Data processing agreement

A drafted processor DPA to accompany the main service agreement where the platform is operated for a customer (hosted or provider deployments). Bracketed items are deployment specific and negotiated per engagement. For self-hosted deployments the customer is the controller and no processor relationship arises from the software itself.

1. Subject matter, duration, nature and purpose

The Processor processes personal data on the Controller’s behalf solely to provide the Wahukeza threat-intelligence platform (ingestion, correlation, sensor telemetry analysis, breach-exposure monitoring of the Controller’s assets, attack-surface discovery of the Controller’s own declared domains and address ranges through public records (and, only for assets whose ownership the Controller has proven and for which it has recorded consent, bounded probing by a probe runner the Controller operates or the Processor operates on its instruction), alerting and reporting) for the duration of the main agreement.

2. Categories of data and data subjects

Categories: attacker IP addresses and attack telemetry; masked and hashed breach-exposure records; the Controller’s authorised-user account and audit data; public DNS, certificate-transparency and RDAP records for the Controller’s declared domains and ranges (of a registrant e-mail address, only its domain is kept, as a string). The full inventory is the platform’s records of processing.

Data subjects: operators of attacking infrastructure; the Controller’s authorised users; the Controller’s account holders, for breach monitoring.

3. Processor obligations (Art. 28(3))

The Processor shall:

1. Process only on documented instructions from the Controller, including for international transfers, unless required by law, with prior notice where lawful.
2. Ensure persons authorised to process are bound by confidentiality.
3. Implement appropriate technical and organisational measures (Art. 32); see Annex II.
4. Respect the conditions for engaging sub-processors (§4).
5. Assist the Controller with data-subject requests (Art. 12-23), using the platform’s data-subject access and erasure tooling.
6. Assist with security, breach notification, DPIAs and prior consultation (Art. 32-36).
7. At the Controller’s choice, delete or return all personal data at the end of provision and delete existing copies, unless retention is legally required. A single-tenant database drop satisfies this.
8. Make available information to demonstrate compliance and allow and contribute to audits.

4. Sub-processors

The Controller authorises the sub-processors in Annex III. The Processor gives [30] days’ notice of changes; the Controller may object on reasonable data-protection grounds. The Processor flows down equivalent obligations to each sub-processor and remains liable for their performance.

5. Personal-data breaches

The Processor notifies the Controller without undue delay and no later than [48] hours after becoming aware of a personal-data breach, with the information the Controller needs to meet its Art. 33/34 duties.

6. International transfers

Any transfer outside the EEA occurs only on the Controller’s instruction and under a valid transfer mechanism, such as Standard Contractual Clauses, incorporated by reference in Annex IV.

Where the Controller takes part in a sector sharing group one of whose members is established outside the EEA, a delivery to that member is such a transfer. The Controller’s membership of the group, and its sharing label on an indicator, are the instruction; the group’s terms name the mechanism, which this clause and Annex IV then cover.

7. Liability, term and governing law

Per the main agreement. Governing law: [jurisdiction]. This DPA prevails over conflicting data-protection terms in the main agreement.

Annex I: Processing details

Subject matter, duration, nature, purpose, categories and data subjects: §§1-2 above.

Annex II: Technical and organisational measures

Encryption in transit and at rest; role-based access control and scoped API keys; multi-factor authentication; signed webhooks; audit logging of sensitive mutations; database-per-tenant isolation; bounded, automatically enforced retention; outbound-sharing sanitisation; secrets management; signed release artefacts with a software bill of materials; attack-surface probing gated on proven ownership and recorded consent, with out-of-zone results dropped and never stored, run by a probe runner with a published scanning identity that honours opt-outs, operated either by the Controller or, on the Controller’s documented instruction, by the Processor, and in both cases only within the ownership-proven, consented scope. [Add infrastructure-specific measures.]

Annex III: Approved sub-processors

Annex IV: Transfer mechanism

[Standard Contractual Clauses module 2 (controller → processor), dated […]; or “not applicable: data hosted in [region]”.]

Controller: Trony Network · Privacy contact: [email protected] · Last updated 2026-11-07