Data Processing Agreement

Effective date: 28 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between 1001621100 Ontario Inc., an Ontario corporation operating as ShipAttest ("ShipAttest", the processor) and the customer using the ShipAttest service (the "Customer", the controller). It applies when ShipAttest processes personal data on the Customer's behalf ("Customer Personal Data") and sets out the terms required by Article 28 of the GDPR.

1. Subject matter and duration

ShipAttest processes Customer Personal Data to provide the service described in the Terms, for as long as the Terms apply plus the deletion period in section 9.

2. Nature and purpose

Hosting and storing Customer Content; checking software components against vulnerability sources; alerting; drafting reports and documents; AI-assisted triage and drafting when a user requests it; audit logging; and support.

3. Data subjects and personal data

• •Data subjects: the Customer's employees, contractors and other authorised users, and people named in Customer Content (for example authors or contacts in SBOMs, product documentation or reports).
• •Personal data: names, business email addresses, roles, account activity and audit records, IP addresses, and any personal data the Customer includes in uploaded content, such as names or email addresses in SBOM metadata, source-code excerpts or report texts.
• •Special categories of personal data are not needed for the service, and the Customer should not upload them.

4. ShipAttest's obligations

ShipAttest will:

• •process Customer Personal Data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use and configuration of the service, unless the law requires otherwise; in that case ShipAttest will tell the Customer first unless the law forbids it;
• •make sure everyone authorised to process the data is bound by confidentiality;
• •apply the security measures in Annex 1;
• •help the Customer, taking into account the nature of the processing, to answer data subject requests and to meet its obligations under Articles 32 to 36 GDPR (security, breach notification, impact assessments and prior consultation);
• •notify the Customer of a personal data breach affecting Customer Personal Data without undue delay, and within 48 hours of becoming aware of it, with the information then available;
• •make available the information needed to show compliance with this DPA, and allow audits under section 8.

5. Sub-processors

• •The Customer gives general authorisation for ShipAttest to use sub-processors. Annex 2 lists the current ones.
• •ShipAttest will email workspace owners at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds. If the parties can't resolve the objection, the Customer may end the affected service and receive a refund of fees prepaid for the remaining period.
• •ShipAttest binds each sub-processor to data protection obligations no less protective than this DPA, and remains responsible to the Customer for their performance.

6. International transfers

Customer Personal Data is stored in the EU (Frankfurt, Germany). ShipAttest operates the service from Canada, which the European Commission recognises as providing adequate protection for personal data handled by businesses subject to Canada's federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). Where Customer Personal Data is processed outside the European Economic Area, ShipAttest makes sure a lawful transfer mechanism applies: an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified providers) or the Commission's Standard Contractual Clauses.

7. The Customer's obligations

The Customer is responsible for the lawfulness of the personal data it uploads and of its instructions, and for informing its own users.

8. Audits

ShipAttest will answer reasonable written questions about its processing and share relevant certifications or audit reports of its sub-processors. If that is not enough, the Customer may audit ShipAttest's compliance at its own cost, with at least 30 days' notice, during business hours, under confidentiality and no more than once a year, unless a regulator requires it or a breach has occurred.

9. Deletion and return

Until the service ends, the Customer can export its data from the service. ShipAttest deletes Customer Personal Data from its live systems within 30 days after the workspace is deleted or the Terms end, and it disappears from backups when they expire, unless the law requires ShipAttest to keep it.

10. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms, to the extent the law allows. If this DPA and the Terms conflict on data protection, this DPA prevails.

Questions about this DPA: dan@shipattest.com.

Annex 1: Security measures

• •Hosting and database with managed providers in the EU (Frankfurt, Germany).
• •Encryption in transit (TLS, with HTTPS enforced by HSTS) and at rest (storage encryption by the hosting providers).
• •Passwords hashed with scrypt; session tokens, API tokens, and invitation and confirmation links stored only as SHA-256 hashes.
• •Email address confirmation for new accounts; optional two-factor login with authenticator apps, with secrets encrypted using AES-256-GCM.
• •Every database query is limited to the customer's own workspace; owner, admin and member roles within a workspace.
• •Rate limits on sign-in, sign-up, two-factor codes and the API; security headers (HSTS, frame-ancestors, X-Frame-Options, nosniff).
• •An audit trail of material actions, which the customer can export.
• •Dependencies checked for known vulnerabilities, and changes tested before deployment.
• •Access to production systems limited to authorised personnel.

Annex 2: Sub-processors