Data Processing Addendum

Roles and instructions

The customer is the controller and Smoke Test is the processor for customer data submitted to or collected from authorized targets. Smoke Test processes that data only to provide, secure, support, and improve the contracted service and as required by law.

Processing details

• Subject matter: automated security testing, findings management, reporting, support, and billing operations.
• Duration: the subscription term plus documented retention and backup periods.
• Data subjects: customer users and individuals whose data appears in authorized test environments or limited scan evidence.
• Data types: identifiers, account data, technical request and response excerpts, application metadata, security findings, and test credentials supplied by the customer.

Security and confidentiality

Smoke Test uses access controls, encryption in transit, encryption for stored credentials and sensitive findings, isolated scan workloads, logging, dependency review, and target-ownership checks. Personnel and contractors with access are bound by confidentiality obligations.

Subprocessors

The customer authorizes Amazon Web Services, Stripe, and OpenAI as subprocessors where their services are used. Smoke Test remains responsible for subprocessors to the extent required by applicable data-protection law and will use appropriate contractual safeguards for international transfers.

Assistance and incidents

Taking into account the nature of processing, Smoke Test will reasonably assist with data-subject requests, security assessments, breach obligations, and deletion or return requests. Smoke Test will notify the customer without undue delay after confirming a personal-data breach affecting customer data.

Audit and deletion

On reasonable written request, Smoke Test will provide information needed to demonstrate compliance. Where legally required and proportionate, the parties will arrange an audit subject to confidentiality and operational safeguards. At termination, customer data will be deleted or returned on request unless retention is legally required.

Execution

This addendum forms part of the Smoke Test Terms when a customer uses the service to process personal data. Contact admin@smoketest.pro for a countersigned copy or customer-specific transfer terms.