Data Processing Agreement

In this DPA the following terms have the meanings set out below:

• “Controller” — the customer who determines the purposes and means of personal data processing.
• “Processor” — Swavvy AB, which processes personal data on behalf of the Controller.
• “Data Subject” — any identified or identifiable natural person whose personal data is processed.
• “Personal Data” — any information relating to an identified or identifiable natural person.
• “Processing” — any operation performed on personal data, as defined in the GDPR.
• “Sub-processor” — any third party engaged by the Processor to process personal data on behalf of the Controller.

The Processor processes personal data solely to provide the Perimeter external attack surface management service, including: conducting external scans of registered assets, storing and displaying scan results and findings, sending notifications and reports, and managing account and billing records.

The categories of personal data processed may include: email addresses, names, IP addresses in the context of asset data, and any personal data incidentally contained in scan results (such as email addresses discovered in public DNS records or certificate data).

The categories of data subjects include: the Controller's employees and authorised users of the platform, and individuals whose data may appear in publicly accessible infrastructure associated with the Controller's registered assets.

Processing is carried out for the duration of the agreement between the parties.

The Processor shall:

• Process personal data only on documented instructions from the Controller (which includes the purposes described in the Terms of Service and this DPA), unless required by applicable EU or Swedish law to do otherwise.
• Ensure that persons authorised to process personal data are under appropriate obligations of confidentiality.
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Article 32 GDPR.
• Assist the Controller in responding to Data Subject rights requests, taking into account the nature of the processing.
• Assist the Controller in ensuring compliance with obligations related to security, breach notification, data protection impact assessments, and prior consultation.
• At the choice of the Controller, delete or return all personal data upon termination of the agreement, and delete existing copies unless storage is required by applicable law.
• Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for audits conducted by the Controller or a mandated auditor, subject to reasonable notice and confidentiality obligations.

The Controller provides general authorisation for the Processor to engage sub-processors to assist in providing the Service. Current sub-processors include:

• Amazon Web Services (AWS) (EU — AWS Europe (Stockholm), eu-north-1) — Hosting, storage and compute for the Perimeter platform and the free scan. Receives: All platform data: accounts, registered domains, scan results and findings.
• Polar Software Inc (United States) — Merchant of record for subscriptions: checkout, payment, invoicing and VAT. Receives: Name, email address and billing details. It receives no registered domains, scan results or findings, and card details are entered on Polar’s own checkout page.Transfer safeguard: European Commission Standard Contractual Clauses.
• Mailgun (Sinch) (EU — Mailgun’s EU region) — Transactional email: address verification, password reset, invitations, finding-assignment notifications and scheduled report delivery. Receives: Recipient email addresses and message content, including finding details and scheduled report PDFs that contain scan results and findings.

The following services support the public websites. They do not receive Customer Data processed in the platform, but they are listed here so that this list and the Privacy Policy stay identical:

• Vercel Inc (United States, serving from a global edge network) — Hosts the public websites, useperimeter.com and enterprise.useperimeter.com. Receives: Visitors’ IP addresses and request details (page address, browser and referrer) in request logs. On the free scan page the address includes the domain being scanned. It does not host the platform or store scan results.Transfer safeguard: European Commission Standard Contractual Clauses in Vercel’s data processing terms.
• Plausible Analytics (EU) — Cookieless, aggregate website analytics on useperimeter.com and enterprise.useperimeter.com. Receives: Page views, referrer, browser, device type and country, plus events such as a free scan starting, which include the domain being scanned. It sets no cookies and does not store IP addresses or build a profile of you.
• Cookiebot (Usercentrics) (EU) — Cookie consent management on the public websites. Receives: Your consent choice, with a consent ID and the date it was given.
• Calendly LLC (United States) — Booking partner and demo calls from enterprise.useperimeter.com. Receives: Only when you book: your name, email address, the time you choose and anything you write in the booking form.Transfer safeguard: European Commission Standard Contractual Clauses in Calendly’s data processing terms.

Public data sources. To discover the assets associated with a registered domain, the Service queries public third-party datasets. These are searches, not sub-processors that hold data for the Processor, but the query sends the registered domain name to the dataset's operator:

• crt.sh certificate-transparency search (operated by Sectigo) (Outside our infrastructure, and may be outside the EEA) — Finding subdomains that appear in public TLS certificate logs, in the free scan and in platform discovery. Receives: The domain name being scanned, sent as a search query. No account details, scan results or findings are sent.

Optional, only when enabled. The Service can also use the providers below. Each is off by default and receives no data unless the Processor switches it on. Switching one on counts as adding a sub-processor and is subject to the notice period below. Where one of these is outside the EEA, we will set out the safeguard for that transfer on this page before the feature is switched on.

• Have I Been Pwned (Australia) — Checking whether workspace members’ email addresses appear in known data breaches. Receives: The email addresses of workspace members, one lookup per address.Off by default. Runs only if we switch the member-email breach check on.
• Sentry (Functional Software Inc) (EU — Sentry’s EU region (de.sentry.io)) — Error reporting, so we can find and fix faults in the platform. Receives: Error reports, made up of the failing code path and request details, which can include a user or workspace identifier and an IP address.Off by default. Runs only once we configure a Sentry project for the platform.
• Shodan (United States) — Enriching discovered hosts with public internet-scan data. Receives: IP addresses and hostnames of your registered assets.Off by default. Runs only if we add a Shodan API key.
• Censys (United States) — Enriching discovered hosts with public internet-scan data. Receives: IP addresses of your registered assets.Off by default. Runs only if we add a Censys API key.
• SecurityTrails (United States) — Finding subdomains from passive DNS history. Receives: Your registered domain names.Off by default. Runs only if we add a SecurityTrails API key.

The Processor will notify the Controller of any intended changes to sub-processors (additions or replacements) with at least 14 days' notice, giving the Controller the opportunity to object. All sub-processors are contractually required to provide at least the same level of data protection as required of the Processor under this DPA.

The Processor implements and maintains appropriate technical and organisational measures including:

• Encryption of personal data in transit (TLS 1.2 or higher) and at rest.
• Access controls and multi-factor authentication for platform and infrastructure access.
• Regular review of access rights and application of least-privilege principles.
• Procedures for regularly testing, assessing, and evaluating the effectiveness of security measures.
• Incident detection and response procedures.