Data Processing Addendum

1. Parties and incorporation

1.1 This Data Processing Addendum (“DPA”) is between Vaktex, Inc., a Delaware corporation (“Vaktex”, “we”, “us”) and the customer that has agreed to the Terms of Service or another agreement with Vaktex for the Services (“Customer”, “you”). The Terms of Service, any order form and any other agreement between the parties for the Services are together the “Agreement”.

1.2 This DPA is automatically incorporated into the Agreement, with no signature required, for every Customer whose use of the Services involves Vaktex processing personal data subject to the GDPR, the UK GDPR or the FADP. It also applies to Customer Personal Data subject to US State Privacy Laws, as set out in Section 15.

1.3 Customers who want a countersigned copy can email support@vaktex.com with the subject “DPA”. A countersigned copy has the same content as this page on the date it is signed, and a signed copy is not required for this DPA to apply.

2. Definitions

Capitalized terms not defined here have the meanings given in the Agreement.

• Applicable Data Protection Law means all laws that apply to the processing of Customer Personal Data under the Agreement, including the GDPR, the UK GDPR, the FADP and the US State Privacy Laws.
• Controller, Processor, Data Subject, Personal Data, Processing and Supervisory Authority have the meanings given in the GDPR, and include the equivalent terms in other Applicable Data Protection Law (for example “business”, “service provider” and “contractor” under the CCPA).
• Customer Content means code, repositories, commit history, scan inputs and results, prompts and completions sent through the Vaktex AI Gateway, sandbox files, Angrep targets, findings and evidence, chat transcripts uploaded to vScan cooked under an organization, organization member data, and any other data that Customer or its users submit to the Services.
• Customer Personal Data means Personal Data in Customer Content that Vaktex processes on Customer’s behalf as a Processor.
• EU GDPR means Regulation (EU) 2016/679. UK GDPR means the EU GDPR as it forms part of UK law, together with the UK Data Protection Act 2018. GDPR means the EU GDPR and the UK GDPR, as applicable.
• FADP means the Swiss Federal Act on Data Protection of 25 September 2020 and its ordinances. FDPIC means the Swiss Federal Data Protection and Information Commissioner.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data that Vaktex or its Subprocessors transmit, store or otherwise process. It does not include unsuccessful attempts that do not compromise Customer Personal Data, such as failed sign-in attempts, pings, port scans or blocked network attacks.
• Restricted Transfer means a transfer of Customer Personal Data from the EEA, the UK or Switzerland to a country that does not have an adequacy decision or regulation recognized by the law of the exporting country.
• SCCs means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• Services means vaktex.com and its account dashboard, vScan Studio, the vScan CLI and scans, the Vaktex AI Gateway, sandbox compute, Angrep, vScan cooked and whoami, as described in Annex 1.
• Subprocessor means a third party that Vaktex engages to process Customer Personal Data.
• UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner, version B1.0, in force from 21 March 2022.
• US State Privacy Laws means the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) and other comprehensive US state privacy laws in force.

3. Roles and scope

3.1 Vaktex as Processor. For Customer Personal Data, Customer is the Controller (or a Processor acting for its own Controller) and Vaktex is the Processor (or Subprocessor). This DPA governs that processing.

3.2 Vaktex as Controller. Vaktex is an independent Controller of account data, billing data, website visitor data, marketing data, security logs, job applicant data, waitlist data and support communications. Vaktex is also the Controller when an individual uses vScan cooked without an organization or uses it anonymously. Vaktex is also an independent Controller of Preview Model Content, as defined in the Terms of Service, when it keeps and uses that content to train AI models (Section 14.2). Our Privacy Policy governs that processing, not this DPA. When a user runs vScan cooked under Customer’s organization account, this DPA applies, except that the public but unlisted result link is created at that user’s own instruction.

3.3 Self-hosted vScan Studio. vScan Studio runs on Customer’s own server, and code scanned in Studio stays on Customer’s infrastructure. Vaktex receives only licence activation data, heartbeats, monthly token and request counts, and, if enabled, notification emails relayed through notifications.vaktex.com. In air-gapped mode, activation and heartbeats are disabled. If Customer configures Studio to use the Vaktex AI Gateway or Vaktex sandboxes, the data sent to those Services is Customer Content covered by this DPA.

3.4 Customer as Processor. If Customer acts as a Processor for a third-party Controller, Customer warrants that its instructions, including the appointment of Vaktex as a Subprocessor, have been authorized by that Controller. Customer remains Vaktex’s single point of contact and is responsible for passing on any notices Vaktex gives under this DPA.

3.5 Customer obligations. Customer is responsible for the lawfulness of its instructions and of the Customer Personal Data it submits, including having a valid legal basis and giving any notices required by Applicable Data Protection Law.

3.6 Sensitive data. The Services are built to analyze code and security systems, not to process sensitive personal data. Customer should avoid submitting special categories of personal data (GDPR Article 9), data relating to criminal convictions and offenses (Article 10), and payment card data subject to PCI DSS. Repositories, logs, commit histories and test data may still contain personal data incidentally, for example names and emails in commits, user records in fixtures, or identifiers in log files. That incidental personal data, including any incidental sensitive data, is Customer Personal Data and is fully protected by this DPA.

3.7 Article 28(3) mapping. The table below shows where this DPA meets each requirement of GDPR Article 28(3).

Article 28(3)	Requirement	Where in this DPA
Lead-in	Subject matter, duration, nature, purpose, data types, data subjects	Annex 1
(a)	Process only on documented instructions, including for transfers	Sections 4 and 11
(b)	Personnel committed to confidentiality	Section 5
(c)	Security measures required by Article 32	Section 6 and Annex 2
(d)	Conditions for engaging Subprocessors	Section 8 and Annex 4
(e)	Assistance with data subject requests	Section 9
(f)	Assistance with Articles 32 to 36	Sections 6, 7 and 10
(g)	Deletion or return at the end of the Services	Section 13
(h)	Information and audits; telling Customer if an instruction infringes the law	Sections 4.3 and 12

4. Processing instructions

4.1 Documented instructions. Vaktex processes Customer Personal Data only on Customer’s documented instructions, including with regard to Restricted Transfers, unless Union, Member State or other applicable law requires otherwise. In that case Vaktex will tell Customer of the legal requirement before processing, unless the law prohibits it on important grounds of public interest.

4.2 Customer’s instructions. Customer instructs Vaktex to process Customer Personal Data to provide, secure and support the Services under the Agreement, as initiated by Customer and its users through the Services (for example by choosing models, naming a Preview Model, starting scans, enabling or disabling response caching, or launching an assessment), and as further described in this DPA. Customer may give additional written instructions that are consistent with the Agreement. Instructions that would change the Services or add work not covered by the Agreement require the parties’ written agreement.

4.3 Unlawful instructions. Vaktex will promptly tell Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. Vaktex may suspend the affected processing until Customer confirms or changes the instruction.

4.4 Limits on use. Vaktex will not process Customer Personal Data for its own purposes, sell it, or use it for advertising. The only exception is Preview Model Content, which Customer chooses to send to Vaktex for its own use under Section 14.2.

5. Confidentiality of personnel

Vaktex limits access to Customer Personal Data to personnel who need it to provide, secure or support the Services. Everyone with that access is bound by written confidentiality obligations or a statutory duty of confidentiality, and those obligations continue after their engagement ends.

6. Security

6.1 Measures. Vaktex implements and maintains the technical and organizational measures in Annex 2 to protect Customer Personal Data, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to Data Subjects, as required by GDPR Article 32.

6.2 Updates. Vaktex may update the measures in Annex 2 as technology and threats change, but will not materially reduce the overall security of Customer Personal Data.

6.3 Customer’s part. Customer is responsible for securing its own accounts, credentials, API keys and systems, for configuring the Services appropriately (including model choice, response caching and air-gapped mode), and for deciding what content to submit.

6.4 Assistance. Taking into account the nature of processing and the information available to it, Vaktex will assist Customer in meeting its obligations under GDPR Article 32 by providing the information in Annex 2 and answering reasonable security questions.

7. Personal Data Breaches

7.1 Notice. Vaktex will notify Customer of a Personal Data Breach without undue delay and in any event within 48 hours of confirming it. Vaktex will send the notice to the email address on Customer’s account and to any security contact Customer has given us.

7.2 Content. The notice will include, as far as it is then available, the information required by GDPR Article 33(3):

• the nature of the breach, including the categories and approximate number of Data Subjects and records concerned;
• a contact point for more information;
• the likely consequences of the breach; and
• the measures taken or proposed to address the breach and mitigate its effects.

Where information is not yet available, Vaktex will provide it in phases without further undue delay and will keep Customer updated as the investigation progresses.

7.3 Response. Vaktex will take reasonable steps to contain, investigate and remediate the breach, and will cooperate with Customer so it can meet its own obligations under GDPR Articles 33 and 34. Vaktex will not notify Supervisory Authorities or Data Subjects about a breach of Customer Personal Data on Customer’s behalf without Customer’s agreement, unless the law requires it.

7.4 No admission. Notifying or responding to a breach is not an acknowledgement of fault or liability.

8. Subprocessors

8.1 General authorization. Customer gives Vaktex general written authorization to engage Subprocessors. The current Subprocessors, their purposes, the data they process and their locations are listed at /legal/subprocessors, which forms Annex 4.

8.2 Subprocessor contracts. Vaktex will engage each Subprocessor under a written contract that imposes data protection obligations no less protective than those in this DPA, to the extent relevant to the service the Subprocessor provides. Vaktex remains fully liable to Customer for each Subprocessor’s performance of those obligations.

8.3 Notice of changes. Vaktex will give at least 30 days’ notice before a new Subprocessor begins processing Customer Personal Data. Notice is given by updating the Subprocessors page and by email to anyone who has subscribed to updates (by emailing support@vaktex.com with the subject “Subprocessor updates”). Paid and enterprise customers with a DPA also receive notice at their account email.

8.4 Objection. Customer may object to a new Subprocessor on reasonable data protection grounds by emailing support@vaktex.com within the 30-day notice period. The parties will work in good faith to resolve the objection, for example by Vaktex offering a way to use the Services without the new Subprocessor. If they cannot resolve it before the change takes effect, Customer may terminate the affected Service by written notice, and Vaktex will refund any prepaid fees for the remainder of the term for that Service, pro rata.

8.5 Emergency replacement. If Vaktex must replace a Subprocessor urgently for security or service continuity reasons, Vaktex may do so with notice as soon as practicable. Customer keeps the objection and termination rights in Section 8.4, with the 30-day period running from that notice.

8.6 AI model providers. AI model providers receive Customer Personal Data only when Customer or its users choose a model from that provider, or use a Service that relies on it. Each provider’s data retention is disclosed per model in the Gateway API model listing. Where the listing says so, the provider of a Preview Model may also train on Preview Model Content.

9. Data subject requests

9.1 Assistance. Taking into account the nature of processing, Vaktex will assist Customer, by appropriate technical and organizational measures, to respond to requests from Data Subjects to exercise their rights under Applicable Data Protection Law (access, rectification, erasure, restriction, portability and objection). Much of this is available directly in the Services, for example by deleting scans, assessments, Angrep projects, organization members or the account. Where Customer cannot fulfil a request itself, Vaktex will help at Customer’s request.

9.2 Requests sent to Vaktex. If Vaktex receives a request from a Data Subject that relates to Customer Personal Data, Vaktex will promptly forward it to Customer, unless the law prohibits it, and will not respond directly except to confirm that the request has been forwarded or as Customer instructs.

9.3 Cost. This assistance is provided at no additional charge, unless the requests Customer refers to Vaktex are manifestly unfounded or excessive, in which case Vaktex may charge reasonable costs agreed with Customer in advance.

10. DPIA and prior consultation

Taking into account the nature of processing and the information available to it, Vaktex will provide reasonable assistance to Customer with any data protection impact assessment and any prior consultation with a Supervisory Authority required by GDPR Articles 35 and 36, in each case relating to Vaktex’s processing of Customer Personal Data. This includes providing the information in this DPA, Annex 1 and Annex 2 and answering reasonable follow-up questions, at no additional charge.

11. International transfers

11.1 Locations. Vaktex is established in the United States and processes Customer Personal Data in the United States and in the locations listed for each Subprocessor in Annex 4. Customer may choose to run each sandbox in the United States or the European Union. With the default setting, a sandbox may run in either. Vaktex does not otherwise offer a choice of data region.

11.2 Transfers to Vaktex. Where a transfer of Customer Personal Data from Customer to Vaktex is a Restricted Transfer:

• From the EEA: the SCCs apply, using Module 2 (controller to processor) where Customer is a Controller and Module 3 (processor to processor) where Customer is a Processor.
• From the UK: the SCCs apply as amended by the UK Addendum, using Module 2 where Customer is a Controller and Module 3 where Customer is a Processor.
• From Switzerland: the SCCs apply with the adaptations for the FADP, using Module 2 or Module 3 on the same basis.

The SCCs, the UK Addendum and those adaptations are incorporated into this DPA by reference and completed as set out in Annex 3. Each party is treated as having signed them by agreeing to the Agreement.

11.3 Onward transfers. For transfers to Subprocessors outside the EEA, UK or Switzerland, Vaktex relies on the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework where the Subprocessor is certified, and otherwise on the SCCs or, for the UK, the UK Addendum.

11.4 Government access requests. If a government or public authority requests access to Customer Personal Data, Vaktex will:

• review the request for legal validity and challenge it where there are reasonable grounds to consider it unlawful, including by seeking interim measures to suspend its effect, and pursue available appeals;
• redirect the authority to request the data directly from Customer where possible;
• promptly notify Customer of the request, unless the law prohibits notice, in which case Vaktex will use reasonable efforts to obtain a waiver of the prohibition so it can share as much as possible, as soon as possible; and
• disclose only the minimum Customer Personal Data the law requires, based on a reasonable interpretation of the request.

These commitments supplement, and do not replace, Clause 15 of the SCCs.

11.5 Transfer impact assessments. Vaktex will provide the information Customer reasonably needs to carry out a transfer impact assessment under Clause 14 of the SCCs, including information about the laws that apply to Vaktex and its Subprocessors, the measures in Annex 2, and the commitments in Section 11.4. If Vaktex has reason to believe the laws that apply to it prevent it from complying with the SCCs, it will promptly tell Customer, and Customer may suspend the transfer and, if needed, terminate the affected Service with a pro-rata refund of prepaid fees.

12. Audits and information

12.1 Information. Vaktex will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA and GDPR Article 28.

12.2 Documentation first. On request, Vaktex will first provide its security documentation and answer Customer’s reasonable written security and privacy questionnaires.

12.3 Audits. If that information is not sufficient to demonstrate compliance, Customer, or an independent auditor it appoints who is bound by confidentiality and is not a Vaktex competitor, may conduct an on-site or remote audit, including inspections. Audits may take place once per year, and more often after a Personal Data Breach or where a Supervisory Authority requires it.

12.4 Conduct. Customer must give at least 30 days’ written notice with a proposed scope, and the parties will agree the scope, timing and duration in good faith. Audits will take place during business hours, will avoid unreasonable disruption to the Services, and will not require access to other customers’ data or information that would compromise Vaktex’s security.

12.5 Cost. Customer bears the cost of an audit, including its auditor’s fees, unless the audit reveals material non-compliance with this DPA. In that case Vaktex will bear its own costs and reimburse Customer’s reasonable audit costs, and will promptly remediate the non-compliance.

13. Return and deletion

13.1 Export. When the Agreement or a Service ends, Customer may export Customer Content from the Services for 30 days.

13.2 Deletion. After that export period, Vaktex will delete Customer Personal Data within 30 days. Backups are overwritten in their normal cycle and age out within 35 days. Deleted files may stay in the storage provider’s recovery store for up to 7 more days before they are permanently erased. Data that the Services delete sooner, under the retention periods in Annex 1, is not kept for the export period. Preview Model Content kept under Section 14.2 is deleted as that Section describes, not at the end of the Agreement.

13.3 Certification. On request, Vaktex will certify the deletion in writing.

13.4 Retention required by law. Vaktex may keep Customer Personal Data only where the law requires it, for no longer than the law requires. Vaktex will keep any retained data confidential, protect it under this DPA, and process it only for the purpose for which it is retained.

14. AI and model training

14.1 No training. Vaktex does not use Customer Personal Data or any other Customer Content to train, fine-tune or evaluate AI models, on any plan, except Preview Model Content under Section 14.2. No setting or opt-in program changes this for any other content. The optional product-improvement setting in the account covers only aggregated diagnostic and usage data, never Customer Content.

14.2 Preview Models. A Preview Model is a model marked “Preview” in the Gateway model listing and API, offered at a reduced rate because Vaktex keeps what is sent to it for training. The Gateway routes a request to a Preview Model only when Customer or its users name that model. Automatic model selection and the fallbacks of other models never choose one. For each such request, Vaktex keeps the messages, tool definitions, generation settings and output (“Preview Model Content”). Vaktex replaces the account identifier with a pseudonym before storing the content, stores it in Cloudflare R2 in the United States, restricts access to personnel who work on model training, and deletes it within 24 months. Vaktex also deletes it when the account is deleted, or sooner at Customer’s request. Vaktex uses Preview Model Content, as an independent Controller, to develop, train, fine-tune and evaluate AI models and to improve the Services. It does not sell Preview Model Content, publish it or make it available to other customers. Customer is responsible for having a lawful basis, and giving any notices required, for personal data it sends to a Preview Model. Customer must not send special categories of personal data or credentials to a Preview Model.

14.3 Subprocessors. Vaktex does not permit its Subprocessors to use Customer Personal Data to train their models, except that the provider of a Preview Model may train on Preview Model Content where the model listing says so. We use providers’ business and API terms, under which API inputs and outputs are not used to train their models by default.

14.4 Provider retention. Some AI model providers keep inputs and outputs for a limited period, for example for abuse monitoring. Unless a model is marked zero-retention, its provider may keep inputs and outputs for abuse monitoring, typically for 30 days (55 days for Google Gemini). Retention ranges from none to a maximum of 90 days, and is disclosed per model in the Gateway API model listing, so Customer can choose models that match its requirements.

14.5 Automated decisions. The Services produce security findings and recommendations for Customer to review. They do not make decisions about Data Subjects that produce legal or similarly significant effects.

15. US state privacy laws

15.1 Service provider. For Customer Personal Data subject to US State Privacy Laws, Vaktex is Customer’s “service provider”, “contractor” or “processor”, as those terms are defined in those laws. Customer discloses Customer Personal Data to Vaktex only for the limited and specified business purposes of providing, securing and supporting the Services.

15.2 Restrictions. Vaktex will not:

• sell or share (for cross-context behavioral advertising) Customer Personal Data;
• retain, use or disclose Customer Personal Data for any purpose other than the business purposes in Section 15.1, including for any commercial purpose other than providing the Services;
• retain, use or disclose Customer Personal Data outside the direct business relationship between Vaktex and Customer; or
• combine Customer Personal Data with personal information it receives from or on behalf of another person, or collects from its own interactions with the consumer, except as the US State Privacy Laws permit.

15.3 Compliance. Vaktex will comply with the US State Privacy Laws that apply to it as a service provider and give Customer Personal Data the level of privacy protection those laws require. Vaktex will notify Customer if it determines it can no longer meet those obligations. Customer may then take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

15.4 Oversight. Customer may take reasonable and appropriate steps to ensure that Vaktex uses Customer Personal Data consistently with Customer’s obligations, including through the audit rights in Section 12. Notice of new Subprocessors under Section 8 satisfies any requirement to notify Customer of, and let it object to, subcontractors.

15.5 Certification. Vaktex certifies that it understands and will comply with the restrictions in this Section 15.

15.6 Preview Model Content. Sections 15.1 to 15.5 do not apply to Preview Model Content. Customer sends it to Vaktex by its own choice, for Vaktex’s own use under Section 14.2, and Vaktex receives it as a business, not as Customer’s service provider. Customer is responsible for whether that disclosure is lawful under US State Privacy Laws, including any notice or opt-out those laws require.

16. Liability

Each party’s liability under or in connection with this DPA, including the SCCs, is subject to the limitations and exclusions of liability in the Agreement. Nothing in this DPA or the Agreement limits the rights of Data Subjects under the SCCs, including their third-party beneficiary rights and their rights against either party under Clause 12 of the SCCs, or any liability that cannot be limited under Applicable Data Protection Law.

17. Term, precedence and miscellaneous

17.1 Term. This DPA takes effect when the Agreement does and continues for as long as Vaktex processes Customer Personal Data, including after the Agreement ends.

17.2 Precedence. If there is a conflict, the following order applies, highest first: (a) the SCCs, including the UK Addendum and Swiss adaptations, for the Restricted Transfers they cover; (b) a written agreement signed by Vaktex and Customer, only where it expressly amends this DPA or the Terms of Service, and only to the extent of that amendment; (c) this DPA, for the processing of Customer Personal Data; (d) any order form; (e) the Terms of Service.

17.3 Changes. Vaktex may update this DPA to reflect changes in Applicable Data Protection Law, the Services or its Subprocessors, but will not materially reduce the protection of Customer Personal Data. Vaktex will give at least 30 days’ notice of material changes by updating this page and emailing paid customers. A countersigned copy of this DPA can be changed only by written agreement, except where a change is required by law. Vaktex may replace the SCCs or the UK Addendum with any successor version or other lawful transfer mechanism that gives at least the same protection.

17.4 Notices. Vaktex sends notices under this DPA to the email address on Customer’s account and to any security or privacy contact Customer provides. Customer sends notices to support@vaktex.com.

17.5 Governing law. This DPA is governed by the law that governs the Agreement, except that the SCCs are governed as set out in Annex 3.

17.6 Severability. If any provision of this DPA is found invalid or unenforceable, the rest of the DPA remains in effect.

Annex 1: Description of Processing

A. Parties

	Data exporter	Data importer
Name	Customer, as identified in the Agreement or the account	Vaktex, Inc.
Address	Customer’s address, as given in the Agreement or the account	131 Continental Dr, Suite 305, Newark, DE 19713, USA
Contact	Customer’s account email or nominated privacy contact	support@vaktex.com. Vaktex has not appointed a data protection officer because it is not required to.
Representatives	As appointed by Customer	Not yet appointed. Vaktex will name its EU and UK representatives on its Privacy Policy once appointed.
Activities	Use of the Services under the Agreement	Providing the Services under the Agreement
Role	Controller (Module 2) or Processor (Module 3)	Processor (Module 2) or Subprocessor (Module 3)

B. Common to all Services

Categories of Data Subjects. Customer’s personnel and contractors who use the Services; members of Customer’s organizations; authors and committers in Customer’s repositories, including collaborators outside Customer’s organization; and any individuals whose personal data appears incidentally in Customer Content, such as Customer’s own end users in code, logs, fixtures or test data, or individuals whose data appears in systems Customer is authorized to test.

Categories of personal data. Names, usernames, email addresses and roles; git author names and email addresses; identifiers, IP addresses and other technical data in code, logs and configuration; credentials and secrets that appear in code or transcripts; and any other personal data that appears incidentally in Customer Content.

Sensitive data. None is intended (see Section 3.6). Sensitive data may appear incidentally in Customer Content. Any such data is protected by the measures in Annex 2, the restriction on training in Section 14 and the retention limits below.

Frequency. Continuous, as initiated by Customer and its users through the Services.

Nature. Collection, storage, analysis by automated tools and AI models, transmission to Subprocessors, retrieval, and deletion, as needed to provide the Services.

Purpose. To provide, secure and support the Services under the Agreement and Customer’s instructions.

Duration. For the term of the Agreement and the export and deletion periods in Section 13, subject to the shorter retention periods below.

Transfers to Subprocessors. To the Subprocessors in Annex 4, for the purposes listed there.

C. Per Service

Service	Customer Personal Data processed	Nature and purpose	Retention
vaktex.com account dashboard	Organization member data: names, emails, roles, seats and access grants keyed by email, invitations	Managing Customer’s organizations, members, licences and keys	For the life of the account; deleted under Section 13
vScan Studio (self-hosted)	Licence key, instance id, a coarse non-identifying machine fingerprint, version, monthly token and request counts; if enabled, recipient emails and content of notification emails	Licence activation, heartbeats, usage counts and relaying notifications. Code stays on Customer’s infrastructure. Air-gapped mode disables activation and heartbeats.	For the life of the account; deleted under Section 13
vScan CLI and scans	Code snippets submitted for scanning, fixed code and model output, and any personal data they contain	Sending code to AI model providers for analysis and returning results; caching inputs and outputs to serve repeat results. Customer’s organization can turn response caching off.	Cached scan data no longer than 90 days, and earlier on request or on account or organization deletion
Vaktex AI Gateway	Prompts and completions from Customer’s agents, and any personal data they contain; usage metadata (tokens, requests, spend, model, timestamps, licence id)	Routing prompts and completions to the upstream model providers Customer chooses; metering and billing	Live session event log kept while the app is connected and erased about 5 minutes after it disconnects (up to about 10 minutes if a request was still running). Usage metadata for the life of the account and as needed for billing. Provider retention is shown per model in the Gateway API. Preview Model Content is kept by Vaktex as an independent Controller for up to 24 months (Section 14.2). Vaktex will disclose any transcript storage for other models before it begins.
Sandbox compute (Vex assessments)	Files and data the assessment reads and writes	Running assessments in ephemeral, single-tenant Google Compute Engine VMs with a maximum 12-hour lifetime; mirroring output files to Google Cloud Storage	VM local disk destroyed with the VM. Output files deleted within 30 days after the assessment ends, and on account deletion. Evidence for confirmed Angrep findings is kept with the finding.
Angrep	Assets, targets, findings and evidence files, and any personal data they contain	Planning and recording authorized penetration tests	For the life of the account or project; Customer can delete at any time
vScan cooked (under an organization)	Uploaded AI-assistant chat transcripts (Claude, Codex, Cursor session files) and any personal data they contain	Analyzing the last 30 days of transcripts; sending a compact digest, up to 8 truncated sample messages and secret-redacted snippets to Google Gemini; detecting pasted secrets to warn the user. At the user’s instruction, results are published at a public but unlisted link.	Raw transcripts no longer than 90 days. Results remain until the user deletes them or asks Vaktex to remove them; they are not removed automatically on account deletion.
whoami	Git history, including git author names and emails of the user and collaborators	Deriving a capability profile, visible to the user’s organization where linked	For the life of the account; deleted under Section 13

Annex 2: Technical and Organizational Measures

These are the measures Vaktex has in place. Vaktex does not currently hold third-party security certifications.

Encryption and pseudonymization

• All traffic to the Services uses TLS, with HSTS.
• Stored data is encrypted at rest by our infrastructure providers (Cloudflare, Google Cloud and Neon encrypt stored data by default).
• Provider API secrets are encrypted with AES-256-GCM, with a unique IV for each value.
• Server-side product events use a pseudonymous user id.

Ongoing confidentiality, integrity, availability and resilience

• Customer data is logically separated by account and organization in the database, with role-based permissions within organizations.
• Sandbox VMs are single-tenant and ephemeral, live for at most 12 hours, and are destroyed with their local disk after use.
• Cloudflare provides DDoS protection and Turnstile bot checks in front of the Services.

Restoring availability and access

• The managed database supports point-in-time restore, with backups kept for up to 35 days.

Testing and evaluating effectiveness

• Vaktex accepts vulnerability reports at support@vaktex.com and keeps dependencies up to date.

User identification and authorization

• Passwords must be 12 to 128 characters, are checked against known breached passwords using a k-anonymity range query (only the first 5 characters of the hash leave our systems), and are stored using a modern password hash.
• Email verification is required. One-time codes are hashed, expire after 10 minutes and allow 3 attempts.
• Inference API keys are stored only as a one-way hash and are shown to Customer once, when created.
• Sign-in and other sensitive endpoints are rate-limited, and banned accounts are blocked.
• Session cookies are Secure, HttpOnly and SameSite=Lax, and requests are checked against trusted origins to prevent cross-site request forgery.
• Service-to-service calls are authenticated with Google identity tokens and IAM; licences are signed; cloud permissions follow least privilege.
• Access to production systems is limited to authorized personnel.

Protection of data during transmission

• TLS for all traffic, with HSTS.
• Signed-in pages are served with private, no-store caching.

Protection of data during storage

• Encryption at rest by infrastructure providers, AES-256-GCM encryption of provider API secrets, and logical tenant separation, as above.

Physical security

• Vaktex does not operate its own data centers. Customer Personal Data is hosted by the infrastructure Subprocessors in Annex 4, which are responsible for the physical security of their facilities.

Event logging

• Security logs record IP address, user agent, request metadata, rate-limit counters and ban status.
• Audit logs record licence administration and sandbox control actions.

System configuration

• A strict Content Security Policy applies to the web application.
• Optional product-improvement and usage-metrics settings are off by default.

Data minimization

• Error monitoring strips user identity, request bodies and IP headers.
• vScan Studio sends only licence, heartbeat and usage-count data, and none in air-gapped mode.
• Customer’s organization can turn off scan response caching.
• vScan cooked sends only a digest, up to 8 truncated sample messages and secret-redacted snippets to the model provider.

Limited data retention

• Retention is limited as set out in Annex 1 and Section 13.

Data portability and erasure

• Customer can delete scans, assessments, Angrep projects, organization members and its account in the Services, and can export Customer Content under Section 13.

Personnel

• Personnel with access to Customer Personal Data are bound by confidentiality obligations (Section 5).

Subprocessors

• Subprocessors are bound by written data protection terms under Section 8. AI model providers are used under business and API terms, under which API inputs and outputs are not used to train their models by default. The only exception is the provider of a Preview Model, where the model listing says so (Section 14.3).

Annex 3: SCC and UK/Swiss elections

A. EU SCCs

Clause	Election
Modules	Module 2 where Customer is a Controller; Module 3 where Customer is a Processor
Clause 7 (Docking clause)	Applies. Additional entities may accede with the agreement of the parties.
Clause 8.9(c) and (d) (Audits)	Carried out as set out in Section 12
Clause 8.5 and 16(d) (Deletion)	Carried out as set out in Section 13; certification on request
Clause 9(a) (Subprocessors)	Option 2, general written authorization. Vaktex gives at least 30 days’ notice of additions or replacements, as set out in Section 8.
Clause 11(a) (Redress)	The optional independent dispute resolution language does not apply
Clause 13(a) (Supervision)	If Customer is established in an EU Member State: the supervisory authority of that Member State. If Customer is not established in the EU but has appointed a representative under GDPR Article 27(1): the supervisory authority of the Member State where the representative is established. If Customer is not established in the EU and has no representative: the supervisory authority of the Member State where the Data Subjects concerned are located, as Customer notifies to Vaktex.
Clause 17 (Governing law)	Option 1: the law of Ireland
Clause 18(b) (Forum)	The courts of Ireland
Annex I.A (Parties)	Annex 1, part A. Customer is the data exporter and Vaktex is the data importer.
Annex I.B (Description of transfer)	Annex 1, parts B and C
Annex I.C (Competent supervisory authority)	As determined under Clause 13 above
Annex II (Technical and organizational measures)	Annex 2
Annex III (List of subprocessors)	Not used, because Option 2 of Clause 9 applies. The current list is in Annex 4 for information.

B. UK Addendum

The SCCs, completed as in part A, apply to UK Restricted Transfers as amended by the UK Addendum, for both Module 2 and Module 3.

UK Addendum	Election
Table 1 (Parties)	Annex 1, part A. The start date is the date the Agreement takes effect.
Table 2 (Selected SCCs, modules and clauses)	The Approved EU SCCs, Modules 2 and 3, with the elections in part A (docking clause applies; Clause 9 Option 2 with 30 days’ notice; Clause 11 optional language not used)
Table 3 (Appendix information)	Annex 1 (parties and description), Annex 2 (technical and organizational measures) and Annex 4 (subprocessors)
Table 4 (Ending the Addendum)	Both the importer and the exporter may end the UK Addendum as allowed by its Section 19
Part 2 (Mandatory Clauses)	Apply. Under them, the SCCs are governed by the laws of England and Wales, disputes are resolved by the courts of England and Wales, and the Information Commissioner is the competent supervisory authority.

C. Switzerland

The SCCs, completed as in part A, apply to Swiss Restricted Transfers, for both Module 2 and Module 3, with these adaptations:

• The FDPIC is the competent supervisory authority under Clause 13 for transfers governed by the FADP. Where a transfer is governed by both the FADP and the GDPR, the FDPIC is competent for the FADP and the authority in part A for the GDPR.
• References to the GDPR are read as references to the FADP for transfers governed by the FADP.
• The term “Member State” in Clause 18(c) does not prevent Data Subjects whose habitual residence is in Switzerland from bringing claims in Switzerland.
• Clause 17 (Irish law) and Clause 18(b) (Irish courts) otherwise apply as in part A.

Annex 4: Subprocessors

Vaktex’s Subprocessors, with their purposes, the data they process and their locations, are listed at /legal/subprocessors. That page is incorporated into this DPA as Annex 4 and is updated as set out in Section 8.

Signature (optional)

This DPA applies without a signature. Customers who want a countersigned copy can complete this block and send it to support@vaktex.com.

	Vaktex, Inc.	Customer
Legal name	Vaktex, Inc.
Address	131 Continental Dr, Suite 305, Newark, DE 19713, USA
Signature
Name
Title
Date
Privacy contact	support@vaktex.com