Data Processing Agreement (DPA)

1. Purpose and parties

This DPA applies whenever AAA Sentinel processes personal data on behalf of the customer in connection with providing the service (for example, data of users the customer registers on its account, or metadata from its cloud accounts). The customer acts as data controller and AAA Sentinel as data processor, within the meaning of Article 4 of Regulation (EU) 2016/679 (GDPR).

2. Subject matter, nature and purpose of processing

AAA Sentinel processes personal data on behalf of the customer to provide the FinOps, account-posture and AI-spend governance Platform:

• Nature: hosting, automated processing, analysis and generation of reports and tickets.
• Purpose: authenticating the customer's users, analyzing cost and configuration of connected accounts, reading spend from connected AI APIs, generating recommendations, alerts and tickets, running approved agent actions, and billing the service.
• Duration: for as long as the service agreement is in force, plus the retention period described in section 3.

3. Duration

This DPA takes effect when the customer starts using the Platform and remains in force for as long as AAA Sentinel processes personal data on behalf of the customer, including the period after termination described in the Privacy Policy (retention of up to 3 months for export or reactivation, or 14 days if the customer requests deletion from their profile, followed by revocation of access and complete deletion).

4. Categories of data subjects and data

Processing may involve the following categories:

• Data subjects: employees and collaborators of the customer with access to the Platform and, with the security add-on, the people who operate its cloud accounts.
• Data: name, email, role, activity logs and, for the people who operate the cloud accounts, the identity (ARN) and source IP of each critical change, kept for 90 days.
• Technical metadata: IAM role ARNs, Service Principal IDs, encrypted Service Account keys, resource identifiers (which may include IAM user names) in findings and in scan coverage, encrypted AI API keys.
• AAA Sentinel does not access application content (code, business data in the customer's databases) beyond the cost, configuration and posture metadata required, the files of its FOCUS export and, if it turns on monitoring flows, searching its logs for a trace and checking a key in DynamoDB or S3 (the configuration of functions such as Lambda, Cloud Functions or Cloud Run includes the values of their environment variables, which are not stored), and does not use AI keys for purposes other than the contracted service.

5. Controller's instructions

AAA Sentinel processes personal data solely on the customer's documented instructions, which are deemed given through contracting the service, its configuration on the Platform, and this DPA. If AAA Sentinel considers that an instruction infringes the GDPR or other applicable data protection law, it will inform the customer before carrying it out.

6. Staff confidentiality

AAA Sentinel ensures that persons authorized to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality, and have received appropriate data protection training.

7. Security measures

AAA Sentinel applies the technical and organizational measures described in section 7 of the Privacy Policy, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Cloud access credentials encrypted with AWS KMS using a key managed by AAA Sentinel.
• Multi-tenant isolation verified at every API endpoint.
• Audit log of actions performed on the data, to which the application only appends entries.
• Mandatory multi-factor authentication for staff with access to platform data.

8. Sub-processors

The customer gives general authorization for AAA Sentinel to engage the following sub-processors to provide the service:

• Amazon Web Services (AWS): infrastructure, EU-West-1 region (Ireland), and EU-Central-1 (Frankfurt) to confirm monitoring outages. Cognito, DynamoDB, Lambda, S3 and KMS.
• Stripe: payments, PCI DSS Level 1.
• Google Cloud (Vertex AI, Gemini): main AI assistance, EU multi-region, not used to train models.
• Amazon Bedrock (AWS): fallback for AI assistance when Gemini fails, us-east-1 region (US), not used to train models.
• Slack, Jira or Linear only when the customer connects them as an alert or ticket destination (processing on the controller's instruction).

AAA Sentinel will inform the customer of any planned change to this list with reasonable notice, so the customer may object on justified data-protection grounds.

9. International transfers

Where a sub-processor processes data outside the European Economic Area, AAA Sentinel ensures the transfer is covered by the European Commission's Standard Contractual Clauses, an adequacy decision, or the EU-US Data Privacy Framework, as applicable.

10. Internal platform staff access

A small internal AAA Sentinel team accesses aggregated metrics to operate the Platform, bill correctly and provide support, subject to the following guarantees (detailed in section 12 of the Privacy Policy):

• Aggregation principle: no access to the content of findings, cloud resource identifiers, credentials or customer reports.
• Strong authentication (MFA) in an identity directory separate from the customer one.
• Audit log of every access.
• Segregation of duties: access to financial data is restricted to specific roles.
• No impersonation access in the current product.

11. Assistance to the controller

AAA Sentinel will assist the customer, insofar as reasonable and taking into account the nature of the processing, in complying with its obligations to respond to data subject rights requests and, where applicable, to carry out data protection impact assessments and prior consultations with the supervisory authority.

12. Security breach notification

AAA Sentinel will notify the customer without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach affecting it, together with the information the customer needs to comply with its own notification obligations.

13. Audits

AAA Sentinel will make available to the customer the information necessary to demonstrate compliance with the obligations set out in this DPA and will allow reasonable audits, including inspections, carried out by the customer or an auditor authorized by it, subject to reasonable notice and standard confidentiality commitments.

14. Return and deletion of data

On termination of the service, and unless otherwise required by law, AAA Sentinel will delete or return to the customer the personal data processed, in accordance with the timeframes described in section 8 of the Privacy Policy. The customer can also download its data at any time from its profile and request its deletion, which is carried out after 14 days unless cancelled before then.

15. Governing law and contact

This DPA is governed by the same law and jurisdiction as the Terms and Conditions. For any questions about this agreement: compliance@aaa-sentinel.com.