Data processing agreement

This Data Processing Agreement (DPA) forms part of the agreement between Obsecure AB (SE559313-738201) (the Processor) and the customer (the Controller) for TrustDesk and AccessWatch (the Services) under our Terms of Service. It sets out the terms required by Article 28 of the General Data Protection Regulation (EU) 2016/679 (GDPR).

1. Subject matter and duration

The Processor processes personal data on behalf of the Controller to provide the Services, for as long as the Controller uses them and until the data is deleted under section 10.

2. Instructions

The Processor processes personal data only on the Controller's documented instructions: the agreement, this DPA and the Controller's use and configuration of the Services. If the Processor believes an instruction infringes the GDPR or other data protection law, it will tell the Controller. If EU or member state law requires other processing, the Processor will inform the Controller first, unless the law prohibits it.

3. Confidentiality

Everyone at the Processor with access to personal data is bound by confidentiality and only has access where needed for their work.

4. Security

The Processor implements the technical and organizational measures in Annex 2, taking into account the state of the art, costs and the risks to data subjects (GDPR Art. 32). The Processor may update the measures as long as the overall level of protection does not decrease.

5. Subprocessors

1. The Controller gives general authorization for the subprocessors listed on the subprocessor page (Annex 3).
2. The Processor will give at least 30 days' notice of a new or replacement subprocessor, by email to account owners or in the Services. The Controller may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Controller may terminate the affected Services and receive a pro-rata refund of prepaid fees.
3. The Processor imposes data protection obligations on each subprocessor that are at least as protective as this DPA, and remains responsible for its subprocessors.

6. International transfers

Personal data is stored in the EU. Where a subprocessor processes personal data outside the EEA in a country without an adequacy decision, the Processor ensures appropriate safeguards under Chapter V GDPR, in particular the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module Three, processor to processor, between the Processor and the subprocessor), together with any supplementary measures needed. Where a recipient is certified under the EU–US Data Privacy Framework, the transfer may rely on that adequacy decision. [TO CONFIRM: whether the customer needs Module Two SCCs directly with us, e.g. for non-EEA customers]

7. Assistance

Taking into account the nature of the processing, the Processor assists the Controller:

• with requests from data subjects exercising their rights, mainly through the export, edit and delete functions of the Services;
• with security, breach notification, data protection impact assessments and prior consultation (GDPR Arts. 32–36), using information available to the Processor.

8. Personal data breaches

The Processor notifies the Controller without undue delay, and where feasible within [TO CONFIRM: 48] hours, after becoming aware of a personal data breach affecting the Controller's data. The notice describes the breach, the likely consequences and the measures taken, as far as known, and is updated as more becomes known.

9. Audits and information

The Processor makes available the information needed to demonstrate compliance with this DPA, including this DPA, the measures in Annex 2 and answers to reasonable security questionnaires. Where that is not enough, the Controller may audit, or have an independent auditor bound by confidentiality audit, with at least 30 days' notice, during business hours, at its own cost and at most once a year unless a breach has occurred or a supervisory authority requires it.

10. Return and deletion

At the end of the Services, the Controller can export its data. The Processor deletes the personal data within 30 days after the Organization is deleted, and from backups within a further 30 days, unless EU or member state law requires storage.

11. Liability and precedence

Liability under this DPA follows the limitations in the Terms of Service, unless the GDPR provides otherwise. If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of personal data.

Annex 1: Details of the processing

Annex 2: Technical and organizational measures

• Hosting in the EU: application, database and file storage run on servers in the EU.
• Encryption in transit: all connections use HTTPS (TLS) with automatically renewed certificates.
• Encrypted backups: nightly database backups are encrypted before they leave the server and kept for 30 days off-site.
• Encrypted secrets: credentials for scanning staging sites and Slack webhooks are stored encrypted (AES-256-GCM).
• Tenant isolation: every query is scoped to the customer's organization; an automated test blocks new tables without that scope.
• Access control: roles (owner, admin, member, viewer, read-only client logins); optional two-factor authentication; rate-limited sign-in; passwords stored as hashes.
• Logging: sign-ins, changes and downloads are recorded in an audit log available to the customer's owners and admins.
• Malware scanning: uploaded files are scanned for viruses before they can be downloaded; only common document and image formats are accepted.
• Network protection for scans: requests made by AccessWatch scans are checked so they cannot reach private networks or internal services.
• Data minimization: IP addresses of visitors, affiliate clicks and free scans are stored as keyed hashes; names and personal data are masked before excerpts are sent for AI drafting where detected.
• Deletion: deleted accounts and organizations are purged after 30 days.
• Organizational measures: [TO CONFIRM: staff confidentiality agreements, access reviews, security training, incident response procedure, vendor assessment]

Annex 3: Subprocessors

The current list, with any planned changes, is published at /legal/subprocessors.