Data Processing Addendum (DPA)

Roles

For personal data you submit to Keelix Cloud, you are the data controller and Keelix acts as a data processor. We process such data only to provide the service and per your documented instructions.

Subject matter & duration

We process account, organization, host, and scan-finding data for the duration of your subscription, subject to the retention windows described in the Privacy Policy, after which data is pruned or erased.

Authorized subprocessors

You authorize the following subprocessors:

• Supabase — Database, authentication, and storage for the hosted dashboard.
• Vercel — Application hosting, edge network, and serverless functions.
• Stripe — Payment processing and subscription billing.
• Resend — Transactional and alert email delivery.
• WorkOS — Enterprise SSO/SCIM (only when an org enables SSO — private preview).
• Anthropic — AI explanation/remediation enrichment (only when AI enrichment is enabled).

We will give notice before adding a new subprocessor so you can object.

Security measures

We maintain access controls, row-level tenant isolation, hashed API-key storage, encryption in transit, and an audit trail of account actions.

Data-subject requests & deletion

We assist you in responding to data-subject requests via the in-product export and erasure controls. On termination, data is hard-erased 30 days after organization deletion.

Requesting a signed DPA

Need a counter-signed DPA for procurement? Email info@keelix.dev.