Data Processing Addendum

1. Scope and roles

Customer is the business (controller) and we are the service provider (processor) for personal data contained in Customer's cloud accounts and the alerts and incident data Customer sends to the Service (“Customer Personal Data”). The subject matter, duration, nature and purpose of processing are set out in the Terms and the Customer's plan: configuration review, monitoring, incident intake and triage, paging, automatic remediation that Customer enables, and reporting. Data subjects are Customer's personnel and end users whose data appears in those systems.

2. Processing only on instructions

• We process Customer Personal Data only to provide the Service and on Customer's documented instructions, including the Terms and approved change plans.
• We do not sell or share Customer Personal Data, use it for targeted advertising, or retain, use or disclose it outside the direct business relationship with Customer.
• We do not combine it with personal data from other sources, except as the law permits for service providers.
• We will tell Customer if we believe an instruction violates applicable law, or if we can no longer meet our obligations under applicable privacy law.

3. Data minimization

Scans read configuration metadata, not application data. Our scanner removes credentials, tokens and detectable personal data from results before they are stored or analyzed by AI. Automatic remediation calls only the control-plane actions Customer allowed (such as restarting or rolling back a resource) and does not read application data. Alerts that Customer sends to our incident webhooks are stored with the incident for the life of the account; Customer should not include personal data in alert labels or annotations.

4. Personnel

Everyone with access to Customer Personal Data is bound by confidentiality obligations and receives security training. Access is limited to people who need it to deliver the Service.

5. Security measures

• Encryption in transit (TLS 1.2+) and at rest.
• Single sign-on with verified email, role-based access in the portal, and short-lived credentials for access to Customer systems.
• Isolated, private databases per service; workload identity instead of stored keys; signed container images; network policies and a web application firewall.
• Append-only audit logs of access and changes, kept 24 months.
• Vulnerability management of our own platform and a public disclosure policy.

6. Subprocessors

Customer authorizes the subprocessors listed on our subprocessor page. We impose data protection terms on each that are at least as protective as this DPA and remain responsible for their performance. We will give at least 30 days' notice of a new subprocessor by email to account owners; Customer may object on reasonable grounds and, if we cannot address the objection, terminate the affected service with a refund of prepaid fees for it.

7. Assistance with requests

We will promptly forward to Customer any request we receive from a data subject about Customer Personal Data and will help Customer respond, taking into account the nature of the processing.

8. Security incidents

We will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a breach of security leading to unauthorized access to Customer Personal Data. The notice will describe what happened, the data involved, the steps taken and a contact for more information, and we will update it as we learn more.

9. Return and deletion

When the Service ends, Customer may export its reports for 30 days. We then delete Customer Personal Data within 90 days, except copies we must keep by law, which remain protected by this DPA. Backups expire on their regular cycle.

10. Audits

On request, no more than once a year, we will provide information reasonably necessary to demonstrate compliance with this DPA, including completed security questionnaires and summaries of relevant assessments. Customer may take reasonable steps to stop unauthorized use of Customer Personal Data.

11. Contact

Marcos Morris, Bentonville, Arkansas. Contact: privacy@infrascanai.com.