Data Processing Agreement (template)¶
Version: Draft 0.1 — 2026-05-03
TODO: review by counsel before sending to any customer. This template was drafted by Secruna's engineering team for a CEE-licensed law firm to refine. It tracks the European Data Protection Board (EDPB) recommended structure for an Article 28 GDPR processor agreement, with optional clauses required by the EU AI Act for providers and deployers of high-risk AI systems. Do not sign or send to a customer without counsel review.
Parties¶
This Data Processing Agreement ("DPA") is entered into between:
- Customer — ___ (the "Controller"), the legal entity contracting for the Secruna service; and
- Secruna sp. z o.o. (or successor entity — TODO: confirm with founder) (the "Processor"), incorporated in Poland.
This DPA forms part of the Service Agreement between the parties referenced as the Master Subscription Agreement. Where this DPA conflicts with the Master Subscription Agreement, this DPA prevails on matters of personal data processing.
1. Subject and duration of processing¶
1.1 Subject¶
The Processor processes personal data on the Controller's behalf to operate the Secruna compliance platform: an EU AI Act Annex III classification and inventory service for AI systems deployed by the Controller and its affiliates.
1.2 Duration¶
Processing begins on the Effective Date of the Master Subscription Agreement and continues for the duration of that agreement. Post-termination, the Processor returns or deletes personal data in accordance with §10 of this DPA.
2. Nature and purpose of processing¶
The Processor processes personal data for the following purposes:
- Discovery. Periodic read-only collection of metadata about the Controller's AI systems through customer-controlled connectors (Azure, AWS, GCP, GitHub, M365 Power Platform, OpenAI, Anthropic, Databricks). Refer to the connector documentation for the exact API endpoints exercised.
- Classification. Submission of extracted artefact metadata (resource names, vendor, model identifiers, audit-log fragments) to the Anthropic Claude LLM for a draft Annex III classification. The Processor does not transmit AI-system prompts, completions, training data, or end-user content.
- Workflow. Storage and surfacing of classifications, verdicts, audit logs, and obligations checklists in the Controller's tenant. Two-eyes approval (Human-in-the-Loop) for high-risk verdicts.
- Notification. Transactional emails about workflow events (verdict assigned, impersonation request) sent through Resend to authorised recipients.
- Operational telemetry. Error tracking (Sentry), uptime monitoring (Better Stack), and audit logging.
The Processor does not use personal data for product analytics, marketing, model training, or any purpose outside the operation of the Service.
3. Categories of data subjects¶
The Processor processes personal data about the following categories of data subjects:
- Controller's authorised users — employees or contractors of the Controller granted access to the Secruna tenant (compliance officers, security team, IT admins).
- Controller's developers — engineers identified as Copilot seat assignees, repository contributors, AWS IAM principals, or comparable identifiers surfaced by the connectors.
- End-users of the Controller's AI systems — only where the Controller chooses to ingest user identifiers into the audit log of an AI system the Processor scans (uncommon). The Processor does not directly observe end-user data.
The Processor does not intentionally process data of children, criminal-conviction data, or special-category data under GDPR Article 9.
4. Categories of personal data¶
The Processor processes the following categories of personal data. The list is exhaustive — any new category requires an update to this DPA.
4.1 Authentication and account data¶
| Field | Source | Purpose |
|---|---|---|
| Email address | Microsoft Entra ID | User login, notifications |
| Display name | Microsoft Entra ID | UI personalisation, audit log readability |
| Entra object ID (UUID) | Microsoft Entra ID | Identity binding |
| IP address (last 7 days) | Request headers | Rate limiting (Plan 20a), audit log |
| User-agent | Request headers | Audit log |
4.2 Connector-derived metadata¶
The exact metadata categories per connector are listed in the respective connector page. Summary:
| Connector | Personal data fields collected |
|---|---|
| Azure | Resource creator UPN (when present in Activity Log entries); subscription owner UPN |
| AWS | IAM principal ARN of assumeRole callers (CloudTrail events); resource creator ARN |
| GCP | Principal email of resource creator (Cloud Logging audit entries) |
| GitHub | Copilot seat assignee login; repository contributor logins (only those returned by code search hits) |
| M365 (Power Platform) | Environment creator UPN |
| OpenAI | Project member emails (only via /v1/organization/projects membership lists if exposed; today not stored) |
| Anthropic | Workspace member emails (today not stored) |
| Databricks | Service Principal client ID (not personal data per se, but documented) |
4.3 Telemetry¶
| Field | Source | Purpose |
|---|---|---|
| Request ID | Generated server-side | Cross-system correlation (Plan 20a) |
| Tenant ID | Session | RLS enforcement |
| User ID | Session | Audit log actor field |
The Processor configures Sentry's PII scrubber to drop request bodies, headers, cookies, and URL parameters by default; exceptions captured by Sentry contain only stack traces, the above identifiers, and a message string.
5. Subprocessors¶
5.1 Authorised subprocessors¶
The Controller authorises the Processor to engage the
subprocessors listed at
legal/subprocessors.md. The list at the
Last updated date of that page is incorporated into this DPA
by reference.
5.2 Subprocessor change procedure¶
The Processor will follow the change procedure at the bottom of the subprocessors page:
- 30-day prior written notice (email to tenant admins + page update) for additions or replacements;
- A reasoned objection window for the Controller; an unresolved objection grants the Controller the right to terminate the affected service per §10.3;
- Emergency replacement permitted with notice within 5 business days when continuity demands it.
5.3 Subprocessor obligations¶
The Processor will impose on every subprocessor processing personal data on the Controller's behalf contractual obligations no less protective than those in this DPA, in writing, including:
- The same purpose limitation (§2);
- The same security measures (§6);
- The same data subject rights handling (§7);
- The same data breach notification timeline (§8);
- The same return/deletion obligations (§10).
6. Security measures (Article 32 GDPR)¶
6.1 Honest baseline¶
This section is written to reflect what Secruna has actually implemented as of the Version date. Items marked [planned] are on the published roadmap with a target date.
6.2 Encryption¶
- In transit: All client and inter-service traffic uses
TLS 1.2+ with HSTS enabled. The frontend (
app.secruna.com) and API (api.secruna.com) are behind Azure-managed TLS certificates auto-rotated by Azure Container Apps. - At rest: Azure Database for PostgreSQL Flexible Server uses AES-256 encryption at rest with Azure-managed keys. Customer-managed keys (BYOK) are not yet offered; [planned] for P2.
- Secrets: Connector credentials (refresh tokens, IAM Role ARN + external_id, OAuth client secrets, admin API keys) are stored in Azure Key Vault in our control-plane subscription. Key Vault soft-delete retention is 7 days.
6.3 Access control¶
- Customer access: Microsoft Entra External ID OIDC, plus per-tenant Postgres Row-Level Security on all multi-tenant tables.
- Secruna employee access: Limited to platform admins. Tenant data access requires a 2-eyes approved ImpersonationRequest (Plan 17b). Every impersonation event is audit-logged with a 7-year retention.
- Service-to-service: Workload identities (Azure managed identities); no static credentials in code or env files.
6.4 Network¶
- Single-region deployment in Azure Sweden Central.
- API and frontend reachable only via TLS over Azure Container Apps' managed ingress; no SSH, no VPN tunnel.
- Per-IP rate limit of 600 requests/minute (Plan 20a).
- Per-tenant rate limit [planned, P0 hardening].
6.5 Logging and monitoring¶
- Structured (JSON) application logs forwarded to Azure Log Analytics; 30-day retention.
- Audit log entries (per §4 of the data retention policy) retained 7 years.
- Error tracking via Sentry (90-day retention; PII scrubbing enabled).
- Uptime monitoring via Better Stack with public status page at
status.secruna.com.
6.6 Resilience¶
- Backups: Azure PostgreSQL point-in-time recovery (PITR) with 7-day window. RPO target: ≤5 minutes.
- Single-region deployment risk: No multi-region active
failover. Disaster recovery is a documented manual procedure
with target RTO ≈ 6 hours (re-deploy stack from
Infrastructure-as-Code into North Europe + restore PG snapshot).
See
docs/ops/incident-response.md. Multi-region failover is [planned, P2]. - Drill cadence: Quarterly DR drills are scheduled but the first drill has not yet executed as of the Version date. This will be remediated within the first 30 days of contract.
6.7 What we do not yet hold¶
The Processor does not hold the following certifications as of the Version date and does not represent that it does:
- SOC 2 Type 1 or Type 2 (planned, P2)
- ISO/IEC 27001
- ISO/IEC 27701
- ISO/IEC 42001 (AI management systems)
The Controller acknowledges receiving an honest disclosure of this gap and proceeds on the basis of the controls described above.
7. Data subject rights¶
7.1 Assistance¶
The Processor will assist the Controller, at the Controller's cost where third-party fees apply, to fulfil the Controller's obligations to respond to data subject requests under GDPR Articles 15–22.
7.2 Operational mechanisms¶
| Right | Mechanism |
|---|---|
| Access (Art 15) | Per-tenant export of audit log + connector artefacts via the dashboard's CSV export. Larger requests handled by support email. |
| Rectification (Art 16) | Personal data the Processor holds about the Controller's users is sourced from Microsoft Entra ID; rectification happens upstream and propagates on next login. |
| Erasure (Art 17) | 30-day SLA from receipt of a controller-verified request; pseudonymisation preferred, hard delete where required. See data-retention.md §Right of erasure. |
| Restriction (Art 18) | Implemented as connection paused status — connector stops scanning until resumed. |
| Portability (Art 20) | CSV export covers structured fields; full audit log export available on request. |
| Objection (Art 21) | The Processor does not undertake processing on the legal basis of legitimate interest; objections are forwarded to the Controller. |
| Automated decision-making (Art 22) | The Processor's classification is decision-support, not an automated decision about a data subject. Where the Controller deploys this output as part of an automated decision, the Controller is responsible for the Article 22 obligations. |
8. Personal data breach notification (Article 33 GDPR)¶
8.1 Notification to the Controller¶
The Processor will notify the Controller of any personal data breach affecting the Controller's data without undue delay, and in any event within 72 hours of the Processor becoming aware of the breach.
8.2 Contents of notification¶
The notification will, to the extent then known, include:
- The nature of the breach;
- The categories and approximate number of data subjects and records affected;
- The likely consequences;
- Measures taken or proposed to mitigate;
- Contact point for further information.
Where the full information is not available within 72 hours, the Processor will provide an initial notification with the information available and supplement it as the investigation progresses.
8.3 Public communication¶
The Processor will not unilaterally make public statements
attributing a breach to the Controller. The Controller's
status-page comms about its own deployment of the Service are
the Controller's responsibility; Secruna's own status page
(status.secruna.com) reports impact at the Service level
(e.g., "API degraded") without Controller-specific detail.
9. International transfers¶
9.1 Default¶
The Service is hosted in the EU (Azure Sweden Central). The default data flow does not involve a transfer outside the EEA.
9.2 Transfers to subprocessors outside the EEA¶
The following subprocessors process personal data outside the EEA:
| Subprocessor | Country | Mechanism |
|---|---|---|
| Anthropic, PBC | United States | EU Standard Contractual Clauses (Module 2: Controller-to-Processor) supplemented by a transfer impact assessment that the Controller acknowledges receiving |
| Resend, Inc. | United States | EU SCCs |
| Functional Software, Inc. (Sentry) | United States | EU SCCs |
The applicable SCCs are the Commission Implementing Decision (EU) 2021/914 of 4 June 2021, with the Module that fits each relationship. Copies are available on request.
9.3 Controller-controlled connectors¶
Where the Controller connects a non-EU cloud provider (e.g.,
an AWS account in us-east-1, a GitHub.com organisation), data
may be returned to Secruna from a non-EU region. The
Controller is the controller of that data flow and is
responsible for selecting an appropriate transfer mechanism
within its existing contract with the cloud vendor.
10. Audit rights¶
10.1 Standard mechanism¶
Once per calendar year, with at least 30 days' written notice, the Controller may request:
- A copy of the most recent independent assessments held by the Processor (when available — see §6.7 on certifications not yet held);
- Written responses to a security questionnaire of reasonable scope (CAIQ, SIG-Lite, or the Controller's own template);
- A live walkthrough by video call of any control listed in §6.
The Processor will respond within 30 calendar days.
10.2 On-site audit¶
For Controllers regulated under DORA or analogous financial-sector oversight (e.g., banks subject to KNF, ČNB, BaFin direct supervision), on-site audit rights apply where mandated by regulator or contractual rule. The Controller and Processor will agree the scope, location, timing, and confidentiality terms in advance. Costs are borne by the Controller except where the audit substantively confirms a breach by the Processor.
10.3 Termination on unresolved audit findings¶
A material audit finding that the Processor fails to remediate within an agreed timeline grants the Controller the right to terminate the Master Subscription Agreement for cause, without liability for unused term.
11. Termination, return, and deletion¶
11.1 Trigger¶
This DPA terminates upon termination or expiry of the Master Subscription Agreement.
11.2 Return or deletion¶
At the Controller's election (made within 30 days of the termination effective date), the Processor will:
- Return all personal data the Controller can access through standard exports (audit log CSV, artefact JSON), delivered to a Controller-nominated location within 30 days of the election; or
- Delete all personal data within 90 days of the termination effective date.
Backup copies in Azure PostgreSQL PITR (7-day window) and Log Analytics (30-day window) age out automatically and are not restored.
11.3 Confirmation¶
Within 90 days of completion the Processor will provide written confirmation that deletion is complete.
11.4 Surviving obligations¶
Sections 6 (Security), 7 (Data subject rights), 8 (Breach notification), and 10 (Audit) survive termination to the extent required to discharge any remaining obligations.
12. Liability¶
Liability for breach of this DPA is governed by the limitation of liability clause in the Master Subscription Agreement, except where applicable law (including Articles 82–84 GDPR) prohibits limitation.
13. Governing law and jurisdiction¶
This DPA is governed by the laws of the Republic of Poland. Disputes shall be resolved by the courts of Warsaw, Poland, without prejudice to the data subject rights conferred by Article 79 GDPR.
Annex I — Description of processing¶
(See §§2, 3, 4 above.)
Annex II — Categories of data per connector¶
(See per-connector pages under connectors/ and §4.2 above.)
Annex III — Technical and organisational measures¶
(See §6 above; for current operational state and incident response,
see docs/ops/incident-response.md and docs/ops/slos.md.)
Annex IV — Subprocessors¶
(See subprocessors.md, incorporated by reference.)
TODO: review by counsel before sending to any customer.