Veri İşleme Eki (DPA — Data Processing Addendum)
UK GDPR Madde 28 uyarınca güvenlik telemetrisi ve kiracı verisi işleme şartları ve teknik güvenlik önlemleri (TOMs).
1. Purpose & Application (UK GDPR Article 28)
This Data Processing Addendum ('DPA') supplements the Cyber Security House Terms of Service and applies whenever ARYA AI TECHNOLOGY LTD (Company No. 17372232, registered in England and Wales, 'Processor') processes Personal Data on behalf of the Customer ('Controller') in connection with the provision of the platform.
This DPA reflects the mandatory requirements of Article 28 of the UK GDPR and Regulation (EU) 2016/679 (EU GDPR).
2. Scope & Nature of Processing
Processor processes security event telemetry, server logs, network connection metadata, and asset identifiers solely to provide real-time threat detection, automated incident triage, Sigma rule evaluation, vulnerability reporting, and Connected World visibility.
Processor shall process Personal Data only on documented instructions from Controller, including with respect to transfers of Personal Data, unless required to do so by applicable UK or European Union law.
3. Technical & Organizational Measures (TOMs)
Processor implements and maintains industry-standard technical and organizational security measures:
Tenant Isolation: PostgreSQL 16FORCE ROW LEVEL SECURITY enforced on all 20 tenant tables, preventing cross-tenant data leakage at the database engine level.Encryption: Telemetry in transit is encrypted using TLS 1.3 with modern cipher suites. Telemetry at rest is encrypted using AES-256-GCM with post-quantum lattice-ready envelope keys managed in Tier-4 London HSM vaults.Access Control: Strict least-privilege role-based access control (RBAC), multi-factor authentication (WebAuthn Passkeys), and immutable SHA-256 append-only administrative audit logs.Vulnerability Management: Continuous internal penetration testing, automated dependency scanning, and third-party code audits.4. Subprocessors & Advance Notification
Controller grants general written authorization to Processor to engage infrastructure subprocessors (such as sovereign cloud hosting facilities in London, Frankfurt, Riyadh, and Tokyo).
Processor maintains an up-to-date list of subprocessors and provides Controller with at least 30 days prior written notice of any intended changes, giving Controller the opportunity to object on reasonable data protection grounds.
5. Security Incident Notification within 48 Hours
Processor shall notify Controller without undue delay, and in any event within 48 hours, after becoming aware of any confirmed personal data breach affecting Controller's telemetry or account data.
The notification shall describe the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the mitigation measures taken.
6. Deletion & Return of Data
Upon termination of the underlying Agreement, Processor shall, at Controller's choice, securely return or delete all Customer Personal Data, including existing copies, within 30 calendar days, and provide written certification of cryptographic shredding upon request.