Data Processing Agreement

1. Definitions

• "Controller": You, the AuditRails customer
• "Processor": AuditRails Inc.
• "Personal Data": Any data relating to an identified or identifiable person
• "Processing": Any operation performed on Personal Data
• "Sub-processor": Third party engaged by AuditRails to process data

2. Scope of Processing

Subject matter: Processing of audit log data submitted via the AuditRails API.

Nature and purpose: Storage, indexing, hash chaining, search, and display of audit events.

Types of personal data:

• Actor identifiers (user IDs, usernames)
• IP addresses
• Action descriptions and timestamps
• Resource identifiers
• Custom metadata fields provided by the Controller

Categories of data subjects: Individuals whose actions are logged (end users, employees, administrators).

Duration: For the term of the subscription plus the applicable retention period.

3. Processor Obligations

AuditRails shall:

• Process Personal Data only on documented instructions from the Controller
• Ensure persons authorized to process data are bound by confidentiality
• Implement appropriate technical and organizational security measures
• Assist the Controller in responding to data subject requests
• Delete or return all Personal Data at the end of the service, at the Controller’s choice
• Make available all information necessary to demonstrate compliance

4. Security Measures

AuditRails implements:

• Encryption at rest (AES-256) and in transit (TLS 1.3)
• Multi-tenant data isolation with tenant_id enforcement at every layer
• API key hashing (SHA-256, raw keys never stored)
• WORM storage (S3 Object Lock in COMPLIANCE mode)
• Cryptographic hash chaining for tamper detection
• Role-based access control (RBAC)
• Automated data retention enforcement and deletion

5. Sub-processors

AuditRails will notify the Controller 30 days before engaging a new sub-processor. The Controller may object within that period.

6. Data Breach Notification

AuditRails will notify the Controller within 48 hours of becoming aware of a Personal Data breach. Notification will include: nature of the breach, categories and volume of data affected, likely consequences, and measures taken to mitigate.

7. Data Subject Rights

AuditRails provides API endpoints (DSAR Export and DSAR Delete) to assist the Controller in responding to data subject access, portability, and erasure requests. ClickHouse data can be deleted immediately; S3 WORM data is retained until the Object Lock retention period expires (this is documented and accepted by signing this DPA).

8. International Transfers

Data is processed in AWS US (us-east-1) by default. EU Standard Contractual Clauses (SCCs) are incorporated by reference. Enterprise customers may opt for EU-only processing (eu-west-1).

9. Audit Rights

The Controller may audit AuditRails’ compliance with this DPA once per year with 30 days’ notice. AuditRails will cooperate and provide access to relevant records and personnel.

10. Term and Termination

This DPA is effective upon signing and continues for the duration of the subscription. Upon termination, AuditRails will delete all Personal Data within 30 days unless retention is required by law or the applicable retention period has not yet expired.