This Data Processing Addendum ("DPA") is part of the Terms of Service between Generator Labs, Inc. ("we", "us") and the customer ("you"). It applies whenever we process personal data for you to provide the Service. No signature is needed. If your process requires a countersigned copy, email legal@generatorlabs.com.
This DPA controls over the Terms on personal data. Where the Standard Contractual Clauses apply, they control over both.
1. Definitions
- Data Protection Laws: laws that apply to the processing, including the GDPR, UK GDPR, Swiss FADP, PIPEDA, and the CCPA and similar US state laws.
- Customer Personal Data: personal data we process for you, described in Annex 1.
- Subprocessor: a third party we engage that processes Customer Personal Data.
- Security Incident: a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data. Unsuccessful attempts, such as blocked scans or failed logins, aren't Security Incidents.
- SCCs: the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914.
Other terms (controller, processor, data subject, service provider, sell, share) have their meaning under the GDPR or CCPA.
2. Roles
You're the controller (or a processor for your own controller). We're your processor, and your service provider under the CCPA.
We're a controller only for our own account administration, billing, fraud prevention, security, and legal obligations. Our Privacy Policy covers that processing.
3. Our Commitments
We will:
- Process Customer Personal Data only on your instructions: the Terms, this DPA, and how you configure the Service. If the law requires other processing, we'll tell you first unless the law forbids it.
- If a government authority asks us for Customer Personal Data, we'll refer it to you, notify you unless the law forbids it, challenge requests we believe are unlawful, and disclose only the minimum the law requires.
- Tell you if we think an instruction breaks Data Protection Laws.
- Bind everyone with access to confidentiality.
- Help you answer data subject requests. Most you can handle in the portal or API. Requests sent to us go to you.
- Help with impact assessments and regulator consultations that concern the Service.
- Never sell or share Customer Personal Data, use it outside our business relationship with you, or combine it with other data except as the CCPA allows.
4. Your Commitments
You need a lawful basis for the data you give us and must give any notices the law requires.
Don't submit special category data (GDPR Article 9), health information, HIPAA protected health information, government identifiers, or financial account numbers. The Service doesn't need them, and we don't sign HIPAA business associate agreements.
5. Subprocessors
You authorize the Subprocessors listed at generatorlabs.com/legal/subprocessors.
We'll give at least 30 days' notice before adding one, by email to your account owner, and to any other address you ask us to add. You may object on reasonable data protection grounds during that time. If we can't resolve it, you may end the affected Service without penalty. If we must replace a Subprocessor urgently for security or continuity, we'll give as much notice as we can.
Each Subprocessor is bound by written data protection terms no less protective in substance than this DPA. We're liable for their work.
6. Security
We maintain the measures in Annex 2. We may change them, but we won't materially reduce the overall protection of Customer Personal Data.
7. Security Incidents
We'll notify your account owner without undue delay, and within 72 hours of becoming aware of a Security Incident. The notice covers what happened, the data and people affected, the likely consequences, and what we're doing about it. We'll send updates as we learn more, and help you meet your own notification duties. A notice isn't an admission of fault.
8. Audits
On request, once a year or after a Security Incident, we'll answer your security questionnaire and provide a summary of our latest penetration test. The full report is available under NDA.
If the law or a regulator requires more, you or an independent auditor under confidentiality may audit our compliance with this DPA, with 30 days' notice, during business hours, at your cost, with scope agreed in advance.
9. International Transfers
We process Customer Personal Data in the United States and Canada.
To run the checks you configure, the Service sends queries to third-party sources (such as blocklist operators' DNS servers) and connects to the endpoints you monitor, which may be in any country. They receive only what each check needs, such as the IP address or domain being checked, and they aren't our subprocessors.
- Canada has an EU adequacy decision for organizations subject to PIPEDA.
- EEA to US: the SCCs apply, incorporated by reference. Module 2 applies where you're a controller and Module 3 where you're a processor. Clause 7 (docking) applies. Clause 9 option 2 applies, with the notice period in Section 5. Clause 11's optional wording doesn't apply. Clause 13: the supervisory authority of your establishment or representative. Clauses 17 and 18: Irish law and Irish courts. Annexes 1 to 3 of this DPA complete the SCC annexes.
- UK: the ICO's International Data Transfer Addendum to the SCCs applies, completed with the information in this DPA.
- Switzerland: the SCCs apply with references to the GDPR read as the FADP, and the FDPIC as supervisory authority.
10. Deletion
While your account is open, you can export your data through the portal and API. We delete Customer Personal Data within 30 days of your account closing, unless the law requires us to keep it. Backups expire within a further 30 days and stay protected by this DPA until they do.
11. Liability and Term
Liability under this DPA is subject to the limits in the Terms, except where the law or the SCCs don't allow it. This DPA lasts as long as we process Customer Personal Data for you.
Annex 1: Processing Details
| Nature and purpose | Monitoring the assets you configure, such as IP addresses, domains, hostnames, and certificates; sending alerts and reports; account administration; customer support |
| Duration | The term of the Terms, plus the deletion period in Section 10 |
| Frequency | Continuous |
| Data subjects | Your users, your alert contacts, people who contact our support for you, and people identifiable from assets you monitor |
| Personal data | Names, email addresses, and company names; sign-in provider account IDs (Google, Microsoft); login records (IP address, time, browser); the assets you monitor, with their check results and history; alert settings (emails, phone numbers, webhook URLs, chat channel IDs); data from connected Google Postmaster Tools and Microsoft SNDS accounts; support messages |
| Special categories | None (see Section 4) |
| Locations | United States (AWS N. Virginia and Ohio); Canada (AWS Montréal and Calgary, for DNS lookups) |
Annex 2: Security Measures
Encryption: TLS 1.2 or 1.3 for all traffic to the website, portal, and API, and for connections that carry customer data inside our private networks. AES-256 encryption at rest on all storage volumes and storage buckets. Passwords and API tokens are stored as hashes.
Customer access: Multi-factor authentication for portal users, role-based permissions, and a login history visible to account administrators. Account owners can require multi-factor authentication for every user in their account and choose how their users sign in, including through supported third-party sign-in providers.
Our access: MFA on all administrative access to our cloud infrastructure, and no access keys on the cloud root account. Remote server login is restricted by network rules to approved addresses. Access is limited to personnel who need it. Administrative access is reviewed every quarter and removed the same day a person leaves or changes role.
Audit logging: Every administrative action in our cloud infrastructure is recorded in a tamper-evident audit log kept for one year. Every read of the audit log is itself logged.
Intrusion detection: A managed threat detection service monitors our cloud account for threats, including unusual API activity, compromised credentials, and malicious network traffic, and alerts our on-call staff.
Network: Databases and internal services run in private networks that can't be reached from the internet. Public access to storage buckets is blocked account-wide. A web application firewall filters traffic to the website, portal, and API.
Hosting and patching: Containers run as unprivileged users with read-only file systems and are rebuilt with current OS updates on every release. Our policy is to apply critical security updates within 7 days of release, and high-severity updates within 30 days.
Vulnerability testing: Container images are scanned for vulnerabilities on every build and weekly, and servers are scanned continuously. Penetration tests: the Service is tested at least once a year by a third-party penetration testing service.
Backups and recovery: Our database cluster spans multiple availability zones. If a database server fails, the cluster fails over automatically to another availability zone. Backups run daily and are kept for 30 days. All backups are encrypted and stored separately from the servers they protect, with copies in a second AWS region, and a full restore of our database cluster is tested automatically every month. Recovery targets, for the loss of a server, database, or availability zone: at most 5 minutes of database changes lost, and the portal and API restored within 8 hours.
Monitoring: Automated alarms on availability, errors, and service health alert our on-call staff.
Payments: Our payment processors handle card payments. We never store card numbers or security codes.
Personnel: Everyone with access to Customer Personal Data is bound by confidentiality. Staff complete security and privacy training when they join and every quarter after.