Data Processing Agreement

Version 1.0, effective 10/23/2026. Published at https://apisec.ai/dpa. Incorporated by reference into the APIsec Master Subscription Agreement. On written request APIsec will provide a dated PDF of the version in effect on an Order Form’s Effective Date.

This Data Processing Agreement, defined as the DPA in Section 7.6 of the MSA, forms part of the MSA between APIsec and Customer and applies to APIsec’s processing of Personal Data on Customer’s behalf. It is deemed executed upon execution of an Order Form referencing the MSA.

1. Definitions

“Controller,” “Processor,” “Data Subject,” “Processing,” and “Supervisory Authority” have the meanings given in the GDPR. “Data Protection Laws” means all laws applicable to the processing of Personal Data under the MSA, including the GDPR, the UK GDPR, the Swiss FADP, the CCPA, and other applicable U.S. state privacy laws. Capitalized terms not defined here have the meanings given in the MSA.

2. Roles

Customer is the Controller (or, where Customer acts as a processor for a third party, the processor) and APIsec is the Processor (or subprocessor) with respect to Personal Data within Service Data. For purposes of the CCPA, APIsec is a “Service Provider” and does not “sell” or “share” Personal Data as those terms are defined in the CCPA.

3. Scope and Instructions

APIsec will process Personal Data only (a) in accordance with Customer’s documented instructions, which are the MSA, this DPA, the applicable Order Form, and Customer’s use of the Services; and (b) as required by applicable law, in which case APIsec will inform Customer of that requirement before processing unless prohibited by law. APIsec will promptly inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

4. Details of Processing

The subject matter, duration, nature, purpose, categories of Data Subjects, and types of Personal Data are set out in Annex I. Annex I must account for two distinct categories: (a) account data relating to Customer’s Authorized Users; and (b) any Personal Data contained in Evidence Data captured from environments Customer directs the Services to test, the categories of which are determined by Customer’s scope configuration under Section 6.5 of the MSA.

5. Confidentiality

APIsec ensures that persons authorized to process Personal Data are bound by confidentiality obligations and have received appropriate training.

6. Security

APIsec implements and maintains the technical and organizational measures described in Annex II, which incorporates the APIsec Security Exhibit, taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of processing.

7. Sub-Processors

Customer provides general written authorization for APIsec to engage Sub-Processors. The current Sub-Processor List and the notice and objection process are set out in Section 6.9 of the MSA. APIsec imposes data protection obligations on each Sub-Processor no less protective than those in this DPA and remains fully liable for each Sub-Processor’s performance.

8. Data Subject Rights

Taking into account the nature of the processing, APIsec will assist Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling Customer’s obligation to respond to Data Subject requests. If APIsec receives such a request directly, it will not respond substantively and will redirect the Data Subject to Customer and notify Customer without undue delay.

9. Assistance

APIsec will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with Supervisory Authorities, and with Customer’s obligations relating to the security of processing and to personal data breach notification, in each case taking into account the nature of the processing and the information available to APIsec.

10. Personal Data Breach

APIsec will notify Customer in accordance with Section 6.11 of the MSA.

11. Audit

APIsec will make available to Customer the information necessary to demonstrate compliance with this DPA. Customer’s audit right is satisfied in the first instance by APIsec’s SOC 2 Type II report, penetration test summary, and completed security questionnaire as described in the Security Exhibit. Where Data Protection Laws require an on-site audit, Customer (or an independent auditor that is not a competitor of APIsec, bound by confidentiality) may conduct one audit per twelve (12) month period, on at least thirty (30) days’ written notice, during normal business hours, at Customer’s expense, and in a manner that does not disrupt APIsec’s operations or compromise the confidentiality of other customers’ data. Additional audits may be conducted following a confirmed Security Incident affecting Customer’s Personal Data.

12. International Transfers

Where processing of Personal Data subject to the GDPR involves a transfer to a country that has not received an adequacy decision, the EU Standard Contractual Clauses set out in Annex III apply, with Module Two (Controller to Processor) or Module Three (Processor to Processor) as applicable, Customer as data exporter and APIsec as data importer. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum in Annex IV applies. For transfers subject to the Swiss FADP, the SCCs apply with the modifications set out in Annex IV. Hosting location is governed by Section 6.8 of the MSA.

13. Export and Deletion

Upon termination, APIsec will make Personal Data available to Customer for export and will then delete it, in each case in accordance with Section 3.4(d) of the MSA.

14. Conflict

In the event of a conflict between this DPA and the MSA regarding the processing of Personal Data, this DPA controls. In the event of a conflict between this DPA and the SCCs, the SCCs control.

15. Liability

Each Party’s liability under this DPA is subject to the limitations set out in Section 10 of the MSA, except to the extent Data Protection Laws prohibit such limitation.

Annexes to be completed by counsel

• Annex I: List of Parties; Description of Transfer (categories of Data Subjects, categories of Personal Data, sensitive data if any, frequency, nature and purpose, retention period, Sub-Processors); Competent Supervisory Authority.
• Annex II: Technical and Organizational Measures (incorporate the Security Exhibit and map to SCC Annex II headings).
• Annex III: EU Standard Contractual Clauses, official text, Commission Implementing Decision (EU) 2021/914, with docking clause and module selections completed.
• Annex IV: UK International Data Transfer Addendum (IDTA or Addendum to the EU SCCs) and Swiss FADP modifications.