Data Processing Agreement (Art. 28 GDPR)

Between ExploitClock LLC ("processor", "we") and the customer named on the account ("controller", "you") · Last updated: 17 October 2026

Privacy · Terms · DPA · Security · Imprint

1. Subject matter, duration, nature and purpose

The subject matter is our provision of ExploitClock: monitoring the software bills of materials you upload against public vulnerability and exploitation feeds, opening assessment cases, running the reporting clocks of Article 14 of Regulation (EU) 2024/2847, producing draft notifications for the ENISA Single Reporting Platform, sending alerts, receiving vulnerability reports through your public reporting page if you switch it on and acknowledging them on your instruction, publishing the security advisories you write on your public advisories page if you switch it on and emailing them to the customer contacts you list, and keeping a hash-chained evidence log. The nature of the processing is storage, organisation, retrieval, consultation, use, transmission to the recipients listed in Annex 1, and erasure. The purpose is to provide that service to you and nothing else. The duration is the term of your account, plus the deletion window in section 9.

2. Categories of data subjects and personal data

• Your staff who use the account: the owner and any invited members. Data: name or username, work email address, Auth0 subject identifier, IP address, timestamps of login and of every action recorded in the evidence log, API key labels.
• Contact persons you name in filings and settings: the people you enter as reporting contacts, alert recipients, addresses on your advisory distribution list or the contact shown in a draft notification. Data: name, role, work email address (for the distribution list, the address only and whether it unsubscribed), and a mobile number if you enable SMS.
• Your billing contact: name, email address, company name and VAT identifier, held in our billing records and by Stripe.
• People who report vulnerabilities to you through your public reporting page, if you switch it on: security researchers, customers and others. Data: the name or handle and email address they choose to give (both optional), and the text of their report and proof of concept. Their IP address is used only in memory to limit abuse and is not stored. Reports are kept until you close or delete them or delete your account, and are included in your export.
• Anyone named in free text you enter: case notes, draft fields and uploaded documents are stored as you supply them. Please do not put special categories of personal data (Art. 9 GDPR) or criminal-offence data (Art. 10) into them; the service is not designed for that.

SBOM documents and component lists are your commercial data. They are not usually personal data, but they can contain the names or email addresses of maintainers. We treat them under this DPA either way.

3. Roles

You are the controller for the personal data described in section 2 and we are your processor. We are an independent controller only for our own business records: your billing and accounting data, the contract itself, and our own security logs. Our processing as controller is described in the Privacy notice.

4. Documented instructions

We process personal data only on your documented instructions, including as to transfers to a third country. Your instructions are: this DPA, the Terms, the configuration you set in the product, and any further written instruction you send to support@exploitclock.com that is within the scope of the service. We may process where Union or Member State law requires it; in that case we inform you before processing unless that law forbids it. If we believe an instruction infringes the GDPR we will tell you without delay and may suspend that instruction.

5. Confidentiality

Every person authorised to process your personal data is bound by a written confidentiality obligation that survives the end of their engagement, or is under an appropriate statutory obligation of confidentiality. Access is granted on a need-to-know basis and is removed when the need ends.

6. Security of processing (Art. 32)

We implement appropriate technical and organisational measures and describe them in full, and honestly, on the Security page, which forms Annex 2 to this DPA. In summary: encryption in transit everywhere (TLS 1.2 or higher, HSTS with preload) and encryption at rest by the managed database provider; authentication delegated to Auth0 with no passwords held by us; signed HTTP-only session cookies with idle and absolute timeouts; API keys stored as bcrypt hashes; CSRF protection on state-changing requests; a strict Content-Security-Policy; account-scoped authorisation on every domain query; validated outbound fetching for any URL you supply; an append-only, hash-chained evidence log with an independent RFC 3161 timestamp of the chain head; a weekly logical database backup uploaded over TLS to EU object storage with a SHA-256 checksum, held under the provider's server-side encryption with credentials limited to that one bucket, and a documented restore script; least-privilege operational access. We review these measures when the service changes materially and at least once a year.

7. Sub-processors

You give general written authorisation for us to engage the sub-processors listed in Annex 1. We impose data protection obligations on each of them that are no less protective than this DPA, and we remain fully liable to you for their performance.

We will give you at least 30 days' notice before a new sub-processor starts processing your personal data, or before an existing one takes on a new role, by email to the account owner and by updating Annex 1 on this page. You may object on reasonable data protection grounds within those 30 days by writing to support@exploitclock.com. We will then work with you to find a solution. If we cannot, you may terminate the affected part of the service without penalty and receive a pro-rata refund for the unused period.

8. Assistance

Data subject requests (Art. 12 to 23). If a data subject contacts us directly about data we process for you, we forward the request to you and do not answer it ourselves, except to say that we have forwarded it. Much of the assistance is self-serve: Settings gives you a complete JSON export of the account (Art. 15 and 20) and an immediate account deletion (Art. 17), and you can correct or remove individual records, contacts and members yourself at any time. Where the product cannot do it, we help you within a reasonable time and at no charge for requests of ordinary volume.

Personal data breach (Art. 33 and 34). We notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting personal data we process for you, with the information we hold at that time and updates as we learn more. We do not notify a supervisory authority on your behalf. Do not confuse this with the CRA Article 14 clock, which is yours to run.

Articles 32, 35 and 36. We assist you, taking into account the nature of processing and the information available to us, with the security of processing, with data protection impact assessments and with prior consultation. The Security page, this DPA and Annex 1 are written to be usable directly as DPIA input.

9. Deletion and return

You can export the complete account at any time from Settings, in a documented JSON format that includes the evidence log and its verification data. On termination of the service, at your choice, we return or delete the personal data we process for you.

• Deletion you trigger yourself in Settings is immediate and irreversible. It removes products, versions, SBOMs, components, matches, cases, deadlines, drafts, evidence events, anchors, notification settings, API keys and invites, and anonymises the account record. There is no grace period and no undo. Export first.
• If the account simply ends (termination for breach, cancellation, or non-payment), we delete the account data within 90 days of the end of the contract. This step is run by us, not by an automatic timer in the product, and we send an export reminder to the account owner before we do it.
• We keep the billing and accounting records we must keep under tax and commercial law, and the Stripe customer identifier that ties them together, for the statutory retention period. Those are our own controller records.
• Database backups roll off on their own schedule and are held for at most twelve weeks after the deletion. They are not accessed except for disaster recovery.

10. Audit and information rights

We make available all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, by you or an auditor you mandate.

In the first instance this is documentation-based: this DPA, the Security page, Annex 1, our architecture and data-flow description, our incident and access-control procedures, and written answers to your security questionnaire. We answer questionnaires from customers on any plan. An on-site or live inspection is available by prior arrangement, during business hours, no more than once in twelve months unless a breach or a supervisory authority requires otherwise, subject to confidentiality, and without access to other customers' data. We do not hold a SOC 2 report or an ISO 27001 certificate today, and we do not claim one. See What we do not do.

11. International transfers

Your account, product, SBOM, case and evidence data is stored and processed in the EU (Frankfurt, Germany (EU)).

Because we are established in the United States of America, our own staff access that data from outside the EU/EEA to operate and support the service, and some sub-processors have parent companies or support functions outside the EU. For those transfers, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA by reference and are hereby entered into between you as data exporter and us as data importer. Docking clause: applies. Clause 9: Option 2, general written authorisation, with the 30 day notice period in section 7. Clause 11: the optional independent dispute resolution body is not used. Clause 17: the Clauses are governed by the law of Ireland. Clause 18(b): the courts of Ireland. Annex I.A is the parties as identified on the account and on the Imprint; Annex I.B is sections 1 and 2 above; Annex I.C is the lead supervisory authority of your place of establishment; Annex II is section 6 and the Security page; Annex III is Annex 1 below. Where a Member State's law or a UK or Swiss addendum applies, the corresponding approved clauses apply in the same way.

Transfer impact. The data at issue is business contact data and product security data, not special categories. It stays in the EU at rest; the transfer is remote access for support and operations, which is limited, logged and role-based. We have received no government request for customer data to date and will tell you of any request unless legally prohibited. We challenge requests that appear unlawful, and we would give you the chance to seek protective relief where we lawfully can. Supplementary measures: encryption in transit and at rest with keys held by the EU sub-processor, no direct database access from public networks, and the option for you to hold the evidence trail yourself through export and the RFC 3161 timestamps. If you assess that these measures are insufficient for your data, tell us before you upload it.

12. Liability

Liability under this DPA is governed by the limitations and exclusions in section 6 of the Terms, to the extent permitted by law. Nothing here limits the rights of data subjects under the GDPR, the liability of either party under Article 82 GDPR, or liability that cannot be limited by law. Where the Standard Contractual Clauses conflict with this DPA or the Terms, the Clauses prevail.

13. Order of precedence and changes

If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. We may update this DPA to reflect a change in the service, in the law, or in Annex 1. We announce material changes to the account owner by email at least 30 days in advance, and we do not use a change to lower the protection you have.

Annex 1: Sub-processors

This is the current list. It is the same list shown on the Security and Privacy pages. Changes are notified 30 days in advance under section 7.

Lookup recipients (no personal data)

To find advisories and exploitation signals we query public vulnerability services. These receive technical identifiers only. They receive no account data, no product names and no SBOM documents. Your component list is nevertheless commercially confidential, so we send identifiers only, never the SBOM itself, and store the results ourselves. All three lookups run on every scan by default.

Removed from this list on 11 September 2026: Google LLC (Google Fonts). The interface's web fonts are self-hosted from our own domain, so no visitor data reaches Google on page load. Removing a recipient does not require the 30 day notice that adding one does.

Your own alert endpoints (an email address, a Slack incoming webhook or an HTTPS webhook you enter in Settings) receive alert content when you configure them, and a Jira Cloud site or GitHub repository you connect under Settings › Integrations receives the tickets you create from a case. Those endpoints and services are yours, not our sub-processors.

Annex 2: Technical and organisational measures

Section 6 above and the Security page, as published on the effective date of your order, form Annex 2. We keep an archive of previous versions and will send you the version in force on any date on request.

Questions or a signature copy: support@exploitclock.com. Operator identity and postal address: Imprint.