Data processing addendum
This addendum forms part of the agreement between GhostAudit and its customers and governs our processing of personal data on a customer's behalf. For a signed copy, write to us.
Last updated
1. Scope and roles
This data processing addendum ("DPA") forms part of the terms of service or other agreement ("agreement") between the business that operates GhostAudit at ghostaudit.ai ("GhostAudit", "processor") and the customer ("controller"). It applies where GhostAudit processes personal data on the customer's behalf in providing the hosted service.
The customer is the controller of that personal data, or a processor acting for its own controllers. GhostAudit is the processor. Each party will comply with the data protection laws that apply to it, including, where applicable, Regulation (EU) 2016/679 (GDPR) and the UK GDPR.
Where the customer runs GhostAudit on its own infrastructure, GhostAudit does not process the customer's personal data and this DPA applies only to any support access the customer chooses to grant.
2. Details of processing
| Subject matter | Provision of the GhostAudit AI governance service |
| Duration | The term of the agreement, plus the deletion period in section 10 |
| Nature and purpose | Hosting, storage, aggregation and display of data to give the customer an inventory of its AI systems, usage analytics, assessments, documents and alerts |
| Data subjects | The customer's employees, contractors and other users of its devices and workspace |
| Sensor telemetry | AI tool identifier; hostname or application name of the AI tool; five-minute time window and seconds active; counts of visits or launches; warning and blocking events; device operating system, architecture, browser and version; computer name and, on macOS, hardware serial number (desktop agent only); a per-device identifier; user identity according to the identity mode the customer selects (work email and username, a salted SHA-256 hash, or none) |
| Workspace data | Names, work emails, roles and departments of users and system owners; audit log entries; any personal data the customer enters into records and documents |
| Integration data | Data retrieved from systems the customer connects, such as application assignments from an identity provider |
| Special categories | None intended. The sensors do not collect content. The customer agrees not to enter special-category data into the service |
The sensors do not collect prompts, responses, page content, keystrokes, clipboard contents, screenshots, file names or contents, or full URLs, and do not report activity that does not match the customer's list of AI tools.
3. Customer instructions
GhostAudit will process personal data only on the customer's documented instructions, which are the agreement, this DPA and the customer's configuration and use of the service, unless the law requires otherwise, in which case GhostAudit will inform the customer unless prohibited. GhostAudit will tell the customer if it believes an instruction infringes data protection law.
The customer is responsible for the lawfulness of its instructions, including its decision to deploy sensors, its choice of identity mode, its notice to employees and any consultation with employee representatives.
4. Confidentiality
GhostAudit ensures that people authorized to process personal data are bound by confidentiality and access it only as needed to provide the service.
5. Security
GhostAudit maintains the technical and organizational measures in Annex 1, and may update them provided the overall level of protection is not reduced.
6. Subprocessors
The customer authorizes GhostAudit to engage the subprocessors listed on the subprocessors page. GhostAudit will impose data protection obligations on each subprocessor equivalent to those in this DPA and remains responsible for their performance.
GhostAudit will give notice of a new subprocessor at least 30 days before it begins processing, by updating that page and notifying customers who have subscribed to updates. The customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the customer may terminate the affected service and receive a pro rata refund of prepaid fees.
7. Data subject requests
Taking into account the nature of the processing, GhostAudit will assist the customer in responding to requests from data subjects. The service lets the customer view and delete devices, users and records itself. If GhostAudit receives a request directly, it will refer the data subject to the customer and notify the customer.
8. Assistance
GhostAudit will provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities, to the extent the customer cannot obtain the necessary information itself. Field-level documentation of the sensors is available for this purpose.
9. Personal data breaches
GhostAudit will notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's personal data, and will provide the information reasonably available to help the customer meet its own notification duties.
10. Return and deletion
During the term the customer can export documents and audit logs from the service. On termination, GhostAudit will delete the customer's personal data from production systems within 30 days, and from backups within the backup retention period, unless the law requires it to be kept. On request, GhostAudit will confirm deletion in writing.
11. Audits
GhostAudit will make available the information necessary to demonstrate compliance with this DPA, and will respond to reasonable written security questionnaires. Where that is insufficient, the customer may audit, no more than once a year unless a breach has occurred or a regulator requires it, on reasonable notice, during business hours and subject to confidentiality. GhostAudit does not currently hold a SOC 2 report or ISO 27001 certificate; see the security page.
12. International transfers
Customer data in the hosted service is stored in: DigitalOcean, New York, United States. Where the processing involves a transfer of personal data subject to the GDPR or UK GDPR to a country without an adequacy decision, the parties agree that the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), module two or three as applicable, and the UK addendum where relevant, are incorporated into this DPA, with the details in section 2 and Annex 1 serving as their annexes.
13. Liability and precedence
Liability under this DPA is subject to the limits in the agreement. If this DPA conflicts with the agreement on the processing of personal data, this DPA prevails; if the standard contractual clauses apply and conflict with this DPA, the clauses prevail.
Annex 1: technical and organizational measures
- Encryption in transit. Sensors and browsers communicate with the service over HTTPS. Sensors require TLS 1.2 or later and do not follow redirects.
- Credential protection. User passwords are stored as salted bcrypt hashes. Device credentials are stored only as hashes. Credentials for customer integrations are encrypted before storage.
- Access control. Role-based access within each workspace, including a read-only role enforced by the server. Each customer's data is logically separated by organization.
- Audit logging. Changes in a workspace are recorded with the acting user and time, and can be exported by the customer.
- Data minimization. Sensors are designed to collect metadata only, to match against the customer's AI tool list on the device, and to discard everything else. Identity can be pseudonymized on the device or omitted.
- Sensor integrity. Each device has its own revocable credential; enrollment tokens can be revoked and can expire.
- Abuse protection. Rate limiting on authentication and public endpoints.
- Backups. Regular database backups with a defined retention period.
- Personnel. Access to production systems is limited to personnel who need it and is subject to confidentiality obligations.
Contact
Questions about this DPA, and requests for a countersigned copy: [email protected].
Questions about this document: [email protected]