Data Processing Addendum.

1. The parties & subject matter

This Data Processing Addendum (the "DPA") forms part of, and is governed by, the Terms of Service or Order Form between the Customer (the "Controller") and Kanonik LLC (the "Processor") for use of Kanonik (the "Service").

The Processor will Process Personal Data on behalf of the Controller in connection with the Service, in accordance with this DPA. Capitalised terms not defined here have the meaning given in the Terms of Service or in Regulation (EU) 2016/679 (the "GDPR") and its UK equivalent (the "UK GDPR").

2. Duration & termination

This DPA applies for the duration of the Customer's Subscription. On termination, the Processor will return or delete Personal Data in accordance with Section 12.

3. Nature & purpose of processing

The Processor will Process Personal Data only as necessary to provide the Service and to comply with the Controller's documented instructions, including (a) running the MCP server and tools, (b) executing the server-side Verifier, (c) producing and storing audit-log events, (d) generating Auditor Export bundles, and (e) reading and writing to the Controller's GRC tool on the Controller's authority.

The Controller's acceptance of the Terms of Service, the configurations the Controller makes in the Service, and any subsequent written instructions from the Controller constitute its documented instructions to the Processor.

4. Categories of personal data & data subjects

Categories of personal data: as described in Annex I. In summary: (a) account data of the Controller's authorised users (name, work email, role, OIDC subject identifier); (b) the canonical representation of the Controller's GRC entities (controls, evidence, mappings) which may incidentally contain the names of the Controller's personnel; (c) audit-log content describing operations on (a) and (b); (d) approval-token references and approver identities.

Categories of data subjects: the Controller's employees, contractors, and authorised users; the Controller's customers, suppliers, and third parties to the extent they appear in Customer Data.

The Service is not designed to process special categories of personal data within the meaning of GDPR Article 9. The Controller agrees not to submit special-category data unless strictly necessary; if it does, additional measures may apply by separate agreement.

5. Processor obligations

The Processor will:

• Process Personal Data only on documented instructions of the Controller, including with regard to international transfers, unless required by applicable law (in which case the Processor will inform the Controller of that legal requirement, unless prohibited);
• Ensure that personnel authorised to Process Personal Data are bound by confidentiality obligations or are under appropriate statutory obligations of confidentiality;
• Take all measures required pursuant to GDPR Article 32 (security of processing), as detailed in Annex II;
• Engage sub-processors only in accordance with Section 6 and impose on them obligations no less protective than those in this DPA;
• Assist the Controller, taking into account the nature of processing, in fulfilling its obligations to respond to requests from data subjects (Section 9);
• Assist the Controller in complying with its obligations under GDPR Articles 32-36 (security, breach notification, DPIAs, prior consultation), taking into account the nature of processing and the information available to the Processor;
• At the choice of the Controller, delete or return all Personal Data after the end of the provision of services (Section 12);
• Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, in accordance with Section 11.

6. Sub-processors

The Controller provides general written authorisation for the Processor to engage the sub-processors listed in Annex III.

The Processor will inform the Controller of any intended addition or replacement of sub-processors at least thirty (30) days before the change takes effect, by updating Annex III at this URL and notifying registered Customers by email.

The Controller may object to a new sub-processor on reasonable grounds within fifteen (15) days of notification by emailing [email protected]. If the Controller objects, the parties will work together in good faith to resolve the objection. If no resolution is reached, the Controller may terminate the affected Subscription with a pro-rata refund of pre-paid fees.

The Processor remains fully liable to the Controller for the performance of its sub-processors' obligations.

7. International transfers (SCCs)

Where the Processor transfers Personal Data of EU / EEA / UK / Swiss data subjects outside the EEA / UK / Switzerland to a country not covered by an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (Decision 2021/914), Module 2 (Controller to Processor) or Module 3 (Processor to Sub-Processor) as applicable, are incorporated into this DPA by reference. The UK International Data Transfer Addendum (or its replacement) is incorporated for transfers from the UK.

Where the SCCs require party choices, the parties agree:

• Clause 7 (docking): the option is enabled;
• Clause 9(a) (sub-processors): option 2 (general written authorisation), with thirty (30) days' notice as set out in Section 6 above;
• Clause 11 (independent dispute resolution): the optional element is not selected;
• Clause 17 (governing law): the law of Ireland;
• Clause 18 (forum): the courts of Ireland;
• Annex I, II, and III of the SCCs are populated by Annexes I, II, and III of this DPA respectively.

The Processor has assessed transfer impact and applies supplementary technical measures (encryption in transit and at rest, key isolation, pseudonymisation where feasible) consistent with European Data Protection Board recommendations.

8. Security measures

The Processor implements and maintains the technical and organisational measures set out in Annex II, designed to ensure a level of security appropriate to the risk of processing.

The Processor's architecture is designed to be compatible with FedRAMP Moderate baseline expectations from day one (FIPS 140-validated cryptography, mTLS internal services, append-only audit log, signed events, infrastructure-as-code with GitOps, signed container images and SBOM per build, supply-chain vulnerability scanning in CI). Authorisation pursuit is on the Processor's longer-term roadmap and not represented as obtained.

9. Data subject rights

The Processor will, taking into account the nature of processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller's obligation to respond to requests for exercising the data subject's rights under Chapter III GDPR (rights of access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making).

Where data subjects contact the Processor directly, the Processor will, without undue delay, refer them to the Controller and inform the Controller of the request.

The Processor offers the following self-service mechanisms accessible to the Controller:

• Auditor Export - one-click signed bundle (PDF + JSON) of all events, mappings, evidence, and reasoning for a tenant, supporting access and portability requests;
• Tenant deletion - multi-step delete with 30-day grace period followed by cryptographic erasure (Section 12), supporting erasure requests;
• REST API access (Team and Business tiers) for granular data export.

10. Personal data breach notification

The Processor will notify the Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting the Controller's Personal Data. The notification will include, to the extent then known:

• The nature of the breach, including the categories and approximate number of data subjects and records affected;
• The likely consequences of the breach;
• The measures taken or proposed to address the breach, including measures to mitigate possible adverse effects;
• The Processor's contact point for further information.

The Processor will continue to update the Controller as additional information becomes available and will cooperate with any necessary investigation, regulatory reporting, or notification to data subjects.

11. Audit & inspection rights

The Processor will make available to the Controller, on request, the most recent third-party audit reports (e.g., SOC 2 Type II reports when obtained) and a written summary of its security and privacy practices.

The Controller may, no more than once per twelve-month period (or more frequently where required by a competent supervisory authority or following a Personal Data Breach), conduct an audit of the Processor's compliance with this DPA. Audits will be conducted at the Controller's expense, on at least thirty (30) days' written notice, during normal business hours, in a manner that does not unreasonably disrupt the Processor's business or compromise the confidentiality of other customers' data, and subject to a written confidentiality agreement.

The Processor may satisfy audit requirements by providing the Controller with the audit reports referenced above.

12. Return or deletion of personal data

On termination of the Subscription, the Processor will, at the Controller's choice and within the timelines below:

• Within 30 days of termination - make Personal Data available for export by the Controller via the Auditor Export and (where applicable) the REST API;
• After the 30-day grace period - destroy the Controller's tenant-level encryption keys (the "crypto-erase" described in the Privacy Policy), rendering Personal Data mathematically inaccessible;
• Append-only audit log entries - retained in the Processor's event store for the regulatory retention period stated in the Privacy Policy (currently 7 years), with the underlying Personal Data already inaccessible due to crypto-erase.

The Processor will provide written confirmation of crypto-erase on request.

13. Liability & precedence

The liability of each party under this DPA is subject to the limitations set out in the Terms of Service. In the event of any conflict between this DPA and the Terms of Service in respect of Personal Data processing, this DPA prevails.

Where the SCCs are incorporated under Section 7 and conflict with any other term of this DPA or the Terms of Service, the SCCs prevail.