Data Processing Agreement.

This page summarises the Data Processing Agreement we sign with customers and the commitments inside it, so you can assess them before you ask for the document. The signed DPA is what governs; where this summary and the DPA differ, the DPA wins.

Getting the DPA signed

1. Email us your contracting entity name and the person who signs.
2. We send the DPA, including the Standard Contractual Clauses where your transfers need them.
3. You sign electronically. It attaches to your order form and takes effect on the date of the last signature.

If your organisation requires its own DPA template, send it. We will review it and either sign it or come back with a short list of changes — we would rather do that than slow your procurement down.

Roles

For personal data inside your application and inside the evidence a run produces, you are the controller and SuperPentest is the processor. You decide what is tested and why; we process on your documented instructions.

For your account, billing and our own website analytics, we are the controller in our own right. That processing is described in our Privacy Policy and is outside the DPA.

Subject matter, nature, purpose and duration

Item	Detail
Subject matter	Authorized security testing of the applications, APIs and AI features in your signed scope, and the production of findings, evidence and reports.
Nature of processing	Sending test requests as identities you supply; capturing requests and responses as evidence; redacting secrets; storing, analysing and presenting that evidence; generating reports and retests.
Purpose	Providing the service you contracted for. Nothing else.
Duration	For the term of your agreement, plus the retention periods you choose for evidence and reports.

Data subjects and categories of personal data

Data subjects — your users and customers whose records exist in the tested environment; your employees who hold test identities; your staff who use the SuperPentest interface.

Categories — identifiers and account data present in the tested application; the content of requests and responses captured as evidence; test identity labels; and operational metadata such as timestamps, IP addresses and run identifiers.

We do not ask for special category data and the service is not designed to process it. If your environment contains it, use seeded test data instead — and if that is impossible, tell us before the run so we can agree the handling in writing.

Our instructions and your control

• We process only on your documented instructions, which are your signed scope and rules of engagement plus anything you later agree in writing.
• We will tell you if an instruction appears to breach data protection law, and we may pause rather than carry it out.
• Everyone with access is bound by confidentiality obligations that survive their engagement with us.
• Scope is enforced in code at the network boundary, so an instruction you did not give is not a run we can accidentally perform.

Security measures

These are the technical and organisational measures recorded in the DPA's security annex.

• Encryption — TLS in transit; encryption at rest for databases, evidence and generated artefacts.
• Secret redaction — captured traffic is masked before it is persisted. Credential values are referenced by identity label and never placed in model context, findings or the interface.
• Isolation — each run executes in an isolated environment with network egress restricted to your authorized scope.
• Access control — role-based access on least privilege, with separation between the staff who operate the platform and the data of any one customer.
• Integrity — promoted findings are sealed into an append-only, hash-chained ledger; tampering with a record breaks the chain and is detectable.
• Auditability — an immutable record of who authorized a run, what scope applied, and who accessed the resulting evidence.
• Resilience and recovery — backups of platform data with tested restoration, and documented stop conditions that halt a run cleanly.
• Assurance — we test our own platform with the product and remediate on the timelines published on our security page.

Sub-processors

You give general written authorisation for us to engage sub-processors. The current list — Cloudflare, MongoDB Atlas, object storage, Stripe, and the model providers used for inference — is maintained in our Privacy Policy.

Each sub-processor is bound by written terms no less protective than the DPA, and we remain fully liable to you for their performance. We give at least 30 days' notice before a new sub-processor starts processing your data, and you may object on reasonable data protection grounds — in which case we will work to a solution or you may terminate the affected part of the service without penalty.

Helping you answer data subject requests

If a data subject contacts us about data we process on your behalf, we forward it to you and do not respond substantively ourselves. We will give you reasonable assistance — including search, export and deletion — so you can meet your own deadlines, taking into account the nature of the processing and the information available to us.

Breach notification

If we become aware of a personal data breach affecting data we process for you, we notify you without undue delay and within 48 hours of becoming aware. The notification describes what we know about the nature of the breach, the categories and approximate volume of data and data subjects affected, the likely consequences, and the measures taken or proposed. We keep you updated as the picture becomes clearer, and we assist with your own regulatory and data subject notifications.

International transfers

Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision where one exists and otherwise on the European Commission's Standard Contractual Clauses, which are incorporated into the DPA, together with the measures in Security measures. A transfer impact assessment is available on request.

Audits

We make available the information needed to demonstrate compliance with the DPA, and we allow and contribute to audits. In practice most customers are satisfied by our documentation, this page and our security page; where you need more, we accommodate one audit per year on reasonable notice, at a time that does not disrupt operations, under confidentiality, and at your cost unless the audit finds a material breach on our side.

Return and deletion

At the end of the agreement you choose whether we return or delete the personal data we processed for you. You can export reports and evidence for 30 days after termination; after that we delete or anonymise, except where law requires us to keep a copy — in which case we tell you what is retained and why, and keep protecting it.

You can also delete individual engagements, evidence sets and test identities at any time from your account, without asking us.