Data Processing Addendum

1. Parties and how this DPA applies

This Data Processing Addendum ("DPA") is between the customer that installs the audytx GitHub App, holds an audytx account, or uses the audytx MCP server (the "Controller") and Rexstart Labs Pvt Ltd, the operator of audytx (the "Processor").

This is a click-through addendum: it forms part of the audytx Terms of Service and takes effect automatically when you install the GitHub App, create an account, or call the MCP server. No signature is required.

2. Subject matter, duration, nature and purpose

The processing is the automated static analysis of the Controller's Terraform and CloudFormation configurations: audytx fetches .tf and .tfvars files and CloudFormation templates (or receives them in an MCP request or an optional plan or change-set upload), analyzes them in memory, and returns findings. No source file content is written to any database or log.

Processing lasts for as long as the GitHub App remains installed or the account remains active, plus the retention period in section 9.

3. Categories of personal data and data subjects

Processed transiently, never persisted: the contents of the Terraform and CloudFormation files audytx scans, which may incidentally contain personal data.

Persisted: scan and call records (the account or installation identifier, tool and client names, outcome, timestamps, and counts of resources, files and findings; numbers and identifiers only, with no customer content and no personal data beyond the account identifier), installation records, and the quota ledger (internal identifiers). The scan's request and result are passed to the analytics service through temporary object storage and deleted as soon as they are processed. Operational logs are kept at Cloudflare for 7 days. What is stored and for how long is listed at /trust#storage.

Data subjects: the Controller's personnel, contractors and repository contributors whose GitHub identifiers appear in the processed data.

Account registration data (email, name, optional company email) and the GitHub user ID of an account that signs in with GitHub, contact-form submissions and Cost Sampler reports are processed by Rexstart Labs Pvt Ltd as an independent controller under the Privacy Policy, not under this DPA. audytx neither requests nor is designed to process special categories of personal data.

4. Documented instructions

The Processor processes personal data only on documented instructions from the Controller. The documented instructions are: installing the GitHub App on chosen repositories (scan pull requests there), each MCP tool call (scan the submitted content), and each optional plan upload. If applicable law requires processing contrary to those instructions, the Processor will inform the Controller before processing, unless that law prohibits it.

5. Confidentiality

Access to production data is limited to authorized personnel of Rexstart Labs Pvt Ltd, who are committed to confidentiality.

6. Security measures

The technical and organisational measures are described on the trust & data handling page. In summary:

• Source files are scanned in memory and never stored — there is no copy of your repository at rest anywhere in the service.
• Persisted data is scan and call counts, installation and account records, and the quota ledger; what is stored and for how long is listed at /trust#storage.
• Access to repository contents is read-only. The GitHub App's other permissions (pull requests, checks, code scanning alerts, issues, metadata) are listed at /trust#permissions; write access to contents is not requested.
• Every HTTP response carries centrally-stamped security headers (HSTS, CSP, X-Frame-Options, nosniff), and API credentials are stored as SHA-256 hashes.
• No third-party analytics, advertising, or data-broker services.

7. Subprocessors

The Controller grants general written authorisation for the subprocessors listed at /subprocessors — currently Cloudflare (hosting, storage, queues, transactional email, operational logs), GitHub (source of scanned files and destination of results) and Google Workspace (staff mailboxes).

The Processor will give at least 30 days' advance notice of any intended addition or replacement by publishing a dated entry on that page. If the Controller objects, its remedy is to stop using the service before the change takes effect — removing the GitHub App stops audytx's access to your repositories.

Each subprocessor is bound by its own data-processing terms, linked from the subprocessor list.

8. Assistance with data subject rights and incidents

Taking into account the nature of the processing (no source code is stored), the Processor assists the Controller in responding to requests to exercise the rights of a data subject — access, rectification, erasure — for the scan and call records and installation records described in section 3, via a support ticket.

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's personal data, and will provide the information reasonably needed for the Controller's own notification obligations.

9. Deletion and return

• Removing the GitHub App from your repository or organization stops audytx's access to it. It does not delete stored data: the installation record is kept, marked removed, and scan and call counts are kept.
• Scan and call records hold numbers and identifiers only and are kept until the account is deleted; the IP address and browser string on older sign-in and activity records are cleared after 90 days.
• Deletion of scan and call records for your installation can be requested via a support ticket and is completed within 7 days, with confirmation by reply.
• Account holders can delete their account from the dashboard. That removes the account, its Client IDs, sessions, sign-in codes, the scan and call records held for the account, saved cost reports and settings. It keeps the quota ledger and the email-hash counters, which hold credit events and balances, an internal Client ID identifier or GitHub installation ID, a request trace ID, and a one-way hash of the email and no scan content; the counters stop a deleted account from resetting its monthly quota. Totals that name no account remain. GitHub App scan records are keyed to the installation, not the account; their deletion can be requested via support@audytx.com.
• Deleted data can remain in Cloudflare's database recovery history for up to 30 days.

10. Information and audit

The Processor makes available the information necessary to demonstrate compliance with this DPA: the trust page lists what is stored and for how long. The Processor will additionally respond to reasonable written audit enquiries submitted via a support ticket.

11. International transfers — Standard Contractual Clauses

Processing runs on Cloudflare's global edge network; scan and account data is stored in a Cloudflare D1 database in the Asia-Pacific (APAC) region, and the Processor is established in India.

Where personal data originating in the EEA, the United Kingdom, or Switzerland is transferred to the Processor, the transfer is governed by the EU Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (controller to processor), which are incorporated into this DPA by reference, with the Controller as data exporter and Rexstart Labs Pvt Ltd as data importer. Where the Controller acts as a processor for its own customers, Module Three (processor to processor) applies instead. For UK transfers the clauses are read with the ICO's International Data Transfer Addendum; for Swiss transfers, with the adaptations required by the FADP.

Annex I to the clauses is completed by sections 2 and 3 of this DPA; Annex II by section 6; the list of subprocessors by /subprocessors. Onward transfers to subprocessors are covered by each subprocessor's own transfer terms, linked from that page.

12. Term and precedence

This DPA applies for as long as the Processor processes personal data on behalf of the Controller and ends automatically when that processing ends (section 9). If this DPA conflicts with the Terms of Service, this DPA prevails with regard to the processing of personal data. Changes to this DPA are posted on this page with the date above updated. Account holders are emailed about material changes.

• 2026-10-02 — Subprocessor list: the website's fonts are now served from audytx.com, so the font provider is no longer listed.
• 2026-10-01 (version 1.1) — Corrected what is stored and for how long, the data location, what uninstalling and deleting an account keep, and the subprocessor list.
• 2026-09-29 — CloudFormation scope and account-data list updated.
• 2026-07-13 (version 1.0) — First published.