Data Processing Agreement

Zairen acts as a data processor for customer data handled through the platform, including code, configuration, and evidence pulled from connected tools. This Data Processing Agreement (DPA) template sets out the terms under which that processing takes place, and is available to any prospect or customer on request.

Scope and roles

The customer is the data controller for personal data within its environment; Zairen is the data processor, acting only on the customer's documented instructions.

Subject matter and duration

Processing covers the categories of data needed to collect evidence, map controls, and operate the auditor portal, for the duration of the underlying service agreement.

Subprocessors

Zairen may engage vetted subprocessors to operate the service. A current list is available on request, and customers are notified of material changes in advance.

Security measures

Zairen applies administrative, technical, and organizational safeguards consistent with the frameworks it helps customers meet, including ISO 27001, SOC 2, and PCI DSS.

Assistance with data subject rights

Zairen will assist the customer in responding to data subject access, deletion, and correction requests relating to data processed on the customer's behalf.

International transfers

Where data is transferred across borders, appropriate transfer mechanisms recognized under applicable data protection law are used.

Breach notification

Zairen will notify the customer without undue delay upon becoming aware of a personal data breach affecting the customer's data.

Deletion or return of data

On termination of the underlying agreement, Zairen will delete or return customer data as instructed, subject to legal retention requirements.

Requesting a signed copy

To request a countersigned DPA for your organization, contact legal@zairen.co.