Data Processing Agreement

Last Updated: March 25, 2026

Data Processing Agreement

Aribot — Cloud Security & Compliance Platform

Effective Date: [EFFECTIVE DATE]

Last Updated: [EFFECTIVE DATE]

This Data Processing Agreement ("DPA") forms part of the agreement between:

Data Controller: The entity identified in the applicable SaaS License Agreement or Order Form ("Controller" or "Customer")

and

Data Processor: Aristiun Samsad B.V., a company incorporated under the laws of the Netherlands ("Processor" or "Aristiun")

collectively referred to as the "Parties."

This DPA supplements and is incorporated into the SaaS License Agreement, Terms of Service, and any Order Form between the Parties (collectively, the "Principal Agreement") and governs the Processor's processing of Personal Data on behalf of the Controller in connection with the Aribot cloud security and compliance platform ("Platform").

1. Definitions

For the purposes of this DPA, the following terms have the meanings set out below. Terms not defined herein have the meanings given in the GDPR or the Principal Agreement.

1.1. "Applicable Data Protection Law" means the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Dutch Implementation Act (Uitvoeringswet AVG, "UAVG"), and any other applicable data protection legislation.

1.2. "Controller" means the natural or legal person which determines the purposes and means of the processing of Personal Data, as defined in Article 4(7) GDPR.

1.3. "Data Subject" means an identified or identifiable natural person whose Personal Data is processed under this DPA.

1.4. "EEA" means the European Economic Area.

1.5. "Personal Data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.

1.6. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed, as defined in Article 4(12) GDPR.

1.7. "Processing" means any operation or set of operations performed on Personal Data, as defined in Article 4(2) GDPR.

1.8. "Processor" means a natural or legal person which processes Personal Data on behalf of the Controller, as defined in Article 4(8) GDPR.

1.9. "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.

1.10. "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission (Implementing Decision (EU) 2021/914).

1.11. "Supervisory Authority" means an independent public authority established by an EU Member State pursuant to Article 51 GDPR.

2. Scope and Purpose of Processing

2.1. Scope. This DPA applies to all Processing of Personal Data by the Processor on behalf of the Controller in connection with the provision of the Platform and Services under the Principal Agreement.

2.2. Purpose. The Processor processes Personal Data solely for the following purposes:

  • Providing the Platform and Services as described in the Principal Agreement;
  • Cloud security posture scanning and analysis;
  • Threat modeling and security assessment;
  • Compliance scanning and reporting (including ISO 27001, PCI DSS, SOC 2, NIST);
  • Code security review and analysis;
  • Shadow AI Discovery;
  • AI-powered security analysis and report generation;
  • User authentication and access management;
  • Customer support and communication;
  • Platform maintenance, monitoring, and improvement.

2.3. Documented Instructions. The Processor shall process Personal Data only on documented instructions from the Controller, including transfers to a third country, unless required by EU or Member State law. The Principal Agreement and this DPA constitute the Controller's initial documented instructions. Additional instructions must be provided in writing.

3. Duration

3.1. This DPA is effective from the Effective Date and remains in force for the duration of the Principal Agreement ("Term").

3.2. The Processor's obligations regarding Personal Data shall continue until all Personal Data has been deleted or returned in accordance with Section 12.

4. Nature of Processing

4.1. Operations. The nature of Processing includes:

  • Collection and storage of account and authentication data;
  • Transmission and analysis of cloud infrastructure metadata;
  • Processing of code snippets for security analysis (with automated secret stripping);
  • Processing of network traffic metadata for Shadow AI detection;
  • AI-assisted analysis of security patterns and compliance posture;
  • Generation of security reports, threat assessments, and compliance findings;
  • Storage and retrieval of scan results and historical data;
  • Log collection and analysis for platform operations.

5. Categories of Data Subjects

5.1. Personal Data processed under this DPA may relate to the following categories of Data Subjects:

  • Customer employees: Users of the Platform with account credentials;
  • Customer contractors and consultants: Third parties granted access by the Customer;
  • Customer end-users: Individuals whose data may appear in cloud resource metadata, code comments, or configuration files processed by the Platform;
  • Customer contacts: Individuals whose contact information is provided for billing, support, or administrative purposes.

6. Types of Personal Data

6.1. The following types of Personal Data may be processed:

  • Identifiers: Email addresses, usernames, full names, user IDs;
  • Authentication data: Hashed passwords, session tokens, multi-factor authentication data;
  • Contact information: Phone numbers, business addresses;
  • Professional information: Job titles, roles, department, company name;
  • Technical identifiers: IP addresses, browser fingerprints, device information;
  • Cloud resource metadata: Resource names, tags, and configurations that may incidentally contain personal data (e.g., resource names containing usernames);
  • Usage data: Feature usage, session times, navigation patterns;
  • Communication data: Support ticket contents, feedback.

6.2. Special Categories. The Processor does not intentionally process special categories of Personal Data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR). If such data is incidentally present in Customer Data, the Controller is responsible for ensuring a lawful basis for its processing.

7. Processor Obligations

7.1. Processing Instructions

The Processor shall:

  • Process Personal Data only on documented instructions from the Controller (Article 28(3)(a) GDPR);
  • Immediately inform the Controller if, in the Processor's opinion, an instruction infringes Applicable Data Protection Law (Article 28(3) GDPR);
  • Not process Personal Data for any purpose other than those set out in this DPA without the Controller's prior written consent.

7.2. Confidentiality

The Processor shall:

  • Ensure that all persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Article 28(3)(b) GDPR);
  • Limit access to Personal Data to personnel who require access for the performance of the Services.

7.3. Security Measures (Article 32 GDPR)

The Processor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as detailed in Annex 1 to this DPA. These measures include, at minimum:

  • Encryption of Personal Data at rest and in transit;
  • Measures to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems;
  • The ability to restore availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
  • Regular testing, assessing, and evaluating the effectiveness of security measures.

7.4. Assistance with Data Subject Rights (Articles 15-22 GDPR)

The Processor shall:

  • Assist the Controller in fulfilling its obligation to respond to Data Subject requests exercising their rights under the GDPR (access, rectification, erasure, portability, objection, restriction);
  • Promptly forward any Data Subject request received directly by the Processor to the Controller;
  • Provide the Controller with tools and capabilities within the Platform to facilitate Data Subject rights fulfillment;
  • Provide assistance within ten (10) business days of the Controller's request.

7.5. Assistance with Compliance Obligations

The Processor shall assist the Controller in ensuring compliance with:

  • Security of processing (Article 32 GDPR);
  • Notification of Personal Data Breaches to the Supervisory Authority (Article 33 GDPR);
  • Communication of Personal Data Breaches to Data Subjects (Article 34 GDPR);
  • Data protection impact assessments (Article 35 GDPR);
  • Prior consultation with the Supervisory Authority (Article 36 GDPR).

7.6. Personal Data Breach Notification

The Processor shall:

  • Notify the Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach (Article 33(2) GDPR);
  • Provide the Controller with the following information:
    • A description of the nature of the breach, including categories and approximate number of Data Subjects and data records concerned;
    • The name and contact details of the Processor's data protection contact;
    • A description of the likely consequences of the breach;
    • A description of the measures taken or proposed to address the breach and mitigate its effects;
  • Cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach;
  • Document all Personal Data Breaches, including the facts, effects, and remedial actions taken (Article 33(5) GDPR).

7.7. Deletion and Return of Personal Data

Upon termination or expiration of the Principal Agreement, the Processor shall, at the Controller's election:

  • Return all Personal Data to the Controller in a structured, commonly used, machine-readable format; or
  • Delete all Personal Data and certify such deletion in writing.

The Controller must make its election within thirty (30) days of termination ("Export Window"). If no election is made, the Processor shall delete all Personal Data within ninety (90) days of termination. The Processor may retain Personal Data to the extent required by applicable law, subject to continued compliance with this DPA.

8. Sub-processors

8.1. General Authorization

The Controller grants the Processor general written authorization to engage Sub-processors for the processing of Personal Data, subject to the conditions in this Section 8.

8.2. Current Sub-processors

The Processor's current Sub-processors as of the Effective Date are:

| Sub-processor | Purpose | Location | Data Processed | |--------------|---------|----------|----------------| | Google Cloud Platform (Google LLC) | Infrastructure hosting, storage, compute | United States (us-central1) | All Customer Data | | Stripe, Inc. | Payment processing and billing | United States | Billing data (name, email, payment method) | | Google (Vertex AI / Gemini) | AI-powered security analysis | United States | Code patterns, architecture metadata (no secrets) | | Anthropic PBC | AI-powered security analysis | United States | Code patterns, architecture metadata (no secrets) | | xAI Corp. | AI-powered security analysis | United States | Code patterns, architecture metadata (no secrets) | | OpenAI, Inc. | AI-powered security analysis | United States | Code patterns, architecture metadata (no secrets) |

8.3. AI Sub-processor Safeguards

For AI analysis Sub-processors, the Processor ensures:

  • Customer Data is not used for model training (contractually guaranteed);
  • Data is not retained beyond the duration of processing the request;
  • Secrets, credentials, and API keys are automatically stripped before transmission;
  • Customer PII is not intentionally included in AI requests;
  • Data is encrypted in transit using TLS 1.2+.

8.4. Notification of Changes

The Processor shall notify the Controller in writing at least thirty (30) days before engaging a new Sub-processor or replacing an existing Sub-processor, specifying the name, location, and processing activities of the proposed Sub-processor.

8.5. Right to Object

The Controller may object to the engagement of a new Sub-processor on reasonable grounds within fifteen (15) days of receiving notice. If the Controller objects:

  • The Parties shall negotiate in good faith to resolve the objection;
  • If the objection cannot be resolved, the Controller may terminate the Principal Agreement and this DPA with respect to the Services requiring the objected Sub-processor, with a pro-rata refund of prepaid fees for the unused portion of the Subscription Term.

8.6. Sub-processor Obligations

The Processor shall:

  • Enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those in this DPA;
  • Remain fully liable to the Controller for the performance of each Sub-processor's obligations;
  • Conduct due diligence on Sub-processors' data protection practices before engagement and periodically thereafter.

9. International Data Transfers

9.1. Transfer Mechanism. To the extent that the processing of Personal Data involves a transfer outside the EEA to a country that has not received an adequacy decision from the European Commission, the Parties agree to the following transfer mechanisms:

(a) Standard Contractual Clauses (Module 2: Controller-to-Processor) as adopted by the European Commission (Implementing Decision (EU) 2021/914), which are incorporated by reference into this DPA;

(b) EU-U.S. Data Privacy Framework for transfers to U.S.-based Sub-processors that are certified under the Framework;

(c) Adequacy Decisions where the European Commission has recognized a third country as providing an adequate level of protection.

9.2. Supplementary Measures. In addition to the transfer mechanisms above, the Processor implements the following supplementary measures:

  • Encryption of Personal Data at rest (AES-256) and in transit (TLS 1.2+);
  • Access controls limiting data access to authorized personnel;
  • Contractual commitments from Sub-processors not to assist government surveillance requests beyond legal obligations;
  • Regular assessment of the legal framework of countries where Sub-processors operate.

9.3. Transfer Impact Assessment. The Processor has conducted a transfer impact assessment for each Sub-processor located outside the EEA and will make the results available to the Controller upon request.

10. Audit Rights

10.1. Controller Audit Right. The Controller has the right to audit the Processor's compliance with this DPA, in accordance with Article 28(3)(h) GDPR.

10.2. Audit Process. Audits shall be:

  • Conducted no more than once per twelve (12) month period, unless required by a Supervisory Authority or in the event of a Personal Data Breach;
  • Initiated with at least thirty (30) days' prior written notice;
  • Conducted during normal business hours;
  • Designed not to unreasonably disrupt the Processor's operations;
  • Subject to reasonable confidentiality obligations regarding the Processor's proprietary information.

10.3. Information and Cooperation. The Processor shall:

  • Make available to the Controller all information necessary to demonstrate compliance with the obligations in Article 28 GDPR;
  • Allow for and contribute to audits, including inspections, conducted by the Controller or an independent auditor mandated by the Controller;
  • Provide access to relevant facilities, systems, and personnel.

10.4. Third-Party Audits. The Controller may elect to have audits conducted by an independent third-party auditor, subject to the auditor executing a confidentiality agreement acceptable to the Processor.

10.5. Certification. The Processor may satisfy audit requests by providing relevant certifications, audit reports (such as SOC 2 Type II reports), or attestations from independent auditors, provided they adequately address the Controller's audit objectives.

11. Liability

11.1. Allocation. Each Party's liability under this DPA is subject to the limitations of liability set out in the Principal Agreement, except to the extent that Applicable Data Protection Law requires otherwise.

11.2. Regulatory Fines. To the extent permitted by applicable law, each Party shall be responsible for administrative fines imposed on it by a Supervisory Authority to the extent such fines are attributable to that Party's breach of its obligations under this DPA or Applicable Data Protection Law.

11.3. Third-Party Claims. If a Data Subject or third party brings a claim against one Party for a breach attributable to the other Party, the responsible Party shall indemnify the other Party for any costs, damages, and expenses arising from such claim, subject to the liability limitations in the Principal Agreement.

12. Term and Termination

12.1. Co-terminus. This DPA commences on the Effective Date and remains in force for the duration of the Principal Agreement.

12.2. Survival. The Processor's obligations under Sections 7.6 (Breach Notification), 7.7 (Deletion/Return), 8.6 (Sub-processor Obligations), 10 (Audit Rights), and 11 (Liability) survive termination of this DPA until all Personal Data has been deleted or returned.

12.3. Termination for Breach. If the Processor materially breaches this DPA and fails to cure within thirty (30) days of written notice, the Controller may terminate the Principal Agreement and this DPA.

13. Miscellaneous

13.1. Conflict. In the event of a conflict between this DPA and the Principal Agreement, this DPA shall prevail with respect to the processing of Personal Data.

13.2. Governing Law. This DPA is governed by the laws of the Netherlands, without regard to conflict of law principles.

13.3. Amendments. This DPA may be amended only by written agreement signed by both Parties.

13.4. Severability. If any provision of this DPA is held invalid, the remaining provisions remain in full force and effect.

Annex 1: Technical and Organizational Measures (Article 32 GDPR)

The Processor implements the following technical and organizational measures to protect Personal Data:

A1. Encryption

| Measure | Implementation | |---------|---------------| | Encryption at rest | AES-256 encryption for all stored data via Google Cloud default encryption and Cloud KMS | | Encryption in transit | TLS 1.2+ for all data transmissions; HSTS enforced | | Key management | Google Cloud KMS with automatic key rotation | | Database encryption | Transparent Data Encryption (TDE) on all database instances |

A2. Access Control

| Measure | Implementation | |---------|---------------| | Authentication | Multi-factor authentication support; JWT-based session management | | Authorization | Role-based access control (RBAC) with five permission levels (Owner, Security Manager, BU Head, Developer, Reader) | | Principle of least privilege | Access granted only to personnel with a demonstrated business need | | Password policy | Minimum complexity requirements; hashed storage (bcrypt) | | Session management | Automatic session expiration; CSRF protection | | Administrative access | Restricted to designated personnel; logged and monitored |

A3. Logging and Monitoring

| Measure | Implementation | |---------|---------------| | Audit logging | All administrative actions, data access, and configuration changes logged | | Log retention | Application logs retained for 30 days | | Intrusion detection | 24/7 infrastructure monitoring via Google Cloud Security Command Center | | Alerting | Automated alerts for anomalous access patterns and security events |

A4. Incident Response

| Measure | Implementation | |---------|---------------| | Incident response plan | Documented procedures for identification, containment, eradication, recovery, and lessons learned | | Breach notification | 72-hour notification capability as required by GDPR | | Incident team | Designated security incident response team | | Post-incident review | Mandatory review and remediation after each incident |

A5. Backup and Recovery

| Measure | Implementation | |---------|---------------| | Backups | Automated daily backups of all data stores | | Backup encryption | All backups encrypted at rest (AES-256) | | Recovery testing | Regular recovery drills to validate backup integrity | | Geographic redundancy | Backups stored in separate availability zones within the same region |

A6. Network Security

| Measure | Implementation | |---------|---------------| | Firewall | Google Cloud VPC firewall rules; ingress restricted to necessary ports | | DDoS protection | Google Cloud Armor; nginx rate limiting (30 req/s per IP) | | Segmentation | Kubernetes namespace isolation between services | | Scanner blocking | Automated blocking of known vulnerability scanner user agents | | HSTS | HTTP Strict Transport Security with preload; max-age 31536000 |

A7. Personnel Security

| Measure | Implementation | |---------|---------------| | Confidentiality agreements | All personnel with data access sign NDAs | | Security training | Regular security awareness training for all staff | | Access reviews | Quarterly reviews of access permissions | | Offboarding | Immediate revocation of access upon termination |

A8. Vulnerability Management

| Measure | Implementation | |---------|---------------| | Penetration testing | Regular third-party penetration testing | | Vulnerability scanning | Automated scanning of infrastructure and application code | | Patch management | Timely application of security patches | | Dependency management | Automated monitoring of third-party dependencies for known vulnerabilities |

A9. Physical Security

| Measure | Implementation | |---------|---------------| | Data center | Google Cloud data centers (SOC 1/2/3, ISO 27001, PCI DSS certified) | | Physical access | Managed entirely by Google Cloud; multi-layered physical security controls |

Annex 2: Standard Contractual Clauses

For international transfers of Personal Data, the Parties agree to the Standard Contractual Clauses (Module 2: Controller-to-Processor) as set out in Commission Implementing Decision (EU) 2021/914, which are incorporated by reference. The completed Annexes to the SCCs are as follows:

Annex I.A — List of Parties:

  • Data Exporter: Controller (as identified in the Principal Agreement)
  • Data Importer: Aristiun Samsad B.V.

Annex I.B — Description of Transfer:

  • Categories of Data Subjects: As set out in Section 5 of this DPA
  • Categories of Personal Data: As set out in Section 6 of this DPA
  • Frequency of transfer: Continuous, during the Term
  • Nature and purpose of processing: As set out in Sections 2 and 4 of this DPA
  • Retention period: As set out in the Privacy Policy

Annex I.C — Competent Supervisory Authority:

  • The Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

Annex II — Technical and Organizational Measures:

  • As set out in Annex 1 of this DPA

Annex III — List of Sub-processors:

  • As set out in Section 8.2 of this DPA

Contact Information

Aristiun Samsad B.V. The Netherlands

  • Data Protection Officer: privacy@aristiun.com
  • Legal: legal@aristiun.com
  • Security incidents: security@aristiun.com
  • Website: https://aribot.ayurak.com

AGREED AND ACCEPTED:

| | Data Controller | Data Processor (Aristiun Samsad B.V.) | |---|---|---| | Signature: | _________________________ | _________________________ | | Name: | _________________________ | _________________________ | | Title: | _________________________ | _________________________ | | Date: | _________________________ | _________________________ |

This Data Processing Agreement was last updated on [EFFECTIVE DATE].