Effective Date: September 28, 2026
1. Purpose
This Data Processing Agreement ("DPA") describes the processing of personal data by AURIX SHIELD on behalf of a customer in connection with the Service.
The DPA is intended to apply where the customer acts as a controller or business and AURIX SHIELD processes personal data on the customer's behalf as part of providing the Service.
Not all information processed by AURIX SHIELD is necessarily personal data. Examples may include account information, security findings, website/target information, repository information, source-code-related information, monitoring information, support information, and information included in security evidence.
2. Definitions
- Customer: The entity or individual using the Service.
- AURIX SHIELD: The provider of the security platform and related services.
- Personal Data: Information relating to an identified or identifiable individual.
- Processing: Any operation performed on personal data, such as collection, storage, use, or deletion.
- Controller: The entity that determines the purposes and means of processing personal data.
- Processor: The entity that processes personal data on behalf of the controller.
- Data Subject: The individual to whom the personal data relates.
- Subprocessor: A third party engaged by the processor to process personal data on behalf of the controller.
- Service: The AURIX SHIELD platform and its provided features.
These terms may have different meanings under different privacy laws depending on the applicable jurisdiction.
3. Roles of the Parties
The Customer generally determines what personal data is submitted, why it is processed, which targets or repositories are analyzed, and what instructions AURIX SHIELD receives.
AURIX SHIELD processes relevant personal data to provide the Service according to the customer's instructions and the applicable agreement.
AURIX SHIELD may act independently as a controller for certain information needed for account administration, security, billing, legal compliance, abuse prevention, and service operations. For more information on those processing activities, please review our Privacy Policy.
4. Subject Matter of Processing
The processing may relate to providing:
- Website Security
- Domain Verification
- GitHub Security
- Security scanning
- Security findings
- Fix & Verify
- Monitoring
- AURIX AI / Ask AURIX
- Support and related product functionality
5. Types of Personal Data
Depending on the customer's use of the Service, personal data processed may include:
- Names or identifiers where provided
- Email addresses
- Account identifiers
- Usernames
- Repository-related identifiers
- IP addresses
- Technical information
- Authentication-related information
- Source-code-related information where it contains personal data
- Security findings and evidence
- File paths or repository information
- Support communications
- Information included in prompts or requests
- Monitoring information
6. Categories of Data Subjects
Depending on the customer's use of the Service, data subjects may include:
- Customer personnel
- Developers
- Administrators
- Users of customer applications
- Website visitors where their information is present in customer-controlled systems
- Individuals whose information may appear in source code, logs, security evidence, or other customer-provided data
The customer is responsible for determining whether it is authorized to submit such information.
7. Customer Instructions
AURIX SHIELD processes personal data according to the customer's use of the Service, these Terms, the applicable product configuration, and documented instructions provided through the Service or applicable agreement.
If a customer provides a specific processing instruction that conflicts with the Service's technical capabilities, AURIX SHIELD may need to clarify whether the requested processing can be supported.
8. AURIX SHIELD Responsibilities
AURIX SHIELD will:
- Process personal data only as necessary to provide the applicable Service and according to applicable instructions
- Maintain appropriate technical and organizational safeguards
- Restrict access to authorized personnel and service providers as appropriate
- Use personal data only for legitimate Service operations and other purposes permitted by the applicable agreement or law
- Assist customers with reasonable privacy-related requests where applicable
9. Customer Responsibilities
Customers are responsible for:
- Having an appropriate legal basis for processing personal data
- Providing required notices to data subjects
- Obtaining required permissions and authorizations
- Ensuring that submitted websites and repositories are authorized
- Ensuring that information submitted to AURIX SHIELD may lawfully be processed
- Configuring the Service appropriately
- Responding to data-subject requests where the customer is responsible for doing so
AURIX SHIELD does not determine the customer's legal basis for processing personal data.
10. Security Measures
AURIX SHIELD uses reasonable technical and organizational measures appropriate to the Service. Measures may include authentication, authorization controls, access restrictions, secure communications, security monitoring, logging, infrastructure access controls, secure development practices, and operational security controls.
11. Confidentiality
Personnel and service providers with access to customer personal data should be subject to appropriate confidentiality obligations.
12. Subprocessors
AURIX SHIELD may use service providers/subprocessors to support the Service. Potential categories may include:
- Authentication
- Database infrastructure
- Cloud infrastructure
- Security scanning infrastructure
- AI processing
- Email delivery
- Monitoring
- Error reporting
- Payment processing
Subprocessors may process information only as necessary to provide their services and are subject to appropriate contractual and security requirements.
13. AI Processing
Because AURIX SHIELD includes AURIX AI and Ask AURIX, depending on the feature used, relevant information may be processed by AI infrastructure to generate requested responses.
This may include relevant security findings, severity, scanner information, repository information, file information, rules, evidence, verification information, and user prompts/questions.
AURIX AI output is an assistance feature and does not itself constitute security verification.
14. Data Subject Requests
Where applicable, AURIX SHIELD will provide reasonable assistance to help the customer respond to data-subject rights requests (such as access, correction, deletion, restriction, objection, or portability).
The customer remains responsible for responding to data subjects where it acts as a controller. AURIX SHIELD may need sufficient information to identify the relevant data.
15. Security Incidents
If AURIX SHIELD becomes aware of a security incident involving customer personal data processed under the DPA, it will take reasonable steps to investigate and mitigate the incident.
Where notification is legally required, AURIX SHIELD will provide information to the customer as required by applicable law.
16. Government and Legal Requests
AURIX SHIELD may disclose information where required by applicable law or valid legal process. Where legally permitted and appropriate, AURIX SHIELD may provide reasonable notice to the customer.
17. International Data Processing
AURIX SHIELD and its service providers may process data in countries other than the customer's country. Where applicable law requires safeguards for international transfers, the parties intend to use appropriate lawful mechanisms.
18. Data Retention and Deletion
AURIX SHIELD will retain customer personal data for as long as reasonably necessary to provide the Service and according to applicable contractual, security, legal, and operational requirements.
When the customer relationship ends, AURIX SHIELD will handle customer personal data according to the applicable Service terms, Privacy Policy, and applicable legal requirements.
Where deletion or return is applicable and technically supported, AURIX SHIELD will take reasonable steps consistent with those requirements. Some information may need to be retained where legally or operationally necessary.
19. Audit / Compliance Information
Customers may request reasonable information about AURIX SHIELD's relevant privacy and security practices where appropriate. Any audit or assessment must be reasonable and must not compromise the security or confidentiality of AURIX SHIELD or other customers.
20. Government / Customer Data Responsibility
Customers should not provide personal data to AURIX SHIELD unless they have the appropriate authorization and legal basis to do so.
Customers remain responsible for data minimization, lawful collection, appropriate notices, permissions, and accuracy where relevant.
21. Relationship to Other Terms
This DPA supplements the Terms of Service for applicable processing of personal data. If there is a conflict concerning data processing, the applicable DPA provisions should govern only to the extent necessary for the relevant processing obligations, subject to applicable law.
22. Changes to This DPA
AURIX SHIELD may update the DPA when the Service changes, processing activities change, legal requirements change, or privacy/security practices change. Material changes will be communicated where required. The effective date will be updated when changes are made.
23. Contact
Privacy:
privacy@aurixshield.com
Legal:
legal@aurixshield.com
Security:
security@aurixshield.com
General:
contact@aurixshield.com