Data Processing Addendum

This document is a working draft for review by counsel and has not yet been executed with any customer. Once final, it will form part of the Master Service Agreement or Terms of Use between the Customer and Archon Labs. To discuss it, contact [email protected].

1. Definitions

Terms used here follow the meaning assigned in the GDPR (Regulation (EU) 2016/679). “Customer” is the Controller; “Archon Labs” is the Processor for personal data processed under the Agreement.

2. Scope and roles

The Customer determines the purposes and means of processing. Archon Labs processes personal data solely for providing the blackpot.io service and only on the documented instructions of the Customer (which include the configuration selections made via the console).

3. Categories of data processed

• Operator account data: names, emails, roles, SSO identity claims of authorized operators
• Session data captured by sensors: IP addresses of connecting endpoints, HTTP request fingerprints, protocol interactions, and any payloads submitted by unauthenticated visitors to Customer-controlled bait ports
• Enrichment metadata: geoip, ASN, and threat-intel correlation added by the enrichment pipeline

4. Duration

For the term of the underlying Agreement, plus a 30-day data-export window after termination.

5. Sub-processors

Archon Labs uses the sub-processors listed in the Privacy Policy, updated as new sub-processors are engaged. Customer may object to a new sub-processor within 30 days of notice; objection permits Customer to terminate the affected service with a pro-rata refund.

6. Security measures

Archon Labs implements the technical and organizational measures described at /security, including but not limited to:

• Encryption in transit (TLS; WireGuard between sensors and the database) and AES-256 encrypted backups
• Console access through Cloudflare Access single sign-on
• Separate least-privilege database roles with row-level security
• Signed container images and HMAC-signed sensor commands
• Automatic deletion on the schedule in our privacy policy

7. Data-subject rights

Archon Labs will assist the Customer in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection). Where a request is received directly, Archon Labs will refer the data subject to the Customer and notify the Customer without undue delay.

8. Breach notification

Archon Labs will notify the Customer without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting Customer data. Notification includes the nature of the breach, the categories and approximate number of data subjects concerned, the likely consequences, and the measures taken.

9. International transfers

For transfers of personal data outside the EEA, Archon Labs relies on the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), incorporated by reference, with the modules appropriate to the roles of the parties. Data is currently processed in the United States; EU hosting is not yet offered.

10. Audit

Once per calendar year, and at Customer's reasonable expense, the Customer may audit Archon Labs' compliance with this DPA. Third-party audit reports will be offered in lieu of an on-site audit once available.

11. Return or deletion

On termination, Archon Labs will delete or return all Customer personal data (at the Customer's election) within 30 days, unless retention is required by law.

12. Contact

DPA questions: [email protected]