Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the service agreement ("Agreement") between the entity identified as the client ("Controller") and All Seeing Eye ("ASE", "Processor"), governing the processing of personal data in connection with the ASE autonomous AI penetration testing service.

This DPA applies to all processing of personal data by ASE on behalf of the Controller under the Agreement, and supplements any applicable data protection terms therein.

1. Definitions

For the purposes of this DPA, the following terms apply:

  • "Applicable Data Protection Law" means all applicable laws and regulations relating to the processing of personal data, including (where applicable) the General Data Protection Regulation (EU 2016/679) ("GDPR"), the California Consumer Privacy Act ("CCPA/CPRA"), the Lei Geral de Proteção de Dados ("LGPD"), the Ley Orgánica de Protección de Datos y Garantía de los Derechos Digitales ("LOPDGDD"), and the Ley 25.326 de Protección de Datos Personales of Argentina.
  • "Controller" means the entity that determines the purposes and means of the processing of personal data, as identified in the Agreement.
  • "Data Subject" means an identified or identifiable natural person whose personal data is processed.
  • "Personal Data" means any information relating to an identified or identifiable natural person that is processed by the Processor on behalf of the Controller in connection with the Services.
  • "Processing" means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.
  • "Processor" means All Seeing Eye (ASE), which processes personal data on behalf of the Controller.
  • "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data processed by the Processor.
  • "Services" means the autonomous AI penetration testing services provided by ASE under the Agreement.
  • "Sub-processor" means any third party engaged by the Processor to process personal data on behalf of the Controller.

2. Scope and Purpose of Processing

The Processor shall process personal data only to the extent necessary to provide the Services as described in the Agreement and as further specified in this DPA. The purpose of processing is the delivery of autonomous AI-powered penetration testing services, including target enumeration, vulnerability identification, finding validation, evidence collection, and report generation.

The Processor shall not process personal data for any purpose other than providing the Services, unless required to do so by applicable law. In such case, the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest.

The nature of processing includes automated scanning, analysis of network responses, collection of assessment evidence, and generation of security findings reports. Processing is carried out on dedicated, single-tenant compute instances assigned exclusively to the Controller.

3. Data Categories and Data Subjects

3.1 Categories of personal data

Category Data Elements Purpose Retention
Account Data Name, email address, company name Authentication, billing, support Duration of account + 30 days
Target Data URLs, domains, IP addresses provided by the Controller Scope definition for assessment Duration of assessment only
Assessment Data Findings, evidence, proofs of concept, execution logs Report generation and vulnerability validation Encrypted at rest (AES-256-GCM) until client download, then purged. Retention window: 72 hours (default). The Controller retains the authoritative copy on their own infrastructure via the local agent
Incidental Credentials Tokens, API keys, credentials discovered during testing Finding documentation Auto-redacted in logs; only hashed references retained
Usage Data Assessment count, execution duration Billing, platform health monitoring Aggregated and anonymized after 90 days

3.2 Categories of data subjects

Data subjects may include:

  • Authorized representatives and employees of the Controller
  • End users of the Controller's systems whose data may be incidentally encountered during authorized penetration testing
  • Third parties whose personal data may be incidentally present in the target systems being assessed

4. Obligations of the Controller

The Controller shall:

  • Ensure that it has obtained all necessary authorizations and legal bases for the processing of personal data as described in this DPA, including valid authorization to conduct penetration testing on the target systems.
  • Provide the Processor with documented instructions regarding the processing of personal data, including defining the scope of each assessment.
  • Ensure that the personal data provided to the Processor is accurate and, where necessary, kept up to date.
  • Inform the Processor without undue delay of any changes to applicable data protection laws that may affect the Processor's obligations under this DPA.
  • Comply with its obligations under applicable data protection laws with respect to the personal data processed under this DPA.

5. Obligations of the Processor

The Processor shall:

  • Process personal data only on documented instructions from the Controller, including with regard to transfers of personal data outside the European Economic Area, unless required to do so by applicable law.
  • Ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
  • Implement and maintain appropriate technical and organizational security measures as described in Section 8 of this DPA.
  • Not engage another processor (sub-processor) without prior written authorization of the Controller, subject to the conditions set out in Section 6.
  • Assist the Controller, taking into account the nature of processing, in responding to requests from data subjects exercising their rights under applicable data protection law.
  • Assist the Controller in ensuring compliance with its obligations regarding security of processing, notification of security incidents, data protection impact assessments, and prior consultation with supervisory authorities.
  • At the choice of the Controller, delete or return all personal data to the Controller after the end of the provision of Services, and delete existing copies unless applicable law requires storage of the personal data.
  • Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.
  • Not use personal data processed on behalf of the Controller for the purposes of training, fine-tuning, or improving AI models. This is a contractual commitment enforceable under this DPA.

6. Sub-processing

6.1 Authorization

The Controller provides general written authorization for the Processor to engage sub-processors, subject to the conditions set out in this Section. The Processor shall maintain a current list of sub-processors, which is available to the Controller upon request and is published at ase.run/subprocessors.

6.2 Notification of changes

The Processor shall notify the Controller in writing at least 30 days before engaging any new sub-processor or replacing an existing sub-processor. The notification shall include the identity of the sub-processor, the nature of the processing to be carried out, and the location of processing.

6.3 Right to object

The Controller may object to the engagement of a new sub-processor within 15 days of receiving notification. If the Controller raises a reasonable objection, the Processor shall make reasonable efforts to provide an alternative solution that avoids the use of the objected-to sub-processor. If no alternative is available and the objection is not resolved, either party may terminate the affected Services.

6.4 Sub-processor obligations

The Processor shall impose on each sub-processor, by way of a written contract, data protection obligations no less protective than those set out in this DPA. The Processor shall remain fully liable to the Controller for the performance of each sub-processor's obligations.

7. Data Transfers

The Processor shall not transfer personal data to a country outside the European Economic Area ("EEA") or to an international organization unless one of the following conditions is met:

  • The European Commission has issued an adequacy decision for the recipient country or territory.
  • Appropriate safeguards have been provided, such as Standard Contractual Clauses approved by the European Commission, binding corporate rules, or an approved certification mechanism.
  • A derogation under Article 49 of the GDPR applies.

Where transfers are made on the basis of Standard Contractual Clauses, such clauses are incorporated by reference into this DPA. The Processor shall conduct a transfer impact assessment where required and implement supplementary measures as necessary to ensure an equivalent level of data protection.

The Processor operates on a dedicated-instance model. Each Controller is provisioned a single-tenant server instance. A local agent installed on the Controller's infrastructure downloads and stores assessment results locally, ensuring the Controller retains custody of their own data. Server-side assessment data is purged after download or after the retention window expires (default: 72 hours).

8. Security Measures

The Processor shall implement and maintain appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage. These measures include, at a minimum:

8.1 Infrastructure security

  • Dedicated, single-tenant compute instances with static IP addresses assigned per Controller
  • No shared infrastructure between Controllers (isolation enforced at the infrastructure level)
  • Hosting on infrastructure backed by SOC 2 Type II certification
  • Least-privilege IAM with scoped, short-lived credentials and no static access keys
  • Network isolation per instance with restricted ingress and egress

8.2 Encryption

  • All data encrypted at rest using AES-256-GCM
  • All data encrypted in transit using TLS 1.3
  • Key management with regular rotation following industry best practices

8.3 Data minimization and sanitization

  • Automatic redaction of credentials, API keys, tokens, and personally identifiable information discovered during assessments
  • Only hashed references retained for finding verification
  • Credentials, PII, and target-specific data automatically redacted from internal storage
  • Assessment data purged after client download or after the retention window expires (default: 72 hours)

8.4 Access controls

  • API key-based authentication for client connections
  • No cross-client data sharing or access
  • Personnel access to personal data limited to those with a documented need
  • All personnel with access bound by confidentiality obligations

8.5 Monitoring and detection

  • Threat detection and runtime monitoring across all infrastructure
  • Anomalous behavior triggers automated alerts and instance isolation

9. Data Breach Notification

9.1 Notification to Controller

The Processor shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting personal data processed under this DPA. The notification shall include:

  • A description of the nature of the Security Incident, including (where possible) the categories and approximate number of data subjects and personal data records concerned
  • The name and contact details of the Processor's data protection contact point
  • A description of the likely consequences of the Security Incident
  • A description of the measures taken or proposed to be taken to address the Security Incident, including measures to mitigate its possible adverse effects

9.2 Cooperation

The Processor shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the Security Incident. The Processor shall preserve evidence related to the Security Incident in a quarantined environment for forensic analysis.

9.3 Documentation

The Processor shall document all Security Incidents, including the facts relating to the incident, its effects, and the remedial actions taken. A post-incident report shall be provided to the Controller upon request.

10. Data Subject Rights Assistance

The Processor shall assist the Controller in fulfilling its obligations to respond to requests from data subjects exercising their rights under applicable data protection law. These rights include:

  • Access: The right to obtain confirmation of whether personal data is being processed and, if so, to access the personal data and related information.
  • Rectification: The right to have inaccurate personal data corrected and incomplete personal data completed.
  • Erasure: The right to have personal data erased under the conditions specified in applicable law.
  • Restriction: The right to restrict the processing of personal data under the conditions specified in applicable law.
  • Portability: The right to receive personal data in a structured, commonly used, and machine-readable format.
  • Objection: The right to object to processing of personal data, including the right to opt out of anonymized usage analytics.

The Processor shall promptly inform the Controller if it receives a request directly from a data subject and shall not respond to such request except on the Controller's documented instructions or as required by applicable law.

11. Audit Rights

The Processor shall make available to the Controller, upon written request, information reasonably necessary to demonstrate compliance with this DPA. Audit arrangements, including scope, timing, and confidentiality, shall be agreed between the parties in advance.

12. Data Return and Deletion

12.1 On termination

Upon termination or expiration of the Agreement, or upon the Controller's written request, the Processor shall:

  • Return all personal data to the Controller in a structured, commonly used, and machine-readable format, or
  • Delete all personal data and existing copies, unless applicable law requires continued storage

The Controller shall make its choice known within 30 days of termination. If no instruction is received within this period, the Processor shall delete all personal data.

12.2 Assessment data

Assessment data on the Processor's dedicated server is encrypted at rest (AES-256-GCM) with per-Controller keys. Reports are automatically purged from the server after download by the local agent or after the retention window expires (default: 72 hours). The Controller retains the authoritative copy of all reports on their own infrastructure and is responsible for storing and managing their own data.

12.3 Certification of deletion

The Processor shall, upon request, provide the Controller with written certification that all personal data has been deleted in accordance with this Section. Deletion is cryptographic and verified.

13. Term and Termination

13.1 Duration

This DPA shall remain in effect for as long as the Processor processes personal data on behalf of the Controller under the Agreement. It shall automatically terminate upon the termination or expiration of the Agreement, subject to the Processor's obligations regarding return and deletion of personal data as set out in Section 12.

13.2 Survival

The provisions of this DPA relating to confidentiality, data return and deletion, audit rights, and liability shall survive the termination or expiration of this DPA.

14. Liability

14.1 Allocation

Each party shall be liable for damages caused by processing that infringes applicable data protection law. The Processor shall be liable for damages caused by processing only where it has not complied with obligations specifically directed to processors under applicable law, or where it has acted outside of or contrary to the lawful instructions of the Controller.

14.2 Limitation

Any limitations or exclusions of liability set out in the Agreement shall apply to claims under this DPA, to the extent permitted by applicable data protection law. Nothing in this DPA shall limit either party's liability for damages arising from violations of applicable data protection law where such limitation is prohibited by that law.

14.3 Indemnification

Each party shall indemnify the other party for any damages, costs, and expenses (including reasonable legal fees) arising from a breach of this DPA by the indemnifying party, subject to the limitations set out in the Agreement.

Contact

For questions or requests related to this DPA, contact the Processor's data protection team at security@ase.run.

For the current list of sub-processors, see Sub-processor List.