Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between the organization identified in the applicable Order Form or Terms of Service account ("Controller," "Customer," "you") and SilentGuard ("Processor," "Provider," "we," "us") and forms part of the Master Service Agreement, Terms of Service, or other agreement between the parties governing Customer's use of the Service (the "Principal Agreement").

This DPA reflects the parties' commitment to comply with applicable Data Protection Laws governing the processing of Personal Data in connection with the Service.

1. Definitions

Terms not defined in this DPA have the meanings given in the Principal Agreement. In addition:

2. Scope and Roles

2.1 Roles

Customer is the Controller and Provider is the Processor with respect to Personal Data processed in connection with the Service. Where Provider determines the purposes and means of processing (e.g., account management, billing, Service improvement using aggregated anonymized data), Provider acts as an independent controller, subject to its Privacy Policy.

2.2 Scope of Processing

This DPA applies to all Personal Data processed by Provider on behalf of Customer in connection with the Service.

2.3 Details of Processing

The details of processing are described in Annex 1 of this DPA and include the subject matter, duration, nature and purpose, types of Personal Data, and categories of Data Subjects.

3. Provider's Obligations as Processor

3.1 Processing Instructions

Provider will process Personal Data only on behalf of and in accordance with Customer's documented instructions. If Provider believes an instruction from Customer infringes Applicable Data Protection Laws, Provider will notify Customer without undue delay.

3.2 Purpose Limitation

Provider will process Personal Data solely for the purposes described in Annex 1 and will not process Personal Data for any other purpose unless required by applicable law.

3.3 Confidentiality

Provider will ensure that all personnel authorized to process Personal Data are bound by appropriate confidentiality obligations (whether contractual or statutory).

3.4 No Selling or Sharing

Provider will not sell, share, or use Personal Data for purposes other than providing the Service as specified in the Principal Agreement.

4. Local-First Architecture and Data Minimization

4.1 Local Processing

The Service's core detection and analysis functions operate locally on the end user's device:

• ✓Regex-based pattern matching executes 100% locally within the browser extension or local runtime;
• ✓Local LLM inference (where enabled) runs on the end user's device hardware;
• ✓Sensitive content identified by the detection engine is redacted or flagged locally before any data leaves the end user's device or network;
• ✓The content of prompts submitted by Authorized Users to third-party AI tools is not transmitted to, processed by, or stored on Provider's servers.

4.2 Data Transmitted to Provider

4.3 Data Minimization

Provider collects and processes only the minimum Personal Data necessary to provide the Service. Provider does not collect or process:

• ✗The content of prompts entered into AI tools by Authorized Users;
• ✗The text of sensitive data detected by the Service;
• ✗Screenshots, recordings, or visual captures of user activity;
• ✗Keystroke data, browsing history, or other surveillance data beyond the scope of the Service.

5. Security Measures

Provider will implement and maintain appropriate technical and organizational security measures to protect Personal Data against Security Incidents, including:

6. Sub-processors

Customer provides general written authorization for Provider to engage Sub-processors to process Personal Data on Customer's behalf. Provider will notify Customer at least thirty (30) days before adding or replacing a Sub-processor.

Current Sub-processors are listed in Annex 3 and available at silentguard.ai/legal/sub-processors.

7. Data Subject Rights

Provider will, taking into account the nature of the processing, assist Customer by appropriate technical and organizational measures to fulfill Customer's obligations to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Laws, including rights of access, rectification, erasure, restriction, portability, and objection.

If Provider receives a request from a Data Subject directly, Provider will promptly redirect the request to Customer and will not respond to the request directly unless authorized by Customer or required by applicable law.

8. Security Incidents

Provider will notify Customer of any confirmed Security Incident without undue delay, and in any event within seventy-two (72) hours of becoming aware of the incident. The notification will include:

• •A description of the nature of the Security Incident, including the categories and approximate number of Data Subjects and Personal Data records affected;
• •The name and contact details of Provider's point of contact;
• •A description of the likely consequences of the Security Incident;
• •A description of the measures taken or proposed to address the Security Incident.

9. Data Transfers

If Personal Data is transferred from the EEA, UK, or Switzerland to a country that has not been deemed to provide an adequate level of data protection, the parties will ensure that an appropriate transfer mechanism is in place, including Standard Contractual Clauses (SCCs), UK International Data Transfer Agreement (IDTA), and supplementary measures as necessary.

For transfers from the EEA, Module Two (Controller to Processor) of the SCCs adopted by the European Commission applies. Complete details are provided in Annex 4.

10. Audits and Assessments

Customer (or a qualified third-party auditor appointed by Customer and bound by confidentiality obligations) may audit Provider's compliance with this DPA once per year, upon at least thirty (30) days' prior written notice.

Provider may satisfy audit requests by providing SOC 2 Type II reports, penetration test results, or responses to standardized security questionnaires (CAIQ, SIG, VSAQ).

11. Data Retention and Deletion

Provider will retain Personal Data for the duration of the Subscription Term as necessary to provide the Service and comply with the Principal Agreement.

Upon termination or expiration of the Principal Agreement, Provider will continue to make Customer Data available for export for thirty (30) days, then delete all Personal Data within thirty (30) days after the export period ends. Upon Customer's written request, Provider will provide written certification of deletion.

12. Governing Law and Dispute Resolution

This DPA is governed by the laws applicable in the Dubai International Financial Centre (DIFC), except that where Applicable Data Protection Laws require the application of specific governing law (e.g., GDPR requires the law of the EU Member State where the Controller is established), such law will apply to the relevant provisions of this DPA.

Any dispute arising out of or relating to this DPA will be resolved in accordance with the dispute resolution provisions of the Principal Agreement.