Data Processing Agreement (UK GDPR Article 28 DPA)
Standard contractual clauses governing how HackGuardX processes technical telemetry and personal data on behalf of customers.
- Pre-aligned with Article 28 of the UK GDPR for fast B2B procurement sign-off.
- Details technical and organisational security measures (TOMs) including AES-256 encryption, RBAC, and ephemeral code analysis.
- Includes 24-hour personal data breach notification commitment to the Data Controller.
1. Subject Matter, Nature and Purpose of Processing
This Data Processing Agreement ('DPA') forms part of the Subscription Agreement between Customer (the 'Controller') and HackGuardX (the 'Processor') in accordance with Article 28 of the UK GDPR.
HackGuardX processes metadata, asset inventories, cloud configuration states, and repository scan findings solely on documented instructions from the Controller to provide cybersecurity monitoring.
2. Technical and Organisational Security Measures (Article 32)
HackGuardX maintains strict Technical and Organisational Measures (TOMs) including:
- •Encryption of all customer telemetry at rest (AES-256-GCM) and in transit (TLS 1.3).
- •Ephemeral, isolated container execution for source code and dependency scanning—source files are discarded immediately upon scan completion.
- •Strict tenant logical isolation, hardware-enforced MFA for all internal HackGuardX engineers, and immutable audit logging.
- •Read-only cloud IAM and Microsoft Graph permissions ensuring HackGuardX cannot mutate customer production data.
3. Sub-Processors & Incident Notification
HackGuardX notifies Customers at least 14 days prior to authorising any new sub-processor. In the event of a confirmed Personal Data Breach affecting Customer data, HackGuardX will notify the Controller without undue delay and in any event within 24 hours.