Legal

Data Processing Agreement

A Data Processing Agreement (DPA) is a contract that governs how Averrow processes personal data on a customer’s behalf. This page explains what ours covers and how to get one — it is not the agreement itself.

Updated 5 Oct 2026

Available on request Our DPA is issued directly to customers who need one, not published as a self-serve document — the terms are tied to the customer’s specific plan and processing relationship. Request our DPA through the contact form and our team will send it over.
What It Covers

What a DPA typically includes

  • The roles of each party — who is the data controller and who is the data processor
  • The subject matter, duration, nature, and purpose of processing
  • The categories of personal data and data subjects involved
  • Our sub-processors and the obligations we flow down to them
  • Security measures applied to the data we process
  • How we assist with data subject rights requests
  • Breach notification commitments and timelines
  • Deletion or return of data at the end of the engagement
Who Needs One

Business and Enterprise customers, generally

If your organization is processing personal data through Averrow — and a privacy law such as the GDPR applies to you — a DPA formalizes that relationship. This typically applies to Business and Enterprise plan customers. Professional and free-scan users are welcome to request one too; we just haven’t needed to standardize it for that tier yet.

Our Data Handling, In Summary

Consistent with our Security & Trust page

The summary below reflects how the platform actually operates today — see Security & Trust for the full detail.

Sub-processors

  • Cloudflare — hosting, database, cache, storage and email routing; also runs the automated second-opinion classification used by the Abuse Mailbox.
  • Resend — transactional email delivery (sign-in links, invitations, report acknowledgements and notifications).
  • Stripe — payment processing and subscription billing.
  • Google — sign-in with Google, where a user chooses it.

No third-party AI model provider currently receives customer data. If that changes, this list will be updated first.

Personal data we process

Averrow scans public signals — domains, public DNS records, public social profiles, and threat feed matches. We also hold account information for your users (name, email address, sign-in method). For the Abuse Mailbox, we store the reporter’s email address, the original sender, the subject, and a short excerpt (up to 500 characters) of each reported message. We don’t collect credentials or internal network data. Public scans record at most the approximate country of the request; we don’t store visitor IP, city, or coordinates.

Encrypted at rest and in transit

Data is encrypted at rest (D1) and in transit (TLS 1.3). API keys are stored as hashed secrets.

Retention

Active account data is retained during the subscription. Scan results are cached 24 hours. Deletion completes within 30 days of a request. Rate-limit records expire within about two hours.

DPA available on request Sub-processors listed in our DPA Data minimised to what the product needs SOC 2 Type I: in preparation

Contact us for our privacy and security documentation through the contact form.

Need a signed DPA?

Tell us about your organization and plan, and we’ll get one over to you.

Request Our DPA Review Security & Trust