Data Processing Addendum
Forms part of the Terms of service where CybXSan processes personal data on your organisation's behalf. If you need it executed as a signed counterpart, email info@cybxsan.com.
Last updated: 16 September 2026
1. Roles
Your organisation is the controller (or, under the DPDP Act, the Data Fiduciary). CybXSan is the processor (Data Processor) for the data described in section 3. Where you are yourself a processor acting for your own customer, we are a sub-processor and this addendum flows down accordingly.
2. Subject matter and duration
Subject matter: counter-signing and archiving erasure certificates, and
operating the organisation console.
Duration: for the life of your organisation account, except archived
certificates, which persist so their verification URLs keep resolving (section 7).
Nature and purpose: storage, integrity attestation and retrieval of erasure
evidence.
Types of personal data: console user names and email addresses; hostnames
and machine fingerprints; and, only where an administrator has enabled named
mode, filenames that may themselves contain personal data.
Categories of data subject: your personnel who use the console or run the
application. Data principals whose records you erase are not identified to us in the
default configuration.
3. What we never process
File contents never reach us, under any configuration. The application contains no code path that reads file data for transmission. Erasure itself makes no network call at all. This is an architectural property, not a policy commitment we could quietly relax — see Security.
By default, item paths are transmitted as SHA-256 digests rather than names. The mode is set
by the server, stamped into each certificate as privacy.filenames, and
re-validated server-side against the record's actual contents before archiving.
4. Processing on instruction
We process personal data only on your documented instructions, which comprise these terms and your use of the service. We will tell you if an instruction appears to infringe applicable data protection law. We will not sell personal data, and we will not use it to train models.
5. Confidentiality
Personnel with access to personal data are bound by confidentiality obligations and have access only to the extent required to operate and support the service.
6. Security measures
Technical and organisational measures, per GDPR Art. 32:
- TLS in transit; encryption at rest as provided by the underlying Cloudflare services
- Session cookie values and organisation API tokens stored only as SHA-256 digests
- Identity bound to the
(provider, subject)pair, never to an email address alone - Unverified provider email addresses rejected at sign-in
- Server-side recomputation of record integrity hashes before signing; fail-closed if the signing key is unavailable
- Domain-separated signing contexts, so an operator signature cannot be replayed as a FileX counter-signature
- An append-only credit ledger with database-enforced idempotency
- Data minimisation by default: path hashes rather than filenames, and no file contents at all
We hold no SOC 2 report and no organisational ISO 27001 certificate. See Security, which says so plainly rather than in a footnote.
7. Sub-processors
You authorise the sub-processors listed on the Security page: Cloudflare (hosting, archive and object storage), Dodo Payments (merchant of record), and Google and Microsoft where you choose their sign-in. We remain liable for their performance. We will give notice here before adding a sub-processor, and you may object.
8. International transfers
Where personal data is transferred outside its originating jurisdiction, transfers rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses where applicable, which are incorporated by reference. The current primary storage region is confirmed in writing on request — see data residency.
9. Assisting you
Taking account of the nature of the processing, we will assist you with data-subject requests, with security obligations, and with impact assessments. Because the default configuration holds no identifiers of the data principals whose records you erase, most such requests will be answerable from your own systems without our involvement.
10. Personal data breach
We will notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting your data, with the information available at the time and updates as we learn more. We note the shorter statutory clocks that may apply to you — including CERT-In's six-hour reporting requirement in India — and will prioritise giving you what you need to meet them.
11. Return and deletion
On termination we delete your organisation's console state and account data. Archived certificates are deleted on your explicit request.
One consequence worth stating plainly rather than burying: deleting an archived certificate makes its public verification URL stop resolving, so evidence you already handed to an auditor or regulator will no longer verify against our service. Certificates you hold locally still verify offline. Tell us which outcome you intend.
12. Audits
We will make available the information necessary to demonstrate compliance with this addendum, and will respond to reasonable security questionnaires. Given our size we do not offer on-site audits; we will answer specific written questions instead, including about the code paths described here.
13. Contact
CybXSan — info@cybxsan.com.