Data Processing Agreement

"Controller" means the entity that determines the purposes and means of processing personal data — i.e., the TraceLayer customer.

"Processor" means TraceLayer, which processes personal data on behalf of the Controller.

"Personal Data" means any information relating to an identified or identifiable natural person, as defined by GDPR Article 4(1).

"Processing" has the meaning given in GDPR Article 4(2) and includes collection, storage, retrieval, use, disclosure, and deletion.

"Sub-processor" means any third party engaged by TraceLayer to process personal data on behalf of the Controller.

"Standard Contractual Clauses" (SCCs) means the European Commission's standard contractual clauses for international data transfers (Commission Decision 2021/914).

TraceLayer processes personal data to provide the compliance evidence collection and monitoring services described in the Terms of Service. Processing begins when the Controller connects an integration or creates an account and continues for the duration of the subscription, including any trial period.

Upon termination of the agreement, TraceLayer will delete or return all personal data in accordance with Section 10 (Data Retention and Return).

TraceLayer processes personal data for the following purposes:

• Providing the platform and its features (authentication, dashboard, evidence collection)
• Collecting compliance evidence from integrated third-party services on behalf of the Controller
• Generating compliance scores, reports, and audit packages
• Sending transactional emails (onboarding, alerts, weekly reports)
• Supporting users and resolving technical issues

Categories of data subjects: The Controller's employees, contractors, and system users whose data is surfaced via connected integrations (e.g., GitHub, AWS IAM, Slack, Google Workspace).

Categories of personal data: Email addresses, names, user identifiers, role and permission data, login events, IP addresses, and integration-specific metadata (e.g., GitHub commit authors, AWS IAM user records). TraceLayer does not collect sensitive categories of data (GDPR Article 9) by design.

The Controller warrants and represents that it:

• Has a lawful basis for processing personal data and for instructing TraceLayer to process on its behalf
• Has provided appropriate notices to data subjects and, where required, obtained valid consent
• Will only provide TraceLayer with the personal data necessary for the stated purposes
• Will inform TraceLayer promptly of any changes to applicable laws or regulatory requirements affecting the processing
• Is responsible for ensuring its instructions to TraceLayer comply with applicable data protection law

TraceLayer shall:

• Process personal data only on documented instructions from the Controller (including via product configuration), unless required to do so by EU or Member State law
• Ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations
• Implement appropriate technical and organisational security measures as described in Section 7
• Assist the Controller in responding to data subject rights requests (Section 8)
• Notify the Controller without undue delay (and no later than 72 hours) upon becoming aware of a personal data breach affecting Controller data
• Provide all information necessary to demonstrate compliance with this DPA and cooperate with reasonable audits upon 30 days' written notice
• Delete or return all personal data upon termination of the agreement (Section 10)

TraceLayer uses the following approved sub-processors. We will provide at least 30 days' notice before adding or replacing any sub-processor. If the Controller objects, it may terminate the affected services with a pro-rata refund.

TraceLayer has implemented the following technical and organisational measures in accordance with GDPR Article 32:

• Encryption in transit: All data transmitted between clients and servers uses TLS 1.2 or higher
• Encryption at rest: Database volumes and object storage are encrypted at rest using AES-256
• Credential security: Integration credentials are encrypted with Fernet symmetric encryption before storage; password hashes use bcrypt
• Access control: Production systems require multi-factor authentication; access is granted on a least-privilege basis
• Network security: API servers run behind firewalls with restricted inbound rules; security headers applied to all responses
• Audit logging: Material actions (logins, data exports, integration changes) are logged to an append-only audit log
• Vulnerability management: Dependencies are monitored for CVEs; critical patches applied within 24 hours

For a full description of our security posture, see our Security page.

TraceLayer will, to the extent technically feasible, assist the Controller in fulfilling data subject requests under GDPR Articles 15–22 (access, rectification, erasure, restriction, portability, objection). The Controller remains responsible for responding to data subjects; TraceLayer provides tooling and cooperation at the Controller's written request.

Controllers may request deletion of all personal data associated with their account by contacting privacy@tracelayer.it.com. TraceLayer will complete deletion within 30 days.

TraceLayer's infrastructure is primarily located in the United States. Transfers of personal data from the European Economic Area (EEA) to the United States are made under the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 2: Controller to Processor). By entering into this DPA, both parties are deemed to have executed the SCCs.

The SCCs are supplemented by the technical and organisational measures described in Section 7, which we assess as providing an essentially equivalent level of protection to that in the EEA.

TraceLayer retains personal data for the duration of the active subscription plus a 30-day grace period to allow data export. After this period, or upon written request from the Controller, TraceLayer will permanently delete all personal data from production systems within 30 days and from backups within 90 days.

Upon request, TraceLayer will provide written confirmation of deletion. The Controller may export their data at any time via the platform's export functionality.

Each party shall be liable for damages caused by processing that infringes applicable data protection law. TraceLayer's aggregate liability under this DPA shall not exceed the amounts paid by the Controller in the 12 months preceding the claim. The Controller indemnifies TraceLayer against third-party claims arising from the Controller's unlawful instructions or failure to comply with applicable law.

This DPA is governed by the law of the jurisdiction specified in the applicable Terms of Service. For EU/EEA customers, the applicable EU data protection law shall also apply with respect to processing covered by this DPA.

For questions about this DPA or to execute a countersigned copy for enterprise contracts, contact legal@tracelayer.it.com.