Data processing agreement

This agreement (“DPA”) forms part of the terms of service and meets Article 28 of the General Data Protection Regulation (GDPR). It is concluded between the Customer, as controller, and szczesny.com Radosław Szczęsny, ul. Obwiednia Południowa 62B/13, 44-200 Rybnik, Poland, NIP 6472381490, as processor (“we”), when the Customer accepts the terms. A countersigned copy is available on request at privacy@permiscope.com.

1. Subject, duration and purpose

• Subject and purpose: providing the Permiscope service: an inventory and security assessment of AI-agent and MCP server configurations, monitoring of changes and alerting.
• Nature: receiving scan reports, storing, analysing and displaying them, sending notifications, and deleting data.
• Duration: while the Customer uses the Service, and until the data is deleted under section 9.

2. Data subjects and personal data

• Data subjects: the Customer’s employees, contractors and other users whose devices or repositories are scanned, and the Customer’s users of the app.
• Personal data: names and email addresses of users and alert recipients; device identifiers (a one-way hash), labels given by administrators and operating-system type; configuration paths (with the home folder replaced by “~”) and project paths, which may contain personal names; names of MCP servers, commands, arguments and environment variable names, with secret values redacted on the device; IP addresses and user agents of sessions; audit records.
• Special categories: none are intended. The Customer will not send them, and will not put personal data in device labels beyond what it needs.

3. Instructions

We process personal data only on the Customer’s documented instructions, which are these terms, this DPA and the Customer’s settings in the Service, including transfers to the sub-processors listed below, unless EU or Polish law requires otherwise; in that case we will tell the Customer first unless that law forbids it. We will tell the Customer if we believe an instruction breaks the GDPR.

4. Confidentiality

Everyone who can access personal data on our side is bound by confidentiality and has access only to the extent needed for the Service.

5. Security measures (Article 32)

• Encryption in transit (TLS, with HSTS) and at rest in the database.
• Each organization’s data is isolated in the database by row-level security enforced for the application’s own database role; the role has no rights beyond what the application needs.
• Secrets are redacted on the device before upload and again on the server; Slack and Teams webhook addresses are encrypted with a dedicated, rotatable key.
• Passwords are stored only as hashes; two-factor authentication is available; sign-in and upload rate limits; device tokens bound to a single device; role-based access within each organization.
• An append-only audit log of security-relevant actions; request logging that could capture tokens is switched off.
• Pinned and reviewed dependencies, automated tests for tenant isolation and authorization, regular security reviews, and a documented threat model.
• Automatic deletion of data at the end of the retention periods in our privacy policy.

We may update these measures as long as the overall level of protection does not decrease.

6. Sub-processors

The Customer gives general authorization to use these sub-processors:

We bind each sub-processor by a written agreement with obligations equivalent to this DPA and remain responsible for it. We will announce a new or replacement sub-processor by email to account owners at least 30 days in advance. The Customer may object on reasonable data-protection grounds within that period; if we cannot resolve the objection, the Customer may end the Service before the change takes effect.

7. Transfers outside the EEA

Personal data is stored in the EU. Where a sub-processor may access it from outside the European Economic Area, the transfer is covered by the EU–US Data Privacy Framework (where the recipient is certified) or the European Commission’s standard contractual clauses, with supplementary measures where needed.

8. Assistance and breaches

• We help the Customer, taking into account the nature of the processing, to answer data subjects’ requests, and with security, impact assessments and consultations with supervisory authorities. Requests we receive directly are passed on to the Customer.
• We notify the Customer of a personal data breach without undue delay, and in any case within 48 hours of becoming aware of it, with the information then available, and keep it updated.

9. Return and deletion

Before the Service ends, the Customer can export its data (findings as CSV, reports as PDF). The owner can delete the organization in the app at any time, which deletes its data at once; otherwise we delete the Customer’s personal data within 30 days after the end, unless the law requires us to keep it; backups are overwritten within a further 30 days. We confirm deletion in writing on request.

10. Audits

We make available the information needed to demonstrate compliance with this DPA, including answers to reasonable security questionnaires. The Customer, or an auditor bound by confidentiality, may audit us once a year with 30 days’ notice, or after a breach, during business hours and at the Customer’s cost, without access to other customers’ data.

11. Liability and precedence

Liability under this DPA follows the terms of service, except where the GDPR provides otherwise. If this DPA and the terms conflict on personal data protection, this DPA prevails.