Ciso99.AI · Incorporated by reference into the Ciso99.AI Terms of Service

Data Processing Agreement

This Data Processing Agreement (“DPA”) is incorporated by reference into the Ciso99.AI Terms of Service (the “Agreement”) between the party entering into the Agreement (“Controller”) and Ciso99.AI (“Processor”).

Whereas, in connection with the performance of its obligations under the Agreement, Processor may Process Controller Personal Data (both as defined below) on behalf of the Controller; and

Whereas, the parties wish to set forth the mutual obligations with respect to the Processing of Controller Personal Data by the Processor;

Now therefore, intending to be legally bound, the parties hereby agree as follows:

Definitions. In addition to capitalized terms defined elsewhere in this DPA, the following terms shall have the meanings set forth below:

“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control” for purposes of this definition means direct or indirect ownership or control of more than 50% of the voting interest in the subject entity.
“Applicable Law” means The Israel Protection of Privacy Law, 1981, all related regulations enacted thereunder including without limitation the Israeli Protection of Privacy Regulations (Information Security) – 2017, and the Israel Privacy Protection Authority’s Guidelines, (collectively, “Israeli Privacy Law”).
“Controller Personal Data” means any Personal Data Processed by Processor on behalf of Controller pursuant to or in connection with the Agreement.
“Data Protection Laws” means Applicable Law and, to the extent applicable, the data protection or privacy laws of any other applicable country.
“Sub Processor” means any person (excluding an employee of Processor) appointed by or on behalf of Processor or any Processor Affiliate to Process Controller Personal Data on behalf of the Controller in connection with the Agreement.
“Data Subject” shall mean the person whose Personal Data is Processed.
“Personal Data” shall mean 'Personal Information' ('meida ishi') as defined under Israeli Privacy Law, in each case, as applicable.
“Processing” shall be as defined in the Israeli Privacy Law.

Applicability and Roles of the Parties. Controller shall be considered the party controlling the database of Controller Personal Data and Processor serves as an outsourced service provider on its behalf.
Processing of Controller Personal Data.

Processor shall Process Controller Personal Data on Controller's behalf and at Controller's instructions as specified in the Agreement and in this DPA, including without limitation with regard to transfers of Controller Personal Data to a third country or international organization. Any other Processing shall be permitted only in the event that such Processing is required by any Data Protection Laws to which the Processor is subject. In such event, Processor shall, unless prohibited by such Data Protection Laws on important grounds of public interest, inform Controller of that requirement before engaging in such Processing.
Controller instructs Processor (and authorizes Processor to instruct each Sub Processor) (i) to Process Controller Personal Data for the provision of the services, as detailed in the Agreement (“Services”) and as otherwise set forth in the Agreement and in this DPA, and/or as otherwise directed by Controller; and (ii) to transfer Controller Personal Data to any country or territory as reasonably necessary for the provision of the Services and in accordance with Applicable Law.
Processor may use Gen-AI, including Gen-AI agents, to analyze, monitor, and act upon Controller Personal Data strictly for the purposes set forth in the Agreement and this DPA, provided that such systems operate under reasonable policies, appropriate human oversight, and auditable controls. Processor shall not use Controller Personal Data to train, fine-tune, or otherwise improve Gen-AI models unless Controller has expressly authorized such use in writing. Notwithstanding the foregoing, Processor may use data derived from Controller Personal Data, where such data has been aggregated and/or anonymized, for the purpose of improving the Services. “Gen AI” means software programs, models, algorithms or systems that utilize artificial intelligence techniques, including but not limited to machine learning, deep learning, neural networks, large language models, transformer architectures, or diffusion models to create, generate, or synthesize novel content, data, or outputs-such as text, images, audio, video, code, or other media-based on patterns learned from training data, prompts, parameter configurations, or other inputs, without explicitly programming the specific rules for content creation.
Controller sets forth the details of the Processing of Controller Personal Data in Schedule 1 (Details of Processing of Controller Personal Data), attached hereto.

Controller. Controller represents and warrants that it has and shall maintain throughout the term of the Agreement and this DPA, all necessary rights to provide the Controller Personal Data to Processor for the Processing to be performed in relation to the Services and in accordance with the Agreement and this DPA. To the extent required by Data Protection Laws, Controller is responsible for obtaining any necessary Data Subject consents to the Processing, and for ensuring that a record of such consents is maintained throughout the term of the Agreement and this DPA and/or as otherwise required under Data Protection Laws.
Data Transfers. Processor shall ensure that any recipient of Controller Personal Data is bound by the same data protection obligations as set out in this section, including the implementation of appropriate safeguards for international data transfers.
Processor Employees. Processor shall take reasonable steps to ensure that access to the Controller Personal Data is limited on a need to know and/or access basis and that all Processor employees receiving such access are subject to confidentiality undertakings or professional or statutory obligations of confidentiality in connection with their access to and use of Controller Personal Data.
Security.

Processor shall implement information security measures and take all necessary measures as per the Israeli Privacy Law, in order to maintain the integrity, availability, confidentiality, survival and reliability of Personal Information of the Data Subjects, and comply with all provisions of the Israeli Privacy Law, including, and without limitation, (a) the measures outlined in Schedule 2 attached hereto; and (b) the obligations of an “external party” under section 15 of the Protection of Privacy Regulations (Data Security), 5777-2017, which a “database controller” must oblige an external party within the framework of an outsourcing agreement (as such terms are defined in the Israeli Privacy Law), and all which are hereby explicitly incorporated in this DPA;
Processor will report, at least once a year, to Controller on the manner in which it is complying with its obligations under the Israeli Privacy Law and this DPA.

Personal Data Breach.

Processor shall notify Controller without undue delay and, where feasible, immediately upon Processor becoming aware of a Personal Data Breach affecting Controller Personal Data. In such event, Processor shall provide Controller with reasonable and available information to assist Controller in meeting any obligations to inform Data Subjects or Supervisory Authorities of the Personal Data Breach as required under Applicable Law.
At the written request of the Controller, Processor shall reasonably cooperate with Controller and take such commercially reasonable steps as are agreed by the parties or required under Applicable Law to assist in the investigation, mitigation and remediation of any Personal Data Breach.

Sub Processing.

Controller authorizes Processor to appoint (and permits each Sub Processor appointed in accordance with this Section 9 to appoint) Sub Processors in accordance with this Section 9.
Processor shall remain fully liable to the Controller for the performance of any Sub Processor's obligations.

Data Subject Rights.

Controller shall be solely responsible for compliance with any statutory obligations concerning requests to exercise Data Subject rights under Data Protection Laws (e.g., for access, rectification, deletion of Controller Personal Data, etc.). Processor shall, at Controller's sole expense, use commercially reasonable efforts to assist Controller in fulfilling Controller's obligations with respect to such Data Subject requests, as required under Data Protection Laws.
Upon receipt of a request from a Data Subject under any Data Protection Laws in respect to Controller Personal Data, Processor shall promptly notify Controller of such request and shall not respond to such request except on the documented instructions of Controller or as required by Data Protection Laws to which the Processor is subject, in which case Processor shall, to the extent permitted by Data Protection Laws, inform Controller of such legal requirement prior to responding to the request.

Deletion or Return of Controller Personal Data. Processor shall promptly and in any event within 60 (sixty) days of the date of cessation of provision of the Services to Controller involving the Processing of Controller Personal Data, delete, return, or anonymize all copies of such Controller Personal Data, provided however that Processor may retain Controller Personal Data, as permitted by applicable law.
Audit Rights.

Subject to Sections 12.2 and 12.3, Processor shall make available to an auditor mandated by Controller in coordination with Processor, upon prior written request, such information reasonably necessary to demonstrate compliance with this DPA and shall allow for audits, including inspections, by such reputable auditor mandated by the Controller in relation to the Processing of the Controller Personal Data by the Processor, provided that such third-party auditor shall be subject to confidentiality obligations.
Any audit or inspection shall be at Controller's sole expense and shall be subject to the terms of the Agreement, and subject to Processor's reasonable security policies and obligations to third parties, including with respect to confidentiality. The results of any audit or inspection shall be considered the confidential information of the Processor and shall be treated with the same degree of care as Controller affords its own confidential information.
Controller and any auditor on its behalf shall use best efforts to minimize or avoid causing any damage, injury or disruption to the Processors' premises, equipment, employees and business and shall not interfere with the Processor's day-to-day business. Controller and Processor shall mutually agree upon the scope, timing and duration of the audit or inspection and the reimbursement rate, for which Controller shall be responsible. Processor need not give access to its premises for the purposes of such an audit or inspection:

to any individual, unless he or she produces reasonable evidence of identity and authority;
if Processor was not given a prior written notice of such audit or inspection;
outside of normal business hours at those premises, unless the audit or inspection needs to be conducted on an emergency basis; or
for the purposes of more than one (1) audit or inspection in any calendar year, except for any additional audits or inspections which:

Controller reasonably considers necessary because of genuine concern as to Processor's compliance with this DPA; or
Controller is required to carry out by Applicable Law, a Supervisory Authority or any similar regulatory authority responsible for the enforcement of Applicable Law in any country or territory where Controller has identified its concerns or the relevant requirement or request in its prior written notice to Processor of the audit or inspection.

General Terms.

Term and Termination and Governing Law. Processor’s obligations under this DPA will apply for the duration of the Agreement. This DPA, including the validity, interpretation, or performance thereof and any of its terms or provisions, and the rights and obligations of the parties under this DPA will be governed by, interpreted, construed and enforced in and only in accordance with, the domestic laws of the State of Israel without giving effect to any choice or conflict of law provision or rule that would cause the application of the laws of any jurisdiction other than the State of Israel. The competent court in Tel Aviv-Jaffa will have the sole jurisdiction over any dispute arising under this DPA.
Order of Precedence. This DPA is not intended to, and does not in any way limit or derogate from Controller's obligations and liabilities towards the Processor under the Agreement and/or pursuant to Data Protection Laws or any law applicable to Controller in connection with the collection, handling and use of Controller Personal Data by Controller or its Affiliates or other processors or their sub processors, including with respect to the transfer or provision of Controller Personal Data to Processor and/or providing Processor with access thereto. In the event of inconsistencies between the provisions of this DPA and any other agreements between the parties, including the Agreement and including (except where explicitly agreed otherwise in writing, signed on behalf of the parties) agreements entered into or purported to be entered into after the date of this DPA, the provisions of this DPA shall prevail.
Severance. Should any provision of this DPA be held invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall either be (i) amended as necessary to ensure its validity and enforceability, while preserving the parties' intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.

Schedule 1: Details of Data Processing

Data which may be processed by Processor	Employee data (names, emails, roles, access permissions) User/account metadata Authentication logs (SSO, MFA events) System and application logs Security alerts and incident data Configuration data (cloud, SaaS, infrastructure) Vulnerability data (scan results, CVEs) Compliance artifacts (policies, audit evidence) Vendor/security questionnaire data Limited content data (only where necessary for incident investigation)
Purpose of processing	Security monitoring and threat detection Incident detection, investigation, and response support Vulnerability management and prioritization Compliance automation (SOC2, ISO27001, etc.) Risk assessment and posture management Identity and access analysis Third-party risk management Security recommendations and remediation guidance Reporting and analytics
Permissible types of processing by Processor	Collection Storage Analysis (including automated/AI-driven analysis) Correlation and enrichment Monitoring (continuous) Alerting and notification Reporting Deletion and anonymization
Systems which may be accessed by Processor	Cloud environments (AWS, GCP, Azure) Identity providers (Okta, GWS, etc.) SaaS tools (GitHub, Slack, Jira, etc.) Security tools (SIEM, EDR, vulnerability scanners) Internal systems relevant to security and compliance Log management systems Ticketing and incident management systems
Processor’s contact person for all matters regarding this DPA shall be:	Your designated CISO Email: support@ciso99.com

Schedule 2: Binding Security Document

Having taken into account the state of the art, the costs of implementation, the nature, scope, context, and purpose(s) of Processing and the risks involved, the following security measures have been deemed appropriate by the parties and have been implemented accordingly:

1. Encryption & Data Protection

Encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent)
Secrets management (no hardcoded credentials)
Tokenization or pseudonymization where feasible

2. Access Control

Role-Based Access Control (RBAC)
Least privilege enforcement
MFA for all privileged access
Just-in-time access where applicable

3. Agentic / AI Controls

Policy-bound agent execution (no unrestricted actions)
Human-in-the-loop for critical actions (optional per configuration)
Full audit logs of agent decisions and actions
Safeguards against unintended data exposure

4. Monitoring & Logging

Centralized logging of:

Access events
Processing activities
Security events

Immutable logs where feasible
Continuous monitoring for anomalies

5. Vulnerability Management

Continuous vulnerability scanning
Patch management processes
Regular penetration testing

6. Incident Response

Formal incident response plan
Breach detection and escalation procedures
Forensics support capability

7. Resilience & Availability

Backup and disaster recovery procedures
Defined RTO/RPO targets
High-availability architecture where applicable

8. Sub-Processor Security

Due diligence and risk assessments
Contractual security obligations
Data Processing Agreements in place

9. Data Minimization & Retention

Collection limited to necessary data
Configurable retention policies
Secure deletion procedures

10. Development & Change Management

Secure SDLC practices
Code reviews and automated testing
Infrastructure-as-code controls

11. Compliance & Assurance

SOC 2 / ISO 27001 (if applicable)
Periodic internal audits
Security awareness training

12. Physical & Infrastructure Security

Cloud provider security controls (e.g., AWS/GCP/Azure)
Restricted physical access
Environmental protections

13. Data Segregation

Logical separation between customers (multi-tenancy controls)

14. Data Subject Rights Support

APIs/processes to support access, deletion, correction requests

15. Secure System Configuration

Hardened baselines
Continuous configuration monitoring