Data Processing Addendum

1. Scope & Roles

For personal data in Customer Data, Customer is the controller (or a processor acting for its own controller) and CertiQA is the processor (or sub-processor). CertiQA is the controller of the personal data it holds for its own purposes, such as account, billing and security records, which the Privacy Policy covers. "Applicable Data Protection Law" means the laws that apply to the processing, including, where applicable, the GDPR, the UK GDPR and the California Consumer Privacy Act as amended. Terms used here have the meaning those laws give them.

2. Instructions

CertiQA will process personal data only on Customer's documented instructions, which are the Terms, this DPA, Customer's configuration and use of the Service, and any further written instruction both parties agree. CertiQA will not sell or share the personal data, retain, use or disclose it outside the direct business relationship, or for any purpose other than providing the Service, or combine it with other personal data except as the law permits. CertiQA will tell Customer if it believes an instruction infringes Applicable Data Protection Law. CertiQA will not use Customer Data to train foundation models.

3. Confidentiality

CertiQA will ensure that people it authorizes to process the personal data are bound by confidentiality obligations and process it only as needed to provide the Service.

4. Security

CertiQA will implement technical and organizational measures appropriate to the risk, including those in Annex II. CertiQA may update them if the update does not materially reduce the protection of the personal data.

5. Subprocessors

Customer gives CertiQA general authorization to engage the subprocessors in Annex III. CertiQA will flow down data protection obligations that are no less protective than this DPA and remains responsible for its subprocessors' performance. CertiQA will notify Customer of a new or replacement subprocessor at least 30 days before it processes Customer personal data, by updating the list on its Security page and emailing the account's administrators. Customer may object on reasonable data-protection grounds within 14 days of the notice; the parties will work in good faith to resolve the objection, and if they cannot, Customer may stop using the affected part of the Service and cancel its subscription under the Terms before the change takes effect.

Model providers that Customer selects and controls, such as Customer's own provider account or a self-hosted endpoint, are not CertiQA subprocessors for that processing. Customer's relationship with them is governed by Customer's agreement with the provider.

6. Assistance & Requests

Taking into account the nature of the processing, CertiQA will help Customer respond to requests from individuals to exercise their rights, and with security, breach notification, impact assessments and prior consultation, to the extent Customer cannot do so itself through the Service. If CertiQA receives a request about Customer's personal data, it will direct the individual to Customer and will not respond substantively unless the law requires it. Customer administrators can export and delete workspace data in the product.

7. Personal Data Breach

CertiQA will notify Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer personal data, and will give the information it has that Customer needs to meet its own obligations, updating it as the investigation proceeds. The notice goes to the workspace's administrators.

8. Deletion & Return

On termination or expiry, CertiQA will delete Customer personal data, or return it on request made before deletion, according to the retention schedule in the Privacy Policy and the Terms, unless the law requires CertiQA to keep it. Deleted data may remain in encrypted database backups until they expire, up to 7 days after deletion, and deleted screenshots and traces may remain in storage version history for up to 7 more days.

9. Audit Information

CertiQA will make available the information needed to show compliance with this DPA, answer reasonable security questionnaires, and, once in any 12-month period or after a personal data breach, allow an audit by Customer or an independent auditor it appoints, on at least 30 days' written notice, during business hours, at Customer's cost, under confidentiality, limited to the systems that process Customer personal data and without access to other customers' data. CertiQA may meet an audit request by providing documentation or a written answer to a security questionnaire where that gives the same assurance. CertiQA does not currently hold SOC 2 or ISO 27001 reports and will not describe itself as if it did.

10. International Transfers

CertiQA does not accept personal data that is subject to the restricted-transfer rules of the EEA, the UK or Switzerland, and Customer must not submit such data to the Service. If the parties later want CertiQA to process such data, they will first agree in writing the transfer mechanism that applies (for example the EU Standard Contractual Clauses and the UK Addendum), which will then be attached to this DPA.

11. General

This DPA takes effect when Customer's administrator accepts it and lasts while CertiQA processes the personal data. If it conflicts with the Terms on data protection matters, this DPA prevails. Each party's liability under this DPA is subject to the limitations and exclusions in the Terms. Questions: legal@certiqa.app.

Annex I: Details of Processing

• Subject matter and nature: hosting and running automated tests, storing results and reports, and providing the AI-assisted features Customer enables.
• Duration: the term of the Terms, plus the deletion period in section 8.
• Categories of data subjects: Customer's personnel and users of the Service; individuals whose data appears in the applications, test data, recordings or agent conversations Customer tests. Customer must not submit special categories of personal data (for example health, biometric or government-identifier data) unless the parties agree otherwise in writing.
• Categories of personal data: account and contact details, usage logs, and any personal data present in test inputs, screenshots, traces, reports and agent transcripts that Customer chooses to submit.

Annex II: Security Measures

The measures are those described on the Security page, including encryption of stored secrets with AES-256-GCM, tenant isolation, role-based access control, outbound-only test runners, and logging of administrative actions. This DPA makes no commitment about availability, recovery time objectives or recovery point objectives.

Annex III: Subprocessors

List version 2026-10-26, updated 2026-10-26. The current list is also at certiqa.app/security.

• Amazon Web Services, Inc.: Core cloud infrastructure, database and artifact storage. Location: United States (us-east-1).
• Cloudflare, Inc.: Edge routing, CDN, DDoS mitigation and bot checks. Location: Global edge network.
• WorkOS, Inc.: Authentication, enterprise SSO and directory sync. Location: United States.
• Stripe, Inc.: Payment processing and subscription billing. Location: United States.
• Brevo (Sendinblue SAS) (details to be confirmed): Transactional email (approvals, invitations, billing, support and alert emails) and the early-access list. Location: European Union (to be confirmed).
• Mailtrap (Railsware) (details to be confirmed): Backup transactional email, used only if the primary email provider fails. Location: To be confirmed.
• Google LLC (Gemini) (details to be confirmed): Platform-controlled model processing for AI features. Location: Provider-dependent (contracting entity and region to be confirmed).
• Anthropic, PBC (details to be confirmed): Platform-controlled model processing for AI features. Location: Provider-dependent (contracting entity and region to be confirmed).

Not CertiQA subprocessors for that processing: Customer-selected model providers. AI feature processing with a provider account or self-hosted endpoint the customer configures, such as OpenAI, Anthropic, Gemini or a self-hosted model. The customer controls this relationship and its terms.