Data Processing Agreement

This Data Processing Agreement ("DPA") governs the Processing of Personal Data by Antanox ("Processor") on behalf of the Customer ("Controller") in connection with the Orithos AI Security Scanning Platform. It forms part of the Terms of Service and, where executed, the Master Subscription Agreement. On conflict concerning data protection, this DPA prevails.

1. Definitions

"Personal Data", "Processing", "Controller", "Processor", "Data Subject", and "Personal Data Breach" have the meanings in the EU GDPR; equivalent terms in the UK GDPR and India's DPDP Act 2023 apply in their territories. "Data Protection Law" means all applicable data-protection regimes, including EU GDPR, UK GDPR, India DPDP Act 2023, and US state privacy laws (including CCPA/CPRA) to the extent applicable.

2. Scope and roles

The Customer determines the purposes and means of Processing Customer Personal Data submitted through agent configurations and scan traffic (Controller). Antanox Processes it solely to provide the Service, as documented in this DPA and the Customer's configured instructions (scan settings, retention mode, API calls).

3. Details of Processing

• Subject matter: AI agent security scanning, verdict evaluation, findings and compliance reporting.
• Duration: the subscription term plus 30 days for deletion/return.
• Data Subjects: the Customer's personnel configuring scans; end users or third parties whose personal data appears in Customer-provided system prompts, tool schemas, RAG sources, or agent responses.
• Categories of Personal Data: account emails; identifiers in agent configurations; personal data contained in or inferable from probe interactions and agent responses (which may include names, contact details, credentials, or other sensitive content the Customer's agent discloses during testing); billing contact details.
• Special-category / sensitive data: not intentionally solicited. Scans may surface it where the Customer's agent discloses it; the Customer warrants a lawful basis for submitting configurations that may elicit such disclosures, and may use Zero-Knowledge mode to prevent persistence.

4. Processor obligations (GDPR Art. 28)

• Instructions: Process Personal Data only on documented Controller instructions (including transfers), unless required by law — in which case Antanox informs the Controller beforehand where lawful. Antanox will alert the Controller if an instruction appears to infringe Data Protection Law.
• Confidentiality: all personnel with access are bound by confidentiality obligations; access follows least-privilege RBAC.
• Assistance: assist with Data Subject requests, breach notifications, DPIAs, and prior consultations, considering the nature of Processing and information available.
• Records: maintain Article 30(2) processing records and make them available to the Controller on request.
• No training use: Customer Personal Data is never used to train machine-learning models.

5. Technical and organisational measures

• Encryption in transit: TLS 1.3 on all endpoints.
• Encryption at rest: AES-256 for database storage; API keys bcrypt-hashed; agent credentials Fernet-encrypted.
• Per-organisation data isolation enforced at the database layer; role-based access control; immutable audit logging of access and configuration changes.
• Per-route rate limiting; session cookies HttpOnly; no advertising trackers.
• Retention automation: tiered windows (Free 14 days, Starter 90 days, Team and above 365 days, custom windows on Business+), export-then-purge with fail-open semantics, and a Zero-Knowledge mode in which traces are never stored.
• Vulnerability handling: suspected platform vulnerabilities treated as highest-priority incidents; security reports to [email protected].

6. Subprocessors

Antanox engages the following subprocessors. The Customer gives general authorisation; Antanox will notify the Customer of intended changes at least 30 days in advance, and the Customer may object on reasonable data-protection grounds, in which case the parties will work in good faith to recommend an alternative or the Customer may terminate the affected services:

• Infrastructure hosting — dedicated virtual private servers, European Union (application, database, cache).
• Dodo Payments — subscription and credit-pack billing (billing contact details only).
• LLM evaluation gateway — judge-model inference (default: DeepSeek models; configurable per deployment). Probe payloads and agent responses transit this gateway for verdict evaluation at sampling temperature 0.
• PostHog — pseudonymised product analytics.
• Resend — transactional email delivery.
• Sentry — error diagnostics (identifiers stripped where possible).
• GitHub / Google — OAuth sign-in (email address only).

7. International transfers

Primary hosting is in the European Union; Antanox operates from India; some subprocessors process data in the United States. Where EU/UK GDPR applies, transfers outside the EEA/UK rely on an adequacy decision or the EU Standard Contractual Clauses (2021/914, Module 2) with the UK Addendum, plus transfer risk assessments. Equivalent safeguards apply under India DPDP Act transfer rules and other regimes as applicable.

8. Personal Data Breaches

Antanox will notify the Controller without undue delay and no later than 72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data, with the nature, categories and approximate numbers affected, likely consequences, and mitigation measures — updated as investigation proceeds. The Controller remains responsible for notifications to authorities and Data Subjects.

9. Audit rights

Antanox will make available information necessary to demonstrate compliance and allow audits: a written security summary and questionnaire responses annually on request; targeted remote audits for substantiated concerns; on-site audits for Enterprise customers with 30 days' notice, during business hours, at Customer expense, no more than once per year absent a breach.

10. Return and deletion

During the term, the Customer can export scan data at any time (evidence packs, CSV). Within 30 days after termination, Antanox deletes Customer Personal Data and existing copies, except where law requires retention (in which case it is isolated and protected until lawful deletion). Expiry-based deletion follows the configured retention schedule automatically.

11. Liability and term

Liability under this DPA is subject to the Master Subscription Agreement or, absent one, the Terms of Service liability provisions. This DPA takes effect on first Processing and survives termination for as long as Customer Personal Data is retained.

12. Contact

Data protection questions: [email protected]. Privacy requests: [email protected]. This page is the authoritative text; a countersigned PDF is available on request for Enterprise customers.