Our GDPR Article 28 obligations, the security measures we apply, and the sub-processors we use.
This Data Processing Addendum (the "DPA") forms part of, and is governed by, the Terms of Service or Order Form between the Customer (the "Controller") and Trust Helm LLC (the "Processor") for use of Kanonik (the "Service").
The Processor will Process Personal Data on behalf of the Controller in connection with the Service, in accordance with this DPA. Capitalised terms not defined here have the meaning given in the Terms of Service or in Regulation (EU) 2016/679 (the "GDPR") and its UK equivalent (the "UK GDPR").
This DPA applies for the duration of the Customer's Subscription. On termination, the Processor will return or delete Personal Data in accordance with Section 12.
The Processor will Process Personal Data only as necessary to provide the Service and to comply with the Controller's documented instructions, including (a) running the MCP server and tools, (b) executing the server-side Verifier, (c) producing and storing audit-log events, (d) generating Auditor Export bundles, and (e) reading and writing to the Controller's GRC tool on the Controller's authority.
The Controller's acceptance of the Terms of Service, the configurations the Controller makes in the Service, and any subsequent written instructions from the Controller constitute its documented instructions to the Processor.
Categories of personal data: as described in Annex I. In summary: (a) account data of the Controller's authorised users (name, work email, role, OIDC subject identifier); (b) the canonical representation of the Controller's GRC entities (controls, evidence, mappings) which may incidentally contain the names of the Controller's personnel; (c) audit-log content describing operations on (a) and (b); (d) approval-token references and approver identities.
Categories of data subjects: the Controller's employees, contractors, and authorised users; the Controller's customers, suppliers, and third parties to the extent they appear in Customer Data.
The Service is not designed to process special categories of personal data within the meaning of GDPR Article 9. The Controller agrees not to submit special-category data unless strictly necessary; if it does, additional measures may apply by separate agreement.
The Processor will:
The Controller provides general written authorisation for the Processor to engage the sub-processors listed in Annex III.
The Processor will inform the Controller of any intended addition or replacement of sub-processors at least thirty (30) days before the change takes effect, by updating Annex III at this URL and notifying registered Customers by email.
The Controller may object to a new sub-processor on reasonable grounds within fifteen (15) days of notification by emailing [email protected]. If the Controller objects, the parties will work together in good faith to resolve the objection. If no resolution is reached, the Controller may terminate the affected Subscription with a pro-rata refund of pre-paid fees.
The Processor remains fully liable to the Controller for the performance of its sub-processors' obligations.
Where the Processor transfers Personal Data of EU / EEA / UK / Swiss data subjects outside the EEA / UK / Switzerland to a country not covered by an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (Decision 2021/914), Module 2 (Controller to Processor) or Module 3 (Processor to Sub-Processor) as applicable, are incorporated into this DPA by reference. The UK International Data Transfer Addendum (or its replacement) is incorporated for transfers from the UK.
Where the SCCs require party choices, the parties agree:
The Processor has assessed transfer impact and applies supplementary technical measures (encryption in transit and at rest, key isolation, pseudonymisation where feasible) consistent with European Data Protection Board recommendations.
The Processor implements and maintains the technical and organisational measures set out in Annex II, designed to ensure a level of security appropriate to the risk of processing.
The Processor's architecture is designed to be compatible with FedRAMP Moderate baseline expectations from day one (FIPS 140-validated cryptography, mTLS internal services, append-only audit log, signed events, infrastructure-as-code with GitOps, signed container images and SBOM per build, supply-chain vulnerability scanning in CI). Authorisation pursuit is on the Processor's longer-term roadmap and not represented as obtained.
The Processor will, taking into account the nature of processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller's obligation to respond to requests for exercising the data subject's rights under Chapter III GDPR (rights of access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making).
Where data subjects contact the Processor directly, the Processor will, without undue delay, refer them to the Controller and inform the Controller of the request.
The Processor offers the following self-service mechanisms accessible to the Controller:
The Processor will notify the Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting the Controller's Personal Data. The notification will include, to the extent then known:
The Processor will continue to update the Controller as additional information becomes available and will cooperate with any necessary investigation, regulatory reporting, or notification to data subjects.
The Processor will make available to the Controller, on request, the most recent third-party audit reports (e.g., SOC 2 Type II reports when obtained) and a written summary of its security and privacy practices.
The Controller may, no more than once per twelve-month period (or more frequently where required by a competent supervisory authority or following a Personal Data Breach), conduct an audit of the Processor's compliance with this DPA. Audits will be conducted at the Controller's expense, on at least thirty (30) days' written notice, during normal business hours, in a manner that does not unreasonably disrupt the Processor's business or compromise the confidentiality of other customers' data, and subject to a written confidentiality agreement.
The Processor may satisfy audit requirements by providing the Controller with the audit reports referenced above.
On termination of the Subscription, the Processor will, at the Controller's choice and within the timelines below:
The Processor will provide written confirmation of crypto-erase on request.
The liability of each party under this DPA is subject to the limitations set out in the Terms of Service. In the event of any conflict between this DPA and the Terms of Service in respect of Personal Data processing, this DPA prevails.
Where the SCCs are incorporated under Section 7 and conflict with any other term of this DPA or the Terms of Service, the SCCs prevail.
Data exporter (Controller): the Customer entity that has accepted these terms.
Data importer (Processor): Trust Helm LLC, organised under the laws of the State of Wyoming, United States of America. Contact: [email protected].
For Customers established in the EU or with EU data subjects, the supervisory authority is determined under GDPR Article 56. As the Processor is established in the United States, EU/UK data subjects may lodge complaints with their local supervisory authority.
The Processor implements and maintains the following measures, derived from its product Architecture Decision Records and updated as the architecture evolves:
This list is current as of the "Last updated" date at the top of this page. The Processor will update this list and notify registered Customers in accordance with Section 6 of the DPA.
| Sub-processor | Purpose | Data categories | Location of processing |
|---|---|---|---|
| Amazon Web Services, Inc. | Compute, storage, networking, object storage for the Service | All Service data, encrypted at rest and in transit | United States (us-east-1, us-west-2) |
| Anthropic, PBC | Server-side Verifier LLM calls (rule-based plus LLM cross-check before commit) | Canonical entity excerpts and retrieved candidates; PII redacted at ingress | United States (Anthropic data-handling terms apply) |
| Lemon Squeezy, LLC | Merchant of Record - subscription billing, global tax calculation and remittance, chargeback handling | Billing contact, company name, billing address, payment method | United States |
| Postmark (Wildbit, LLC) | Transactional and approval-link email delivery | Recipient email and approval-token references; no GRC content | United States |
| Slack Technologies, LLC (optional, per-tenant opt-in) | Approval-channel notifications | Approval-token references; no GRC content | United States |
| Self-hosted SigNoz on AWS | Operational logs, traces, metrics | Service performance data; PII redacted at ingestion | United States (us-east-1) |
| The Customer's own GRC tool (e.g., Eramba, Vanta, Drata, Hyperproof) | Read and draft-write to the Customer's GRC tool, on the Customer's authority and using credentials the Customer provides | Whatever the Customer has stored in that tool, accessed via Customer-provided credentials | Wherever the Customer hosts that tool |
Sub-processors planned for future Service phases (introduction will trigger Section 6 notification): Cloud HSM (AWS CloudHSM, Azure Dedicated HSM, or GCP Cloud HSM) for hardware-rooted key isolation in Enterprise tier; Bedrock Claude API (AWS) for Customers requiring GovCloud-bound model access.