Data Processing Agreement (DPA) — Defneo Cloud

1. Parties and subject matter

The processor is VAULT APPS SRL, tax ID 37880060, Trade Register J29/1679/2017, registered office Str. Cireșoaia nr. 15, Ploiești, Prahova County, Romania. The controller is the Defneo Cloud account holder, on behalf of their organisation. The subject matter is hosting and processing the data put into the Defneo Cloud workspace, for the life of the account.

2. Nature of processing, data and data subjects

Processing consists of storage, display, computing scores and reports, passive checks on the customer's domains and receiving data from agents the customer installs.

• data subjects: the customer's employees and contractors, workspace members, learners, supplier contacts, people in the customer's GDPR registers;
• data categories: names, e-mail addresses, roles, training results, user accounts and processes reported by agents, IP addresses, host names, data in the compliance registers the customer enters;
• the customer must not enter special categories of data (Art. 9 GDPR) unless it has a legal basis and has told us in advance.

3. The controller's instructions

We process data only to provide the service and on the customer's documented instructions — configuring and using the workspace are such instructions. If an instruction breaches the law, we inform the customer. We do not use customer data for any other purpose, including training AI models.

4. Confidentiality

People authorised to access customer data are bound by confidentiality and access it only when needed to operate the service, for support the customer requests, or a legal obligation.

5. Security measures (Art. 32 GDPR)

• per-customer isolation: each customer has its own database schema, chosen from the request context; a request with no identified customer is refused, never served from a shared schema;
• password-less sign-in with short-lived, attempt-limited e-mailed codes; HttpOnly/Secure sessions; roles (admin, operator, viewer) checked on every request;
• agents authenticate with keys specific to each customer and can report only into that account; API tokens expire within 90 days and are stored only as a cryptographic digest;
• TLS-encrypted traffic; protection against server-side request forgery (SSRF); active scans run only on domains with proven ownership;
• servers are operated by us in Romania and protected by the same Defneo platform (WAF, attack detection and blocking).

6. Sub-processors

As of this version, Defneo Cloud uses no sub-processor for workspace data: hosting is on our own infrastructure, AI features with external providers are disabled, and sending e-mail to learners is turned off.

The customer gives us general authorisation to engage sub-processors. Before adding one we update this list and notify customers by e-mail at least 30 days in advance; the customer may object on reasonable grounds and, if no solution is found, close the account. Every sub-processor is bound by equivalent data protection obligations.

Passive checks on the customer's domains query public sources (DNS, Certificate Transparency logs such as crt.sh) with the domain name; they receive no personal data from the workspace.

7. International transfers

Workspace data is stored in Romania and is not transferred outside the European Economic Area.

8. Assistance to the controller

We help the customer, through the service's features and on request, to answer data subject requests, carry out impact assessments and meet its security obligations. If we receive a request directly from a data subject we forward it to the customer.

9. Personal data breaches

We notify the customer without undue delay and within 48 hours of becoming aware of a breach affecting its data, with the available information on its nature, impact and the measures taken, so the customer can meet its 72-hour notification duty.

10. Return and deletion of data

While the account is active, the customer can extract its data through exportable reports and the API. When the account is closed we delete the workspace and its data within 30 days, except what the law requires us to keep.

11. Audit

We make available to the customer the information needed to demonstrate compliance with Art. 28 GDPR and allow reasonable audits, announced at least 30 days in advance and carried out without affecting other customers. Requests go to office@vaultapps.ro.

12. Term and precedence

This agreement applies for as long as we process customer data. If it conflicts with the Terms, this agreement prevails on data protection. Customers who need a signed DPA may write to us for a signed copy of this text.