Enterprise data protection for Hayrok customers.
Hayrok processes security and operational data on behalf of customers using the Hayrok platform. The DPA establishes the privacy, security, confidentiality, subprocessor, international-transfer, data-subject-rights, incident-response, deletion, and audit obligations that apply.
Clear responsibilities for customer data.
When Hayrok processes personal data on your behalf.
When a customer determines why and how personal data is processed through Hayrok, and Hayrok processes that information to provide the contracted service, the customer generally acts as the Controller and Hayrok acts as the Processor — using GDPR terminology. The DPA establishes how Hayrok handles that Customer Personal Data on the customer's behalf.
- Processing instructions
- Confidentiality
- Security safeguards
- Subprocessors
- Data-subject requests
- Security incidents
- International transfers
- Data deletion & return
- Audit & compliance support
- Customer responsibilities
- AI & third-party processing
- Private Runner considerations
Processing Customer Personal Data through Hayrok.
The DPA applies where Hayrok processes personal data on behalf of a customer in connection with the applicable Hayrok agreement. Customer Personal Data may appear across these information classes:
User & Identity Data
- User identifiers
- Email addresses
- Organization membership
- Identity-provider metadata
- Roles & permissions
- Service-account information
Asset Data
- Applications & APIs
- Cloud resources
- Workloads
- Repositories
- Infrastructure metadata
Security Telemetry
- Identity events
- WAF records
- API gateway events
- Cloud & Kubernetes logs
- Application & detection events
Security Findings
- Vulnerability information
- Misconfigurations
- Validation outcomes
- Remediation information
Validation Evidence
- Request & response metadata
- Runtime observations
- Detection events
- Control responses · reachability
- Screenshots · approval history
- Execution metadata
AI Context (where enabled)
- Nectar prompts
- Evidence references
- Finding & attack-path context
- Generated responses
- AI interaction metadata
Who does what.
Customer responsibilities
- Lawful collection of Customer Personal Data
- Providing appropriate notices
- Establishing a lawful basis where required
- Defining authorized users
- Configuring integrations
- Determining validation scope
- Issuing processing instructions
- Responding to individuals where the customer is Controller
Hayrok responsibilities
Hayrok processes Customer Personal Data according to:
- The customer agreement
- The DPA
- Customer configuration
- Documented customer instructions
- Applicable legal obligations
Customer-controlled processing.
Hayrok processes Customer Personal Data only for purposes necessary to provide, maintain, and secure the Hayrok service; provide customer support; perform authorized validation; generate evidence and reports; operate authorized integrations; provide enabled AI capabilities; and meet applicable legal obligations.
- Selecting integrations
- Configuring validation objectives
- Defining assets & scope
- Establishing user permissions
- Setting retention options
- Enabling / disabling functionality
The annex, in shorthand.
Provision of Hayrok's Governed Adversarial Exposure Validation platform and associated services.
For the term of the customer agreement, plus any limited period necessary for authorized retention, deletion, backup lifecycle, security, or legal requirements.
- Collection
- Transmission
- Storage
- Organization & retrieval
- Analysis & correlation
- Validation
- AI-assisted reasoning
- Evidence generation
- Reporting
- Deletion
To deliver and secure the Hayrok services selected by the customer.
Whose personal data may appear.
- Customer employees
- Customer contractors
- Authorized Hayrok users
- Developers & administrators
- Security personnel
- Application users
- Customer end users
- Individuals in security logs / telemetry
- Business contacts
- Others in customer-controlled systems
What may be processed.
- Name · email
- User & account identifiers
- Employer · department
- Role · job function
- Roles & permissions
- Account metadata
- Authentication-event metadata
- Service-account identifiers
- IP addresses · device IDs
- Application & API metadata
- Log information
- Security events
- Findings
- Detection records
- Validation evidence
- Attack-path relationships
- Remediation activity
Protecting Customer Personal Data.
Hayrok maintains technical and organizational measures designed to protect Customer Personal Data against unauthorized access, use, alteration, loss, or disclosure. The DPA incorporates or references Hayrok's current security measures.
- Strong authentication
- Enterprise identity integration
- Role-based authorization
- Contextual policy evaluation
- Least privilege
- Administrative access controls
- Tenant-aware authorization
- Tenant-scoped data access
- Tenant-aware evidence handling
- Tenant-specific integrations
- Cross-tenant access controls
- Edge protection
- Gateway enforcement
- Network restrictions
- Service-to-service auth
- Mutual TLS where implemented
- Encryption in transit
- Encryption at rest
- Secrets protection
- Key-management controls
- Secure development
- Code review
- Dependency security
- Container security
- Security testing · vuln mgmt
- Authentication monitoring
- Authorization logging
- Security telemetry
- Infrastructure monitoring
- Audit logging · investigation
- Backup controls
- Recovery procedures
- Operational monitoring
- Incident-response processes
Security testing does not remove privacy obligations.
Hayrok may perform adversarial validation against systems explicitly authorized by the customer. Validation remains subject to:
- Customer authorization
- Defined scope
- Policy controls
- Safety requirements
- Tool restrictions
- Approval gates where required
- Evidence requirements
- Auditability
AI processing remains within the customer data relationship.
Nectar is Hayrok's evidence-grounded intelligence and reasoning layer. Where Nectar processes Customer Personal Data on your behalf, that processing remains subject to the DPA.
- Explain findings
- Interpret evidence
- Analyze attack paths
- Summarize defensive response
- Recommend remediation
- Summarize reports
- Guide revalidation
AI retrieval is constrained by the requesting user's tenant, organization, permissions, and resource access.
Where Hayrok engages a third-party AI provider to process Customer Personal Data on Hayrok's behalf, the provider is treated as a subprocessor.
Access limited to authorized personnel.
Hayrok personnel with access to Customer Personal Data are subject to appropriate confidentiality obligations. Access is limited according to job responsibilities, least privilege, customer-support requirements, security responsibilities, and approved administrative workflows.
Providers supporting the Hayrok service.
Hayrok may engage subprocessors to provide infrastructure or functionality required to operate the service. Hayrok contractually requires subprocessors that process Customer Personal Data to provide data-protection obligations appropriate to the services they perform, consistent with GDPR Article 28.
- Cloud infrastructure
- Authentication
- Communications
- Observability
- AI services
- Customer support
- Business operations
Enterprise transparency.
The DPA defines Hayrok's process for adding or replacing subprocessors — publication of the current list, advance notice of material changes, customer subscription to change notifications, and a defined objection mechanism where legally or contractually required.
Safeguards for cross-border processing.
Where Customer Personal Data is transferred internationally and an applicable law requires a transfer mechanism, Hayrok uses the legally appropriate mechanism for that relationship.
EU SCCs
European Commission's 2021 Standard Contractual Clauses for transfers to countries outside the EU/EEA.
IDTA / UK Addendum
UK International Data Transfer Agreement or the ICO's UK Addendum to the EU SCCs where appropriate.
Local mechanisms
Applicable transfer mechanisms required by local law.
SCC incorporation.
Where required, the DPA incorporates the applicable modules of the EU SCCs based on the roles of the parties.
Customer Controller → Hayrok Processor
The controller-to-processor structure ordinarily evaluated for direct Hayrok customer relationships.
Customer Processor → Hayrok Subprocessor
The DPA supports the appropriate role configuration rather than assuming every customer has the same legal status.
Supporting your transfer reviews.
Where legally required, Hayrok provides information reasonably necessary to help customers evaluate international transfers.
- Processing locations
- Subprocessors
- Security controls
- Encryption
- Access-control measures
- Government-request policies
- Contractual safeguards
Service provider & contractor processing.
Where applicable U.S. privacy law treats Hayrok as a service provider, contractor, processor, or comparable role, the DPA includes the contractual restrictions needed for that role — for example, California's framework imposes distinct requirements on businesses and on service providers or contractors processing personal information for businesses.
Helping customers respond to privacy rights.
Where Hayrok acts as Processor, customers remain responsible for responding to requests from individuals concerning Customer Personal Data. Hayrok provides reasonable assistance where required.
- Access
- Correction
- Deletion
- Portability
- Restriction
- Objection
- Other applicable rights
Supporting customer compliance.
Where the customer's use of Hayrok requires a DPIA or regulatory consultation under applicable law, Hayrok provides reasonable information concerning its processing activities and security controls.
- Processing description
- Architecture information
- Subprocessor details
- Security safeguards
- Data flows
- Retention practices
- AI-processing information
Customer-specific legal conclusions remain the customer's responsibility.
Notification and cooperation.
If Hayrok confirms a Personal Data Breach affecting Customer Personal Data, Hayrok notifies the affected customer without undue delay in accordance with applicable contractual and legal obligations.
- Nature of the incident
- Affected services
- Types of data affected
- Known or estimated scope
- Mitigation performed
- Relevant contact information
- Additional updates as investigation continues
Reasonable assistance, proportionate scope.
- Incident investigation
- Customer risk assessment
- Regulatory notification
- Data-subject notification
- Remediation
Assistance remains proportionate to the incident and the services provided.
Processing locations and residency.
The DPA identifies or references where Customer Personal Data may be processed. Regional or customer-specific residency options are defined in the Order Form, product documentation, DPA annex, or enterprise agreement.
Customer-controlled retention where supported.
Hayrok retains Customer Personal Data according to the customer agreement, product configuration, applicable retention settings, security requirements, legal obligations, and backup lifecycle. Different categories may have different retention periods.
- Findings
- Evidence
- Reports
- Audit logs
- Telemetry
- Authentication records
- Nectar interaction records
What happens when the service ends.
At termination or expiration, Hayrok returns or deletes Customer Personal Data according to the DPA, subject to applicable legal requirements and the technical lifecycle of backups.
Backups may be deleted through their normal lifecycle rather than immediate removal where appropriate. Data retained because of a legal obligation remains protected and limited to the required purpose.
Reasonable opportunity to take your data.
Before termination, customers have a reasonable opportunity, where supported, to export eligible information:
- Findings
- Reports
- Evidence packages
- Asset information
- Relevant configuration
- Other supported customer records
Export capabilities reflect current product functionality rather than broad contractual promises.
Demonstrating Hayrok's controls.
- Security documentation
- Architecture information
- Security questionnaire responses
- Independent assurance reports when available
- Penetration-test summaries where appropriate
- Relevant policies
- Subprocessor information
The DPA does not grant every customer unrestricted physical or technical audit access to production systems — a tiered model is more appropriate.
Four levels, in order.
Trust documentation
Customer reviews existing documentation on the Trust Center.
Security review
Hayrok responds to reasonable questions during procurement or renewal.
Independent assurance
Where available, customers review independent reports or certifications.
Customer audit
Only where legally necessary and existing documentation is insufficient, subject to:
- Reasonable notice
- Confidentiality
- Scope limitations
- Security restrictions
- No access to other customers' data
- No unreasonable operational disruption
Shared data-protection responsibilities.
Where the customer deploys a Hayrok Customer Runner, Private Runner, or related component within customer-controlled infrastructure, responsibility is shared.
- Runner software
- Work-request authentication
- Platform authorization
- Supported encryption
- Application updates
- Relevant platform logging
- Host infrastructure
- Network configuration
- Local credentials
- OS security
- Customer-controlled encryption keys
- Local access
- Environment configuration
- Authorized validation targets
Enterprise encryption control.
Where Customer-Managed Keys are supported, the Order Form or service documentation specifies:
- Data classes covered
- Key-management provider
- Key ownership
- Rotation requirements
- Revocation behavior
- Availability implications
- Recovery considerations
Protecting customer information.
Subject to applicable law, Hayrok:
- Validates the request
- Limits disclosure to what is legally required
- Notifies the affected customer where legally permitted
- Challenges requests where appropriate and reasonably available
- Documents relevant handling
Exact contractual language is reviewed by counsel, particularly because this may affect international-transfer assessments.
Data minimization is shared.
Customers should avoid submitting unnecessary sensitive information.
- Authentication secrets
- Private keys
- Passwords
- Financial information
- Government identifiers
- Health information
- Special-category personal data
Credentials require stronger controls.
- Encryption
- Secret storage
- Least privilege
- Credential binding
- Access restrictions
- Rotation
- Expiration
- Auditability
Evidence can contain personal data.
- Tenant isolation
- Access control
- Retention policy
- Encryption
- Evidence integrity
- DPA obligations
AI-generated descriptions of evidence are derived information and do not replace the underlying source record.
Two distinct categories.
Customer Personal Data
Processed by Hayrok on the customer's behalf. Covered by the processor provisions of the DPA.
Hayrok Account & Business Data
Information Hayrok processes for its own legitimate business purposes:
- Customer contact records
- Billing contacts
- Contract administration
- Service-security records
- Business communications
Governed primarily by the Privacy Policy and applicable law.
Four clear annexes.
Processing details
- Parties & roles
- Subject matter
- Duration
- Purpose
- Nature of processing
- Categories of personal data
- Categories of data subjects
- Frequency
- Retention
Technical & organizational measures
- Identity · authorization
- Tenant isolation
- Encryption
- Network security
- Secure development
- Vulnerability management
- Logging · incident response
- Resilience
- Personnel security
- Evidence security
- AI security
Subprocessors
Either listed directly or incorporated by reference from the maintained Trust Center list where legally appropriate.
International transfers
- EU SCC selections
- UK Addendum
- Transfer-related party details
- Supervisory authority
- Governing-law selections
Choose how you want to review the agreement.
Short form. No procurement gauntlet.
Tell us who's asking and what jurisdictions apply. We'll send an execution-ready package tailored to your review.
Enterprise procurement questions.
Do all customers need a DPA?+
Is the DPA part of the Hayrok agreement?+
Does the DPA cover Nectar?+
Does Hayrok use subprocessors?+
Does Hayrok support EU SCCs?+
Does Hayrok support UK transfers?+
Where is customer data processed?+
Can we use our own DPA?+
How does Hayrok handle privacy requests?+
What happens to our data when we leave?+
Continue your privacy & security review.
Need the DPA countersigned?
Send us your entity details and the agreement you are executing under, and our team will return a countersigned copy along with the current subprocessor list.