Data Processing Addendum (DPA)
Between:
- Data Controller ("Customer"): Customer identified in the applicable order form or service agreement
- Data Processor ("AtomicOSINT"): AtomicOSINT LLC
Effective Date: 2026-06-11
1. Definitions
"Agreement" means the master services agreement, order form, or other agreement between Customer and AtomicOSINT governing Customer's use of AtomicOSINT.
"Applicable Data Protection Law" means all data protection and privacy laws applicable to the processing of Personal Data under this DPA, including but not limited to the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA), and any successor legislation.
"Personal Data" means any information relating to an identified or identifiable natural person that is processed by AtomicOSINT on behalf of Customer in connection with the Agreement.
"Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, deletion, or destruction.
"Sub-processor" means any third party engaged by AtomicOSINT to process Personal Data on behalf of Customer.
"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
2. Scope and Applicability
2.1 This DPA applies where AtomicOSINT processes Personal Data on behalf of Customer in the course of providing the AtomicOSINT services described in the Agreement.
2.2 This DPA supplements the Agreement and, in the event of any conflict between this DPA and the Agreement regarding data protection matters, this DPA shall prevail.
2.3 The details of the processing (subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects) are described in Annex A.
3. Roles and Responsibilities
3.1 Customer as Controller. Customer determines the purposes and means of processing Personal Data. Customer is responsible for ensuring that its use of the Platform complies with Applicable Data Protection Law, including providing any required notices to and obtaining any required consents from Data Subjects.
3.2 AtomicOSINT as Processor. AtomicOSINT processes Personal Data solely on behalf of Customer and in accordance with Customer's documented instructions, except where required by law to process Personal Data independently (in which case AtomicOSINT shall inform Customer of such legal requirement before processing, unless prohibited by law).
4. Customer Instructions
4.1 AtomicOSINT shall process Personal Data only in accordance with Customer's documented instructions. The Agreement, this DPA, and Customer's configuration of the Platform constitute Customer's instructions.
4.2 AtomicOSINT shall promptly inform Customer if, in AtomicOSINT's opinion, an instruction from Customer infringes Applicable Data Protection Law.
5. Confidentiality
5.1 AtomicOSINT shall ensure that personnel authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
5.2 AtomicOSINT shall not disclose Personal Data to any third party except as authorized by this DPA, the Agreement, or Customer's written instructions.
6. Security Measures
6.1 AtomicOSINT shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, theft, or disclosure, as described in Annex B.
6.2 These measures shall include, at a minimum:
- (a) Encryption of Personal Data in transit (TLS 1.2+) and at rest (transparent disk encryption), and application-layer AES-256-GCM encryption of administrator authenticator secrets and email verification delivery tokens
- (b) Password hashing using bcrypt with per-user salts
- (c) Cryptographically random session tokens with database-backed validation
- (d) Role-based access control with principle of least privilege
- (e) Web application firewall, DDoS protection, and rate limiting
- (f) Multi-factor authentication is available for administrative accounts when enabled by the account holder
- (g) Regular security assessments and monitoring
7. Sub-processors
7.1 Customer authorizes AtomicOSINT to engage the Sub-processors listed in Annex C as of the effective date of this DPA.
7.2 AtomicOSINT shall notify Customer at least 30 days before engaging any new Sub-processor or replacing an existing Sub-processor, providing the Sub-processor's name, processing activities, and location.
7.3 Customer may object to the engagement of a new Sub-processor by notifying AtomicOSINT in writing within 14 days of receiving notice. If Customer objects, the parties shall work in good faith to resolve the objection. If no resolution is reached within 30 days, Customer may terminate the affected services without penalty.
7.4 AtomicOSINT shall impose data protection obligations on each Sub-processor that are no less protective than those in this DPA.
7.5 AtomicOSINT remains fully liable to Customer for the performance of each Sub-processor's obligations.
8. Data Subject Rights
8.1 AtomicOSINT shall assist Customer in fulfilling its obligations to respond to Data Subject requests to exercise their rights under Applicable Data Protection Law, including rights of access, rectification, erasure, restriction, portability, and objection.
8.2 If AtomicOSINT receives a request directly from a Data Subject, AtomicOSINT shall promptly redirect the Data Subject to Customer and notify Customer of the request without undue delay.
8.3 AtomicOSINT shall provide Customer with self-service tools (where feasible) and reasonable technical assistance to enable Customer to respond to Data Subject requests within the timeframes required by Applicable Data Protection Law.
9. Data Breach Notification
9.1 AtomicOSINT shall notify Customer of any confirmed Personal Data breach without undue delay and in any event within 72 hours of becoming aware of the breach.
9.2 The notification shall include, to the extent available:
- (a) A description of the nature of the breach, including the categories and approximate number of Data Subjects and records affected
- (b) The name and contact details of AtomicOSINT's point of contact
- (c) A description of the likely consequences of the breach
- (d) A description of the measures taken or proposed to address the breach
9.3 AtomicOSINT shall cooperate with Customer and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of the breach.
10. Data Protection Impact Assessments
10.1 AtomicOSINT shall provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, where required by Applicable Data Protection Law, taking into account the nature of the processing and the information available to AtomicOSINT.
11. International Data Transfers
11.1 Personal Data may be processed in the United States and other countries where AtomicOSINT's Sub-processors operate.
11.2 For transfers of Personal Data from the European Economic Area, United Kingdom, or Switzerland to countries not recognized as providing an adequate level of data protection, AtomicOSINT shall ensure appropriate safeguards are in place, including:
- (a) EU Standard Contractual Clauses (SCCs) as approved by the European Commission (Module 2: Controller to Processor), incorporated by reference into this DPA
- (b) UK International Data Transfer Addendum, where applicable
- (c) Swiss Federal Data Protection Act transfer mechanisms, where applicable
11.3 The parties agree that the SCCs (Module 2) are incorporated by reference and form part of this DPA. In the event of conflict between this DPA and the SCCs, the SCCs shall prevail.
12. Data Retention and Deletion
12.1 Upon termination or expiration of the Agreement, AtomicOSINT shall, at Customer's election:
- (a) Return all Personal Data to Customer in a structured, commonly used, and machine-readable format; or
- (b) Delete all Personal Data and confirm deletion in writing.
12.2 AtomicOSINT shall complete the return or deletion within 30 days of receiving Customer's instruction, unless Applicable Data Protection Law requires further retention.
12.3 During the Agreement, Personal Data is retained in accordance with the retention periods specified in the Platform Privacy Policy and Annex A. Key retention periods include:
- Account data: until account deletion
- Learning records: until account deletion
- Analytics events: 1 calendar year (IP truncated after 30 days)
- Behavioral telemetry: 90 days
- Error diagnostics: 30 days
- Sign-in and account-security events: 7 calendar years
- Purchase records: kept after account deletion for financial records, without a link to the learner
- Admin audit logs: 7 calendar years (regulatory compliance)
- Backups: daily database backups 30 days, monthly database backups 12 months; the cross-provider S3 copy, when configured, 90 days
13. Audits
13.1 AtomicOSINT shall make available to Customer information necessary to demonstrate compliance with this DPA and Applicable Data Protection Law.
13.2 Customer may conduct, or engage a qualified third-party auditor to conduct, an audit of AtomicOSINT's compliance with this DPA, subject to the following conditions:
- (a) Customer shall provide at least 30 days written notice
- (b) Audits shall be conducted during normal business hours and shall not unreasonably interfere with AtomicOSINT's operations
- (c) Customer shall bear the cost of the audit
- (d) Audits shall be limited to once per 12-month period, unless required by a supervisory authority or in response to a confirmed data breach
- (e) Third-party auditors shall be bound by confidentiality obligations
13.3 As an alternative to on-site audits, AtomicOSINT may provide Customer with SOC 2 Type II audit reports or equivalent certifications, where available.
14. Liability
14.1 Each party's liability under this DPA shall be subject to the limitation of liability provisions in the Agreement.
14.2 Nothing in this DPA shall limit either party's liability for breaches of Applicable Data Protection Law to the extent such limitation is prohibited by law.
15. Term and Termination
15.1 This DPA shall remain in effect for the duration of the Agreement and shall automatically terminate upon termination or expiration of the Agreement, subject to Section 12 (Data Retention and Deletion).
15.2 The obligations of AtomicOSINT under this DPA with respect to Personal Data that is retained after termination shall survive until such Personal Data is deleted or returned in accordance with Section 12.
16. Governing Law
16.1 This DPA shall be governed by and construed in accordance with the laws governing the Agreement, except where Applicable Data Protection Law requires otherwise.
17. Entire Agreement
17.1 This DPA, together with its Annexes, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior agreements relating to data processing.
Annex A — Details of Processing
| Element | Description |
|---|---|
| Subject matter | Processing of Personal Data to provide the AtomicOSINT training services |
| Duration | The term of the Agreement |
| Nature and purpose | Providing OSINT training, learning management, progress tracking, and certification services |
| Types of Personal Data | Account and sign-in, Sign-in and consent records, Profile and preferences, Profile image, Learning activity, Mentoring and social, Feedback and reports, Purchases and subscriptions, Usage analytics and client errors, Diagnostics, Request logs and network data, Email and notification records, Push notification tokens, Administrator accounts, Backups |
| Categories of Data Subjects | Customer's authorized users (employees, contractors, students) who access the Platform |
| Retention periods | As specified in Section 12.3 and the Platform Privacy Policy |
Annex B — Technical and Organizational Security Measures
Infrastructure Security
- All services hosted on Cloudflare Workers and Pages (global edge network)
- Cloudflare WAF, DDoS protection, and rate limiting on all endpoints
- No direct database access from the public internet
Encryption
- In transit: TLS 1.2+ enforced on all connections; no unencrypted connections accepted
- At rest: Neon PostgreSQL transparent disk encryption for all stored data
- Application-layer: AES-256-GCM encryption for administrator authenticator (TOTP) secrets and email verification delivery tokens
Authentication and Access Control
- Password hashing using bcrypt with per-user salts
- Cryptographically random session tokens with database-backed validation
- Automatic session expiration and purge
- Role-based access control using the roles defined by
MICRO_ADMIN_ROLESandMICRO_ORG_MEMBER_ROLESinpackages/contracts/src/constants.ts - Principle of least privilege enforced
- Multi-factor authentication available for administrative accounts when enabled by the account holder
Data Minimization
- Guest use may be pseudonymous; registered accounts collect the normalized email address and optional display name described in the Privacy Policy
- IP addresses in analytics events truncated to /24 after 30 days
- Behavioral analytics collected only with explicit opt-in consent
- Error diagnostics retained for 30 days only
Monitoring and Incident Response
- Admin audit logs retained for 7 calendar years
- Security event logging (authentication, rate-limiting, abuse prevention)
- Automated retention enforcement via scheduled cleanup processes
Personnel
- All personnel with access to Personal Data are bound by confidentiality obligations
- Access to production systems restricted to authorized personnel only
Annex C — Approved Sub-processors
| Sub-processor | Service | Processing Location | Data Processed |
|---|---|---|---|
| Cloudflare, Inc. | Hosting and edge compute (Workers and Pages), R2 storage for images and encrypted backups, rate limiting, Turnstile bot checks, DNS and CDN, and the application log archive | Global (edge network) | Every request, including IP addresses; stored images; rate-limit counters; application logs; encrypted backups |
| Neon Inc. | PostgreSQL database hosting | United States | All stored application data |
| Resend Inc. | Transactional email delivery | United States | Recipient email addresses, the content of the emails we send, and delivery events |
| Functional Software, Inc. (Sentry) | Error tracking and performance monitoring | United States | Error reports, stack traces, device and app metadata and request timing from the iOS app and the admin console (sent only after consent) and scrubbed error reports from the API (a one-way hash of the learner ID is included only when the learner has consented) |
| Stripe, Inc. | Web checkout and billing portal (Paid plans are not offered during the beta) | United States | Payment details entered on Stripe's pages (processed directly by Stripe), customer and subscription records, and the learner ID in checkout metadata |
| Apple Inc. | Sign in with Apple, App Store in-app purchases (purchase validation with the App Store Server API), and the Apple Push Notification service | United States | Apple subject identifier, the name and email shared at sign-in, purchase transaction identifiers, and for a push notification the device push token and the notification's title and text |
| Google LLC | Google Sign-In for learners and administrators, and Google Play purchase verification (supported by the API and not used by the iOS app) | United States | Google subject identifier, email, name and picture address; purchase tokens for Google Play verification |
| Microsoft Corporation | Microsoft sign-in for learners (personal, work and school accounts) | Global (Microsoft identity platform) | Microsoft subject identifier (tenant and object ID), email and name |
| GitHub, Inc. | Source code hosting and GitHub Actions, including the scheduled jobs that create and encrypt database backups | United States | Database dumps exist on GitHub-hosted runners while a backup job runs, before they are encrypted and uploaded |
| Amazon Web Services, Inc. | Cross-provider copy of encrypted backups in S3 (Only when the cross-provider backup workflow is configured) | Region set in the backup configuration | Encrypted database and asset backups |
UNEXECUTED TEMPLATE: This repository copy is a template for customer review. It is not an executed agreement until both parties complete and sign the signature block below.
CUSTOMER:
Name: Customer authorized signatory Title: As identified in the applicable order form or service agreement Signature: To be completed at customer execution Date: To be completed at customer execution
AtomicOSINT LLC:
Name: AtomicOSINT authorized signatory Title: Authorized representative Signature: To be completed at customer execution Date: To be completed at customer execution