Data Processing Agreement

Version: dpa-2026-10 Effective date: 2026-10-19 Parties: ZERODIN ("Processor") and the customer identified in the ordering document ("Controller").

This Data Processing Agreement ("DPA") forms part of the Terms of Service (tos-2026-10) and applies whenever ZERODIN processes Personal Data on behalf of the Controller in the course of providing ATHELOS Cloud or ATHELOS Dedicated.

This DPA is entered into pursuant to Article 28 of Regulation (EU) 2016/679 ("GDPR") and implements the requirements of Article 28(3).

1. Definitions

Terms used in this DPA have the meanings given to them in Article 4 of the GDPR. In addition:

• "Controller" means the customer, acting as the controller of Personal Data processed through ATHELOS.
• "Processor" means ZERODIN, acting as a processor on behalf of the Controller.
• "Services" means ATHELOS Cloud or ATHELOS Dedicated as described in the Terms of Service.
• "Personal Data" means any information relating to an identified or identifiable natural person processed by the Processor in the course of providing the Services.
• "Sub-Processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller, as listed in Annex B.

2. Roles and Scope

2.1 The Controller is the controller of Personal Data processed through the Services. The Processor processes that Personal Data on the Controller's behalf.

2.2 This DPA applies to the processing of Personal Data for the duration of the Terms of Service and terminates automatically when the Terms of Service end, subject to the deletion and retention obligations in §10.

2.3 The Processor may process Personal Data outside the scope of this DPA only with the Controller's prior written authorization or where required by law, in which case the Processor will inform the Controller of the legal requirement before processing (unless the law prohibits that disclosure on important grounds of public interest).

3. Subject Matter, Nature, and Purpose of Processing

3.1 Subject matter. The Processor provides the Services, including: hosting the tenant's database, object storage, and search index; authenticating users; sending transactional email; billing; and providing the application features described in the Terms of Service and in the ATHELOS documentation.

3.2 Nature of processing. Storage, retrieval, modification, deletion, backup, and transmission of Personal Data in the course of providing the Services. Processing is automated.

3.3 Purpose. To provide ATHELOS to the Controller under the Terms of Service. The Processor does not process Personal Data for its own purposes, does not sell it, and does not use it to train machine-learning models beyond the Controller's own tenant.

3.4 Duration. For the term of the Terms of Service, followed by the retention periods in §10 and in Annex C.

4. Categories of Data Subjects and Personal Data

4.1 Categories of data subjects:

• Employees and contractors of the Controller who use the Services.
• The Controller's clients and their personnel whose data is entered into ATHELOS.
• Individuals whose data appears in findings, evidence, reports, or contracts produced through ATHELOS.

4.2 Categories of Personal Data:

• Identification data: names, email addresses, job titles.
• Authentication data: password hashes, TOTP secrets, WebAuthn credentials (all stored in hashed or encrypted form).
• Business data: engagement details, findings, evidence, reports, contracts, invoices.
• Usage data: session logs, audit logs, activity history.

4.3 Special categories of Personal Data (Article 9 GDPR) are not required for the use of the Services. If the Controller chooses to enter such data into ATHELOS, the Controller is responsible for ensuring a lawful basis under Article 9(2) and instructing the Processor accordingly.

5. Controller Instructions

5.1 The Processor will process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country, unless required to do otherwise by Union or Member State law. In such a case the Processor will inform the Controller of that legal requirement before processing, unless prohibited by law.

5.2 The Controller's instructions are: (a) the Terms of Service; (b) this DPA; (c) the ordering document; and (d) any further written instructions given by the Controller through the Service's user interface or by email to privacy@athelos.pro.

5.3 The Processor will immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

6. Confidentiality

6.1 The Processor ensures that persons authorized to process Personal Data are bound by appropriate obligations of confidentiality, whether contractual or statutory.

6.2 Access to production systems is limited to the minimum number of personnel necessary. All such personnel undergo background checks and receive data protection training.

7. Security Measures (Article 32)

7.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

7.1.1 Encryption. Data is encrypted in transit (TLS 1.3) and at rest (LUKS on the host, and application-level encryption for sensitive fields such as TOTP secrets). Backups are encrypted client-side with restic before upload.

7.1.2 Access control. Multi-factor authentication is required for administrative access. Least-privilege is enforced through role-based access control in the application.

7.1.3 Isolation. Cloud tenant data is isolated at the database level, with a dedicated Postgres database, MinIO bucket, and Meilisearch index per tenant. Dedicated deployments use a physically separate VPS per customer. Cross-tenant isolation is verified by an OWASP Cross-Tenant Boundary Test.

7.1.4 Audit logging. Administrative actions are logged to an append-only audit log retained per Annex C. Application-level activity logs are retained per Annex C.

7.1.5 Backup and recovery. Daily encrypted backups to Backblaze B2. Backup restores are tested periodically.

7.1.6 Vulnerability management. Dependency scanning, static analysis, and container image signing (SLSA, cosign) are part of the build pipeline. Security advisories are reviewed and acted on.

7.2 The Processor may update these measures from time to time, provided the overall level of protection is not reduced.

8. Sub-Processors

8.1 General authorization. The Controller grants the Processor general written authorization to engage Sub-Processors for the purposes described in Annex B.

8.2 Current Sub-Processors. The current list of Sub-Processors, including their purpose, data categories, location, and safeguards, is maintained in docs/legal/SUB-PROCESSORS.md (version subprocessors-2026-10, Annex B).

8.3 Changes. The Processor will notify the Controller by email at least 30 days before engaging a new Sub-Processor. The Controller may object to the change on reasonable data protection grounds. If the Controller objects and the parties cannot resolve the objection within 15 days, the Controller may terminate the affected Services on written notice and receive a pro-rata refund of any prepaid fees.

8.4 Flow-down. The Processor imposes data protection obligations on each Sub-Processor that are equivalent to those in this DPA, in particular the obligation to implement appropriate technical and organizational measures.

8.5 Liability. The Processor remains fully liable to the Controller for the performance of each Sub-Processor's obligations.

8.6 Status of SMTP provider. As of version subprocessors-2026-10, the SMTP provider used for transactional email has not yet been engaged. When it is engaged, it will be added to Annex B with the 30-day notice in §8.3.

9. Data Subject Rights

9.1 Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organizational measures, insofar as possible, in fulfilling the Controller's obligation to respond to requests for exercising the data subject's rights under Chapter III of the GDPR (Articles 12–22).

9.2 The Services provide features that allow the Controller to access, correct, export, and delete Personal Data without the Processor's involvement. The Processor will provide additional assistance on request at privacy@athelos.pro.

9.3 If a data subject contacts the Processor directly with a request concerning Personal Data controlled by the Controller, the Processor will forward the request to the Controller without undue delay and will not respond to the data subject except to confirm the referral.

10. Deletion and Return

10.1 The retention periods for each category of data are set out in docs/legal/RETENTION.md (version retention-2026-10, Annex C).

10.2 On termination of the Terms of Service, Personal Data is deleted in accordance with Annex C. Deletion is verified through an audit log entry whose subject is identified by a salted SHA-256 hash rather than by the plaintext tenant ID.

10.3 The Controller may request a complete export of Personal Data before deletion, in a machine-readable format, by writing to privacy@athelos.pro. The Processor will provide the export within 30 days of the request.

10.4 The Processor will not retain Personal Data after the retention period in Annex C except where required by law. Where retention is required by law (for example, billing records for tax purposes), the Processor will inform the Controller of the retention period and the legal basis.

11. Breach Notification (Article 33)

11.1 In the event of a Personal Data breach, the Processor will notify the Controller without undue delay after becoming aware of the breach, and in any event within 24 hours of confirming a breach has occurred.

11.2 The notification will include, to the extent then known: the nature of the breach; the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach; and the contact point for further information.

11.3 The Processor will provide reasonable assistance to the Controller in meeting the Controller's own obligations under Articles 33 and 34, including assistance in assessing risk to data subjects and preparing any required notification to a supervisory authority.

11.4 The Processor documents all Personal Data breaches, including the facts, effects, and remedial action taken, in a breach register retained for 7 years.

12. Audits

12.1 The Processor will make available to the Controller all information necessary to demonstrate compliance with the obligations in Article 28 and this DPA.

12.2 The Controller may conduct audits of the Processor's compliance with this DPA. Audits must be:

• Announced in writing at least 30 days in advance.
• Conducted no more than once per calendar year, unless required following a Personal Data breach.
• Conducted during normal business hours and without unreasonable disruption to the Processor's operations.
• Conducted subject to confidentiality obligations at least as strict as those in the Terms of Service.

12.3 The Processor's published third-party attestations (such as any SOC 2 report the Processor makes available) may be accepted in lieu of a direct audit, at the Controller's reasonable discretion.

12.4 The Processor may charge a reasonable fee for audit support that exceeds routine assistance.

13. International Transfers

13.1 The Processor will not transfer Personal Data outside the European Economic Area except in accordance with the GDPR Chapter V.

13.2 Where a Sub-Processor is located outside the EEA, the transfer is governed by appropriate safeguards, as described in Annex B. Specifically:

• Backblaze (United States): EU Standard Contractual Clauses (Module Two: controller-to-processor).
• Cloudflare (United States): EU Standard Contractual Clauses (Module Three: processor-to-processor).
• Stripe: Intra-EU for EU customers via Stripe Payments Europe; Standard Contractual Clauses for non-EU customers.
• Postmark / ActiveCampaign (United States): EU Standard Contractual Clauses (Module Two: controller-to-processor). Postmark does not maintain EU-resident servers; all transactional email data is stored and processed in the United States under the SCCs in Postmark's DPA.

13.3 The Controller authorizes these transfers under the safeguards above.

14. Liability

14.1 Each party is liable to the other for damage caused by a breach of this DPA, in accordance with Article 82 of the GDPR and the liability provisions of the Terms of Service.

14.2 Where the Processor is held liable for damage caused by a Sub-Processor, the Processor will seek recovery from that Sub-Processor as described in §8.5.

14.3 Nothing in this section limits liability that cannot be limited by law.

15. Governing Law and Jurisdiction

This DPA is governed by the laws of Ireland. Disputes arising from this DPA are resolved under §14 of the Terms of Service, except where mandatory provisions of the Controller's local law require otherwise.

Annex A — Terms of Service

See docs/legal/TERMS.md (version tos-2026-10). This DPA is an annex to and part of the Terms of Service.

Annex B — Sub-Processor List

See docs/legal/SUB-PROCESSORS.md (version subprocessors-2026-10).

Annex C — Data Retention & Deletion Policy

See docs/legal/RETENTION.md (version retention-2026-10).

Version History