Data Processing Agreement

Effective 30 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service, or any signed agreement, for the Akesis service (the "Agreement") between Valitura, of 1065 SW 8th, Unit 5579, Miami, FL 33130, USA ("Valitura"), and the customer named in the Agreement ("Customer").

1. Definitions

Terms used and not defined here (controller, processor, personal data, processing, data subject, personal data breach, supervisory authority) have the meanings in the GDPR. "GDPR" means Regulation (EU) 2016/679, and where relevant the UK GDPR and the Swiss Federal Act on Data Protection. "Data Protection Laws" means the GDPR and any other law that applies to the processing, including US state privacy laws such as the California Consumer Privacy Act as amended ("CCPA"). "Customer Personal Data" means personal data Valitura processes on Customer's behalf in providing the service. "Sub-processor" means a processor Valitura engages to process Customer Personal Data.

2. Roles and scope

2.1 Customer is the controller of Customer Personal Data, or a processor acting for its own controller; Valitura is its processor (or sub-processor). Annex I describes the processing.

2.2 This DPA applies only to Customer Personal Data. It applies automatically when Customer accepts the Agreement; Valitura will countersign a copy on request to privacy@akesis.app. Data Customer connects from its own services (for example its code hosts, scanners, Jira, Slack or Sentry) is processed at Customer's direction; those services are Customer's own processors or controllers, not Valitura's Sub-processors.

3. Processing on instructions

3.1 Valitura processes Customer Personal Data only on Customer's documented instructions, including on transfers, unless required to do otherwise by law, in which case Valitura informs Customer first unless the law forbids it. The Agreement, this DPA and Customer's configuration and use of the service (for example the integrations it connects and the policies it sets) are Customer's instructions.

3.2 Valitura tells Customer promptly if, in its opinion, an instruction infringes Data Protection Laws.

3.3 Valitura does not use Customer Personal Data or any customer content to train machine-learning models, and does not sell or share it (as those terms are used in the CCPA).

4. Confidentiality

Valitura ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality and has access only as needed to provide or support the service.

5. Security

Valitura implements the technical and organisational measures in Annex II, appropriate to the risk, and keeps them under review. It may update them as long as the overall level of security doesn't decrease.

6. Sub-processors

6.1 Customer gives general authorisation for Valitura to engage Sub-processors. The current list is in Annex III and published at akesis.app/legal/subprocessors.

6.2 Valitura notifies Customer of any intended addition or replacement at least 30 days in advance, by updating that page and emailing Customer's admins. Customer may object on reasonable data-protection grounds within that period. The parties then discuss in good faith; if they can't resolve the objection, Customer may terminate the affected part of the service and receive a pro-rata refund of prepaid fees for it.

6.3 Valitura imposes on each Sub-processor data-protection obligations no less protective than this DPA, and remains responsible to Customer for its Sub-processors' performance.

7. Data subjects' rights

Taking into account the nature of the processing, Valitura assists Customer, by appropriate technical and organisational measures, in responding to requests to exercise data subjects' rights. The service lets Customer's admins find everything held about one person by email or code-host login, export it, and erase audit-log entries that mention them (Admin → Data subject requests), correct, disable and remove users (removal erases the person's account; the audit log holds only an internal ID, see Annex II), and export the audit log. Valitura forwards to Customer, without responding itself, any request it receives directly that concerns Customer Personal Data.

8. Assistance

Valitura provides reasonable assistance with Customer's obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to it, including documentation of the processing and of the AI features.

9. Personal data breaches

9.1 Valitura notifies Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

9.2 The notice describes, as far as then known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point. Valitura provides further information in phases as it becomes available.

9.3 Valitura takes reasonable steps to contain and remedy the breach, and keeps a record of it. Notifying Customer is not an acknowledgement of fault.

10. Return and deletion

10.1 On termination, Customer may ask Valitura to return Customer Personal Data. Valitura provides a full export: every record held for Customer (credentials and secret references excepted) and the audit log with what is needed to verify it.

10.2 Within 30 days after Customer confirms receipt of the export (or after termination, if Customer doesn't ask for one), Valitura deletes Customer Personal Data, unless law requires it to keep some. Copies in backups are deleted as the backups expire under the database Sub-processor's retention schedule.

10.3 Valitura keeps an anonymised form of the audit log for up to seven years: the identity of who acted, the repositories and all free-text details are erased, leaving only what kind of action happened and when, still cryptographically verifiable. A record that the deletion took place is kept.

11. Information and audits

11.1 Valitura makes available to Customer the information necessary to demonstrate compliance with Article 28 GDPR, including this DPA's annexes, its security documentation, and answers to a reasonable security questionnaire once a year.

11.2 Where that information isn't sufficient, Customer (or an independent auditor bound by confidentiality, not a competitor of Valitura) may audit Valitura's compliance once a year, on 30 days' notice, during business hours, at Customer's cost, and without access to other customers' data. When Valitura has a SOC 2 Type II report, it satisfies this clause for the controls it covers.

12. International transfers

12.1 Valitura is established in the United States, and Customer Personal Data is stored there (Annex III). EU data storage is not yet available.

12.2 For transfers of Customer Personal Data from the EEA to Valitura, the parties enter into the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 2 (controller to processor) or Module 3 (processor to processor) as applicable, incorporated by reference, with these choices:

Clause 7 (docking clause): included.
Clause 9: option 2 (general written authorisation), with the notice period in section 6.2.
Clause 11: the optional redress language is not included.
Clause 13: the supervisory authority of the EU member state where Customer is established or, if it isn't, where its representative is.
Clauses 17 and 18: the law and courts of Ireland.
Annexes I to III: the annexes to this DPA.

12.3 For transfers from the United Kingdom, the UK International Data Transfer Addendum to the SCCs applies; for Switzerland, the SCCs with the adjustments required by the Swiss FDPIC.

12.4 Valitura's transfers to Sub-processors rely on the mechanisms listed in Annex III.

13. US state privacy laws

To the extent the CCPA or similar US state laws apply, Valitura is a "service provider" (or "processor"). It processes Customer Personal Data only for the business purpose of providing the service, does not sell or share it, does not retain, use or disclose it outside the direct business relationship or combine it with personal information from other sources except as those laws permit, complies with the applicable obligations, and notifies Customer if it can no longer meet them.

14. General

14.1 This DPA lasts as long as Valitura processes Customer Personal Data. If it conflicts with the Agreement, this DPA prevails; if it conflicts with the SCCs, the SCCs prevail.

14.2 Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the SCCs don't allow that.

Annex I: Description of the processing

Data subjects

Customer's personnel who use Akesis (admins, engineering leads, security owners, engineers, auditors).
People named in data Customer's connected services provide: authors of pull requests and commits on Customer's code hosts, and accounts used by Customer's automation (e.g. Dependabot, Snyk, Renovate bot accounts).
Incidentally, anyone whose personal data appears in content Customer's scanners report (for example in an advisory description) or in source code read for reachability.

Categories of personal data

Account data: email address, name (if Customer's identity provider sends it), identity-provider issuer and subject, role, account status, last sign-in time.
Session data: browser user-agent and session expiry (the session token is stored only as a hash).
Integration data: the Jira account email Customer enters; code-host account names on pull requests; names and scopes of assistant and API tokens (tokens and keys stored only as hashes); connected apps; webhook endpoint addresses.
Audit data: internal user IDs linked to actions, with timestamps.
Network data: IP addresses in short-lived rate-limiting counters (sign-in to connected AI apps) and in application request logs held by the hosting Sub-processor.
Incidental data in scanner findings, in monitoring alerts Customer sends, and in source code (code is read in memory and not stored; from Customer's CI, Akesis keeps only the file paths and function names that use each package).

Special categories: none intended. Customer should not place special-category data in the service.

Nature and purpose: providing the Akesis service: ingesting and de-duplicating vulnerability findings, re-scoring them, analysing reachability, adopting and opening fix pull requests, deciding and performing merges within Customer's policies, notifications and tickets, optional AI narratives, the audit log, user and access management, and support.

Frequency: continuous for the term.

Retention: for the term, then as in section 10. Audit entries are kept for Customer's retention setting (1 to 10 years, default 7) while Customer is active.

Sub-processors: Annex III.

Annex II: Technical and organisational measures

Isolation between customers

Every customer's data is separated by the database itself: row-level security on every customer table, with the customer set per transaction. A query without it sees nothing. Tested continuously against a real database.
Separate database roles for the application, scheduled jobs and sign-in lookups, each with least privilege; only operators' migration tooling uses the owner role, from operators' machines.

Access control

Sign-in only through Customer's identity provider (OpenID Connect, with PKCE, state and nonce; signatures, issuer, audience and expiry verified). Akesis holds no passwords.
Five roles with least privilege; sensitive changes (raising autonomy, accepting risk) need specific roles and a recorded reason.
Server-side sessions (12 hours by default); cookies are HttpOnly and SameSite and hold only a random token, stored as a hash. Requests that change data must come from the application's own origin.
Assistant access by scoped, expiring tokens or OAuth 2.1 with PKCE; never more than the person's current role; revoked at once when the person is disabled.

Encryption

In transit: TLS to the service and between the service and the database (certificate verification required).
At rest: storage encryption by the database Sub-processor; credentials Customer enters are additionally encrypted with AES-256-GCM using keys held outside the database, bound to the customer and purpose; tokens and keys are stored only as hashes.

Integrity and accountability

An append-only, hash-chained audit log of security-relevant actions, which the database itself protects against change; customers can verify and export it independently.
Every automated merge is re-checked immediately before merging and pinned to the commit tested; an emergency stop halts automation at once.

Data minimisation

Source code read for reachability is processed in memory and never stored; code structure from Customer's CI is reduced to the file paths and function names that use each package; coverage reports reduced to a percentage; secrets matched by scanners are discarded; exploit scripts are never received.
AI features receive only facts already held about a finding, never source code; prompts are not logged; AI requests run in the customer's region (EU customers in the EU).

Operational security

Changes to the service are made through reviewed pull requests by an automated account, under branch protection; dependencies are scanned for vulnerabilities.
The hosting environment refuses development configurations in production; secrets are held only in the hosting environment's protected settings.
Backups and point-in-time recovery by the database Sub-processor.

Deletion: offboarding procedure with a recorded, verifiable deletion within 30 days (section 10).

Incident response: the breach procedure in Valitura's internal runbook (section 9).

Annex III: Sub-processors

Sub-processor	Purpose	Data	Location	Transfer basis
Neon, Inc.	Managed PostgreSQL database: all stored Customer Personal Data	All categories in Annex I	United States (AWS us-east-2)	Within the United States; Neon's data processing terms
Amazon Web Services, Inc.	Underlying infrastructure of Neon; Amazon Bedrock for AI narratives (only when AI features are on)	Bedrock: facts about a finding, no source code	Bedrock: Customer's region (US, or EU for EU customers)	AWS data processing terms, including the SCCs
Hostinger International Limited	Application hosting: runs the service; holds request logs	All categories in transit; request logs with IP addresses	United States	Hostinger's data processing terms

The current list, and the record of changes, is at akesis.app/legal/subprocessors.

Not Sub-processors: services Customer connects (GitHub, GitLab, Bitbucket, Snyk, Jira, Slack, Sentry, its monitoring tools, its identity provider, AI assistants and webhook endpoints), which Customer engages directly; and public data sources Akesis queries without any personal data, which receive only public vulnerability identifiers.