Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Shieldome Siege ("Processor") and the customer organization using the platform ("Controller"), and applies whenever Shieldome Siege processes personal data on the Controller's behalf under GDPR Article 28. It's published here so any organization can review it before signing up; a countersigned copy is available on request to [email protected].

In plain terms: your organization is the controller of the data that shows up in your scans and findings (for example, a leaked email address your test uncovers). We process it only to run the engagement you've asked for, we don't use it for anything else, and we'll help you meet your own GDPR obligations around it.

1. Subject matter and duration

Shieldome Siege processes personal data on the Controller's behalf for as long as the Controller maintains an active subscription, plus any period afterward needed to return or delete data under Section 8.

2. Nature and purpose of processing

Processing consists of running authorized penetration testing engagements: scope-checked reconnaissance, vulnerability identification, human-approval-gated exploit confirmation, audit logging, and report generation, exclusively as instructed by the Controller through the platform.

3. Categories of data and data subjects

Personal data processed is typically incidental to the security testing itself, for example email addresses, usernames, or credentials that appear in scan results, breach-exposure checks, or findings. Data subjects are generally the Controller's own employees, users, or customers whose information exists somewhere within the systems being tested.

4. Processor obligations

Process personal data only on the Controller's documented instructions, including as set by the Controller's own scope and Rules of Engagement.
Ensure personnel with access are bound by confidentiality.
Implement appropriate technical and organizational security measures (see Section 6).
Assist the Controller in responding to data subject rights requests and in meeting its own breach-notification and DPIA obligations, where the request relates to data held on the platform.

5. Sub-processors

The Processor uses the following sub-processors, and will notify the Controller before adding or replacing one that would materially change how Controller data is handled:

Sub-processor	Purpose	Location
OVHcloud	Hosting infrastructure	Gravelines, France (EU)
Titan	Transactional email delivery	EU

6. Security measures

Measures currently in place include TLS in transit, hashed credential storage, optional TOTP-based two-factor authentication, role-based access control scoped per organization, a hash-chained tamper-evident audit log, and human approval required before any exploit confirmation runs.

7. International transfers

All processing described in this DPA takes place within the EU (Gravelines, France). No personal data is transferred outside the EEA as part of operating the platform.

8. Deletion and return of data

On termination of the subscription, and on the Controller's written request, the Processor will delete or return engagement data within a reasonable period, except where retention is required by law or for the audit log's evidentiary purpose during an active dispute.

9. Audits

The Processor will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for audits, including inspections, by the Controller or an auditor mandated by the Controller, on reasonable notice.

10. Liability

Liability under this DPA is subject to the limitation of liability set out in the Terms of Service.

Executing this DPA

This page states our standard terms. To countersign a copy for your organization's own records, email [email protected] with your organization's legal name and address.