Data Processing Agreement

Overview

This Data Processing Agreement ("DPA") forms part of the kavachOS Cloud Terms of Service between GLINR (the "Data Processor") and the customer entity ("Data Controller") and sets out the terms under which GLINR processes personal data on behalf of the customer in connection with the kavachOS Cloud service.

This DPA is intended to comply with the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and equivalent data protection legislation in other applicable jurisdictions.

1. Definitions

"Personal Data", "Data Subject", "Processing", "Controller", "Processor", and "Supervisory Authority" have the meanings given to them in applicable data protection law. "Customer Data" means any personal data submitted to or generated by the kavachOS Cloud service by or on behalf of the customer.

2. Scope and nature of processing

GLINR processes Customer Data solely to provide the kavachOS Cloud service as described in the Terms of Service and as further documented in our Privacy Policy. Processing activities include storing user account credentials, session tokens, audit logs, and authentication event records in the customer's tenant database.

Categories of data subjects: the customer's end users who authenticate via the kavachOS platform. Categories of personal data: email addresses, hashed credentials, session metadata, and IP addresses associated with authentication events.

3. Customer instructions

GLINR processes Customer Data only on documented instructions from the customer, including as set out in this DPA and the Terms of Service. GLINR will promptly notify the customer if it believes an instruction infringes applicable data protection law, unless prohibited from doing so.

4. Confidentiality

GLINR ensures that personnel authorized to process Customer Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.

5. Security measures

GLINR implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of credentials at rest using PBKDF2 with 600,000 iterations
• TLS 1.2 or higher for all data in transit
• Tenant data isolation using row-level tenant ID enforcement in all database queries
• Access controls limiting personnel access to Customer Data on a need-to-know basis
• Audit logging of authentication events with configurable retention periods

6. Sub-processors

The customer provides general authorization for GLINR to engage sub-processors to deliver the kavachOS Cloud service. GLINR will notify the customer of intended changes to sub-processors (additions or replacements) by updating this page and providing at least 30 days notice before any new sub-processor begins processing Customer Data.

Current sub-processors

GLINR enters into data processing agreements with each sub-processor that impose data protection obligations at least as protective as those in this DPA.

7. Data subject rights

GLINR will assist the customer in fulfilling its obligations to respond to requests from data subjects exercising their rights under applicable data protection law (including rights of access, rectification, erasure, restriction, and portability). Customers may submit data subject requests to hello@kavachos.com.

8. Security incident notification

GLINR will notify the customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data. Notifications will include the information required under Article 33(3) of the GDPR to the extent available at that time.

9. Data transfers

Where Customer Data is transferred to countries outside the European Economic Area, such transfers are made pursuant to Standard Contractual Clauses adopted by the European Commission or another lawful transfer mechanism. Cloudflare, Stripe, PostHog, Vercel, and Resend are all covered by Standard Contractual Clauses or equivalent safeguards.

10. Return and deletion of data

Upon termination of the service or at the customer's request, GLINR will delete or return all Customer Data within 30 days, and delete existing copies unless applicable law requires retention. Customers can also initiate account deletion at any time from the dashboard settings.

11. Audits and inspections

GLINR will make available to the customer all information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits and inspections conducted by the customer or its designee, subject to reasonable notice and confidentiality obligations.

Execute this DPA

Enterprise customers requiring a countersigned DPA for procurement purposes can request an executed copy by emailing hello@kavachos.com with the subject line "DPA request". Please include your company name, primary contact, and any jurisdiction-specific requirements. We aim to turn these around within 5 business days.