Data Processing Addendum

1. Purpose

This addendum describes data-processing expectations when aisecurity.llc processes personal data, customer data, artifacts, logs, prompts, repositories, traces, findings, reports, or evidence for a customer or partner.

2. Processing Roles

The applicable order form should define whether aisecurity.llc acts as:

• processor
• subprocessor
• independent controller
• service provider
• no-data processor for local-only deployments

Roles may vary by deployment model.

3. Categories of Data

Data may include:

• account information
• user information
• organization membership
• billing information
• repository metadata
• code snippets
• application traces
• prompt samples
• model interaction records
• findings
• reports
• evidence bundles
• logs
• usage events
• support records

4. Deployment Models

Data behavior differs by deployment:

• SaaS platform: data may be processed by aisecurity.llc systems
• local worker: sensitive analysis may remain local, with usage sync
• OEM sidecar: partner may control customer data path
• air-gapped: aisecurity.llc may process little or no customer data
• support case: customer may provide diagnostic data voluntarily

5. Processing Purpose

Processing purposes may include:

• authentication
• billing
• entitlement management
• usage metering
• scan execution
• findings generation
• evidence generation
• report generation
• support
• security monitoring
• audit
• service improvement where allowed

6. Customer Instructions

aisecurity.llc processes data according to the agreement, order form, documentation, and lawful customer instructions.

aisecurity.llc may refuse instructions that are unlawful, unsafe, technically infeasible, or outside the agreed service.

7. Retention

Retention should be specified by product and deployment model.

Possible retention categories:

• account data retained while account is active
• billing records retained as legally required
• usage events retained for commercial reconciliation
• artifacts retained according to configured policy
• support records retained for support history
• local-only data not retained by aisecurity.llc

8. Deletion

Customers may request deletion according to the applicable agreement, product capability, and legal requirements.

Deletion does not necessarily remove:

• billing records required by law
• aggregate usage records
• security logs required for protection
• records in immutable backups until backup expiry
• records held by the partner in OEM or MSSP deployments

9. Security Measures

Security measures may include:

• access controls
• encryption in transit
• encryption at rest where supported
• audit logging
• least privilege
• secure token handling
• license signing
• output integrity controls
• environment separation
• incident response process

10. Subprocessors

If aisecurity.llc uses subprocessors, they should be listed or made available through a subprocessor notice mechanism.

Subprocessors may include hosting, storage, authentication, email, billing, analytics, support, or infrastructure providers.

11. International Transfers

International transfers, if applicable, should be governed by appropriate contractual safeguards.

12. Incident Notice

aisecurity.llc should notify customers of confirmed security incidents affecting customer data according to the agreement and applicable law.

13. Partner-Controlled Data

For OEM, MSSP, and private-label arrangements, the partner may control customer data flows.

The partner is responsible for its own privacy notices, customer instructions, data retention, deletion, and legal compliance unless aisecurity.llc directly processes the data.

14. Suggested Order Form Fields

Data terms should specify:

• deployment model
• data categories
• processing role
• artifact retention
• usage data retention
• support data handling
• subprocessor terms
• deletion process
• regional requirements
• special restrictions