies to this Addendum. On personal data, this Addendum prevails over the Terms; the Standard Contractual Clauses prevail over both where they apply.