Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the SaaS Subscription Agreement between Qarmiq, Inc. ("Qarmiq", "Processor") and the Customer ("Customer", "Controller"). It applies where Qarmiq processes personal data on behalf of the Customer through the Service.

This DPA is intended to satisfy Article 28 of the EU and UK General Data Protection Regulation (GDPR), Australian Privacy Principle 8, the Digital Personal Data Protection Act 2023 (DPDP), and equivalent provisions in other applicable data protection laws. Where Customer Data includes EU or UK personal data transferred outside the EEA or UK, the Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA) are incorporated by reference and attached as Schedule 3.

Definitions

Capitalized terms not defined here have the meanings given in the SaaS Subscription Agreement. The terms "Controller", "Processor", "Data Subject", "Personal Data", "Processing", and "Sub-processor" have the meanings given in the GDPR.

Where the Digital Personal Data Protection Act, 2023 (‘DPDP Act’) applies, references to "Controller", "Processor", and "Data Subject" shall be read as references to "Data Fiduciary", "Data Processor", and "Data Principal", respectively.

Subject Matter and Scope

The Customer is the Controller of Personal Data that it or its Users submit to or generate through the Service. Qarmiq is the Processor of that Personal Data. Except where processing is required by applicable law, Qarmiq processes Personal Data only on the Customer's documented instructions, which include the SaaS Subscription Agreement, this DPA, and any Order Form, If Qarmiq believes an instruction violates applicable data protection law, it will inform the Customer promptly.

Processing details (Schedule 1)

The details of the Processing are set out in Schedule 1 below.

Processor obligations

Qarmiq will:

(i) Process Personal Data only for the purposes described in Schedule 1 and on the Customer's documented instructions;

(ii) Ensure that personnel authorized to process Personal Data are under appropriate confidentiality obligations;

(iii) Implement and maintain the technical and organizational security measures described in Schedule 2;

(iv) Assist the Customer in responding to requests from Data Subjects exercising their rights under applicable laws, by appropriate technical and organizational measures and taking into account the nature of the Processing;

(v) Assist the Customer in ensuring compliance with its obligations relating to security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities, taking into account the information available to Qarmiq;

(vi) At the Customer's choice, return or delete Personal Data on termination of the Subscription Term, in accordance with the SaaS Subscription Agreement, unless retention is required by law;

(vii) Make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, and allow for audits as set out in Section 8.

Controller obligations

The Customer will:

(i) Be responsible for the lawful basis on which it collects and discloses Personal Data to Qarmiq;

(ii) Provide all required notices and obtain all required consents from Data Subjects for the processing of Personal Data;

(iii) Ensure that its use of the Service complies with applicable data protection law;

(iv) Issue all Processing instructions in compliance with applicable data protection law.

Sub-processors

6.1 General authorization

The Customer gives Qarmiq general authorization to engage Sub-processors to provide the Service, subject to this Section 6. A current list of Sub-processors is maintained as Schedule 4.

6.2 Sub-processor obligations

Qarmiq will impose on each Sub-processor data protection obligations no less protective than those in this DPA and remains responsible to the Customer for the performance of its Sub-processors' obligations.

6.3 Changes to Sub-processors

Qarmiq will provide at least thirty (30) days' notice of any intended addition or replacement of a Sub-processor (by updating Schedule 4 and notifying customers who have subscribed for such notifications). The Customer may object on reasonable grounds related to data protection within that notice period. If the parties cannot resolve the objection, the Customer may terminate the affected Order Form, with refund of pre-paid Fees for the unused portion as its sole remedy.

International data transfers

The Service involves Personal Data flows across the following regions in the ordinary course of operation:

(i) United States (AWS us-east-1): S3-stored evidence and artifacts from autonomous checks.

(ii) United States (DigitalOcean Managed MongoDB in New York; Hostinger application server in Massachusetts; Fly.io runners in New Jersey): scenarios, checks, runs, verdicts, defects, coverage data, audit logs, AI conversation history, user and organization metadata, and the execution of autonomous checks.

(iii) United States: AI provider infrastructure (OpenAI, Anthropic), and optional Customer-configured integrations (GitHub), and transactional email delivery (Resend).

(iv) Global edge: Cloudflare Turnstile bot-protection request handling.

Where Qarmiq transfers Personal Data of EU or UK Data Subjects to a country that is not the subject of an adequacy decision, the transfer will be governed by the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, for UK transfers, the UK International Data Transfer Addendum, each as attached at Schedule 3. The parties agree that the Customer is the data exporter and Qarmiq is the data importer. For Personal Data of Indian Data Subjects, the Customer warrants that it has secured all necessary authorizations, permissions, and valid consents from its Data Subjects, including for the cross-border transfers arising from the processing of that data outside India by the Sub-processors listed in Schedule 4 and from the Customer’s use of AI enabled features, in accordance with the DPDP Act.

Audits

Qarmiq will, on reasonable written request, provide the Customer with summaries of its most recent third-party security audits, certifications (where available), and the technical and organizational measures in place. Where the Customer reasonably requires additional information, Qarmiq will respond in good faith. Subject to reasonable confidentiality and security requirements, on-site audits will be permitted only where required by applicable law or a supervisory authority, at the Customer's cost, with reasonable notice, during business hours, without disrupting the Service or the data of other customers,

except where the audit identifies a material breach of this DPA by Qarmiq.

Audits may not be conducted more than once in any twelve (12)-month period unless required by applicable law.

Personal Data Breach Notification

Qarmiq will notify the Customer without undue delay and, where required by applicable law within seventy-two (72) hours after becoming aware of a Personal Data breach affecting Customer Data. The notification will describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned (where known), the likely consequences, and the measures taken or proposed. Qarmiq will cooperate with the Customer's reasonable investigation and remediation efforts. For clarity, notification of a Personal Data breach shall not constitute an admission of fault or liability by Qarmiq.

Return or deletion of Personal Data

On expiry or termination of the Subscription Term, Qarmiq will make Personal Data available for export for thirty (30) days, after which it will be permanently deleted from production systems, in accordance with the SaaS Subscription Agreement. Backups will be deleted in the normal course of business in line with backup retention schedules within ninety (90) days.

Liability

The liability provisions in the SaaS Subscription Agreement shall apply to this DPA. Any claims under this DPA are subject to the same limitations.

Term and Termination

This DPA takes effect on the effective date of the SaaS Subscription Agreement and terminates automatically when the last Order Form expires or is terminated. The obligations relating to confidentiality, security, return or deletion of Personal Data, and applicable transfer mechanisms survive termination.

Governing law

This DPA is governed by the same law as the SaaS Subscription Agreement, except where mandatory provisions of EU or UK or Indian data protection law require otherwise (including in respect of the SCCs and the UK IDTA at Schedule 3).

Nothing in this DPA shall limit or exclude the application of any mandatory provisions of applicable data protection laws that apply to the Processing of Personal Data under this DPA.

Schedule 1: Processing details

Schedule 2: Security measures

Qarmiq maintains the following technical and organizational measures. These measures may be updated from time to time provided that the overall level of protection is not materially diminished.

(i) Encryption in transit. All connections to the Service use TLS 1.2 or higher. HTTP Strict Transport Security (HSTS) is enforced with a max-age of twelve (12) months.

(ii) Encryption at rest, application layer. Customer-supplied authentication credentials (stored for automation purposes) and stored API keys are encrypted using AES-256-GCM authenticated encryption, with the encryption key held separately from the database.

(iii) Encryption at rest, storage layer. Bulk Customer Data stored in AWS S3 and on its managed database (DigitalOcean Managed MongoDB) is encrypted at rest using the provider's default encryption (AWS-managed keys and DigitalOcean-managed keys respectively). Customer-managed key (CMK) encryption is not currently offered.

(iv) Access control. Role-based access enforced at the application layer; project-scoped membership checks gate access to Customer Data on every request. Two-factor authentication is available to users and is recommended for enterprise deployments. It is not enforced by default.

(v) Personnel access. Infrastructure access is restricted to authorized Qarmiq personnel using SSH keys and AWS IAM permissions scoped to the minimum necessary for the role.

(vi) Logical separation. Customer Data is logically separated by organization and project membership checks enforced at the application layer.

(vii) Logging and monitoring. A dedicated audit-log module records security-relevant events (authentication, authorization changes, data access, data export, configuration changes, and similar) in the platform's audit-log collection. Logging and monitoring measures are implemented as per the security program of Qarmiq and may be enhanced from time to time.

(viii) Bot and abuse protection. Cloudflare Turnstile is enabled on public endpoints.

(ix) Backups. Backups of managed databases are taken by the respective managed-database providers in accordance with their default schedules. Object-storage data in AWS S3 is subject to lifecycle policies that may move older artifacts to cold storage. Formal Recovery Time Objectives and Recovery Point Objectives are not currently published; the Customer may request the current operational targets in writing.

(x) Disaster recovery. The Service is currently deployed in a single region in the United States. The Service does not currently include cross-region failover or a formally documented multi-region disaster recovery capability. Customers requiring multi-region resilience should contact us before contracting.

(xi) Personnel. Confidentiality obligations apply to all personnel with access to Customer Data. Background checks (where lawful) and security awareness training are deployed in proportion to role and access level as the organization scales.

(xii) Vendor management. Sub-processors are selected to maintain a security baseline materially equivalent to the measures in this Schedule. The current sub-processor list is set out in Schedule 4.

(xiii) Vulnerability and patch management. Application dependencies and infrastructure components are updated on a regular cadence following security review and testing. Automated continuous dependency scanning (for example via Dependabot or Snyk) is on the roadmap.

(xiv) Incident response. Qarmiq maintains internal incident-response procedures including roles, escalation paths, and Customer notification timelines consistent with Section 9 of this DPA. A formal, externally-audited incident-response runbook is in development.

Schedule 3: International transfer mechanisms

Where applicable, the following are incorporated by reference and form part of this DPA:

(i) Standard Contractual Clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (Controller to Processor). The Customer is the data exporter; Qarmiq is the data importer.

(ii) The UK International Data Transfer Addendum to the EU Standard Contractual Clauses (Version B1.0, in force 21 March 2022), where personal data of UK Data Subjects is transferred.

Schedule 4: Sub-processors

The following Sub-processors are engaged by Qarmiq to process Customer Data. This list is current as of the "Last updated" date on this DPA and is updated as Sub-processors change.

BYOAI calls (where the Customer supplies its own AI provider keys) are routed through Qarmiq's orchestration layer to the Customer's chosen AI provider. That AI provider acts as an independent processor under the Customer's own agreement with it. The Customer retains responsibility for selecting providers, managing keys, and complying with the provider's terms. Qarmiq shall not be responsible for the Customer's selection or use of such provider.

Optional Customer-configured connectors and MCP clients. The Customer may configure connectors and MCP clients of its choice for exchanging findings, verdicts and scenarios. Recipients of such exchanges are not Sub-processors of Qarmiq; the Customer is solely responsible for the security and lawful processing of Personal Data sent to those endpoints.

Sub-processors not currently engaged. Qarmiq does not currently engage a dedicated error-reporting / observability provider (for example, Sentry or Datadog). If and when such Sub-processors are engaged, this Schedule will be updated with at least thirty (30) days' prior notice, in line with Section 6.3 of this DPA.

Contact

Questions about this DPA can be sent to contact@qarmiq.ai.

Questions about this document can be sent to contact@qarmiq.ai.