Data Processing Agreement

Version 1.0. This agreement is under legal review. It is concluded between the customer as controller and Resilic as processor when an organisation is created in Resilic and forms part of the Terms of Service. This English text is a translation; the German version (Auftragsverarbeitungsvertrag) prevails.

1. Subject and duration

The processor (Resilic AI – Christian Morgenthaler, Gartenstraße 24, 76307 Karlsbad, Deutschland, "Resilic") processes personal data on behalf of the customer (the "controller") to provide the services under the main contract (Terms of Service). The duration of this agreement equals the duration of the main contract.

2. Nature and purpose of processing, types of data, data subjects

The purpose of the processing is the operation of the Resilic platform for the controller: managing products, software bills of materials, suppliers, installations and vulnerabilities, preparing reports under Article 14 CRA, records of training and policies, and notifying users.

• Types of data: account data of the controller's users (name, email address, role, language); data on employees in the context of training and policy records (name, email address, function, training status, confirmations); contact details of contact persons at the controller's customers and suppliers (name, email address, function); content the controller enters into Resilic insofar as it contains personal data; technical data (IP addresses, timestamps, log data, audit trail).
• Data subjects: employees and agents of the controller; contact persons at its customers, operators and suppliers; recipients of the controller's notifications.
• Resilic Edge records device information from machine networks (vendor, type, firmware, network addresses). This is normally not personal data; where it is in an individual case, this agreement applies.

3. Instructions

Resilic processes the data exclusively within the main contract and on the controller's documented instructions. The controller issues instructions by using the functions of Resilic and, where necessary beyond that, in text form. If Resilic considers an instruction unlawful, Resilic informs the controller without delay and may suspend its execution until the matter is clarified.

4. Resilic's obligations

• Resilic binds all persons with access to the data to confidentiality; the duty continues after their engagement ends.
• Resilic implements the technical and organisational measures in Annex 2 and reviews them regularly. Measures may be replaced by equivalent ones without lowering the level of protection.
• Resilic assists the controller in answering requests of data subjects and in the obligations under Art. 32 to 36 GDPR, as far as this is possible for Resilic.
• Resilic notifies the controller of a personal data breach without undue delay and at the latest 48 hours after becoming aware of it, with the information needed for the notification under Art. 33 GDPR.
• Resilic names a contact for data protection: info@resilic.ai.
• Resilic processes the data within the European Union. Processing in a third country takes place only through the sub-processors named in Annex 1 and under the safeguards stated there.

5. Sub-processors

The controller consents to the sub-processors named in Annex 1. Resilic informs the controller in text form at least four weeks before adding or replacing a sub-processor. Within that period the controller may object for an important data-protection reason; if no agreement is reached, either party may terminate the main contract as of the date the change takes effect. Resilic binds every sub-processor by contract to obligations equivalent to those in this agreement.

6. Controller's rights

Resilic makes available to the controller the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, in particular the description of the technical and organisational measures and third-party reports or attestations where available. On-site inspections are possible with at least four weeks' notice during usual business hours, at most once a year unless there is a specific reason.

7. Deletion and return

After the end of the main contract the controller can export its data for 30 days in common machine-readable formats. Resilic then deletes the controller's data, including backup copies within the regular backup cycles, unless a statutory retention duty requires otherwise. On request Resilic confirms the deletion in text form.

8. Liability

The liability rules of the main contract apply. Art. 82 GDPR remains unaffected.

9. Final provisions

In case of conflict between this agreement and the main contract, this agreement prevails as far as the protection of personal data is concerned. German law applies. Changes require text form. In case of differences between the German version and a translation, the German version prevails.

Annex 1: Sub-processors

• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg: hosting of the platform and databases and sending of email (Amazon Simple Email Service), Frankfurt region (eu-central-1), processing within the EU.
• Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA: DNS, protection and delivery of the public websites and of the security advisories (CSAF) the controller publishes, email forwarding. Processing predominantly in EU data centres; safeguards for third-country transfers: EU-US Data Privacy Framework and EU standard contractual clauses.
• Anthropic, PBC, 548 Market St, San Francisco, CA 94104, USA: generation of AI drafts from content the controller hands to an AI function. No use of the content for training; safeguards for third-country transfers: EU-US Data Privacy Framework and EU standard contractual clauses.
• Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland: payment processing and invoicing (billing data of the organisation and the paying contact), processing within the EU.
• Grafana Labs, hosted in the EU region: operational monitoring of the platform using technical log and metric data, without the controller's content.

Annex 2: Technical and organisational measures

• Access control (authentication): sign-in through a central identity service with password rules, optional two-factor authentication and connection to the controller's single sign-on; lockout after repeated failed attempts.
• Access control (authorisation): role-based permissions within the organisation; four-eyes principle for security-relevant changes; access by Resilic's operations staff only for maintenance and support.
• Separation: strict separation of each organisation's data in the database through row-level access rules (row-level security) and a separate sign-in area per organisation.
• Encryption: transmission exclusively over TLS; encryption of stored data and backups; particularly sensitive secrets (such as the controller's API keys) additionally encrypted at application level.
• Availability: regular automatic backups with monitoring of the backup runs; redundant operation across several availability zones of the data centre; restores are rehearsed.
• Logging and input control: audit trail for changes to the organisation's data; central operational monitoring with alerting.
• Processor control: written contracts with all sub-processors; review of their safeguards before use.
• Regular review: security updates of the software in use during operation, automated checking of dependencies, review of these measures at least annually.