Data Processing Agreement

"Personal Data" means information relating to an identified or identifiable person that WipeCert processes on Customer's behalf in providing the service. "Data Protection Law" means the laws that apply to that processing, including, where applicable, Regulation (EU) 2016/679 (GDPR), the UK GDPR, and US state privacy laws such as the Texas Data Privacy and Security Act and the California Consumer Privacy Act. "Controller", "Processor", "Service Provider", "Subprocessor", "Data Subject" and "Personal Data Breach" have the meanings in those laws.

Customer is the Controller (or Business) and WipeCert is the Processor (or Service Provider) for Personal Data in Customer's organization account. WipeCert is an independent controller for its own account administration, billing, security logs and legal obligations, as the Privacy Policy describes. Payment card data is processed by Stripe, which acts as an independent controller for that data.

WipeCert processes Personal Data only to provide the service under the Agreement, on Customer's documented instructions. The Agreement, Customer's configuration of the service and its use of the API are Customer's instructions. WipeCert tells Customer if it believes an instruction breaks Data Protection Law. Where Data Protection Law requires it, WipeCert will not sell or share Customer Personal Data, will not use it outside the direct business relationship, and will not combine it with other data except as the law permits.

Access to Personal Data is limited to authorized personnel and systems that need it for their role in running and supporting the service, bound by confidentiality duties.

WipeCert keeps technical and organizational measures appropriate to the risk, including those in Annex 2. The trust center is the public statement of them. WipeCert does not hold SOC 2, ISO 27001 or any certification and does not claim one.

Customer gives general authorization for the subprocessors on the current list, available on request. WipeCert binds each one by written terms that give substantially the same protections as this DPA. WipeCert remains responsible for its subprocessors' performance of these duties.

WipeCert is operated from the United States and hosts in the United States. For Personal Data of persons in the European Economic Area, the UK or Switzerland that is transferred to WipeCert in the United States, the parties agree the Standard Contractual Clauses (EU Commission Decision 2021/914), Module Two (controller to processor), apply and are incorporated, with: Clause 7 docking omitted; Clause 9 option 2 general authorization, as section 6 sets out; Clause 11 optional redress omitted; Clause 17 law of Ireland; Clause 18 courts of Ireland; Annex I as Annex 1 here; Annex II as Annex 2 here; Annex III as the subprocessor list. For UK transfers the UK Addendum applies. WipeCert is not certified under the EU-US Data Privacy Framework and does not claim it.

WipeCert gives Customer the tools to export and delete Personal Data in the account. If a Data Subject writes to WipeCert about Customer's data, WipeCert refers them to Customer and does not answer on the merits unless required. WipeCert helps Customer respond within the time the law allows, at no extra charge for ordinary requests.

WipeCert notifies Customer without undue delay, after becoming aware of a Personal Data Breach affecting Customer's Personal Data. The notice states what is known: nature, categories and approximate numbers affected, likely consequences, measures taken or proposed, and a contact. Notice is by email to the security contact Customer names in Annex 1. WipeCert helps Customer meet its own regulator and Data Subject notice duties.

On Customer's reasonable written request, once a year, WipeCert gives Customer the information needed to show compliance with this DPA, including its security answers and subprocessor list. If that is not enough, Customer may audit, remotely first, on 30 days' notice, in business hours, under confidentiality, at its own cost, and without access to other customers' data.

The Terms give Customer 30 days after termination to export data, after which it may be deleted. The Privacy Policy says personal data is deleted within 90 days of account closure, except where law requires retention or where certificate records must be kept. Customer may instead ask for earlier deletion in writing.

Erasure certificates are permanent compliance records. They contain device serial numbers, wipe results and operator identity. After termination they are retained as records unless Customer asks in writing for their deletion.

Each party's liability under this DPA is subject to the limits in the Agreement.

This DPA lasts as long as WipeCert processes Personal Data for Customer. If it conflicts with the Enterprise Plan Terms or the Terms of Service on data protection, this DPA wins. The Agreement is governed by the laws of the State of Texas, United States with venue in the state or federal courts located in Harris County, Texas, except the Standard Contractual Clauses follow their own clause 17.

Customer accepts this DPA at Stripe Checkout by choosing "I agree" in the required Terms acceptance field, which covers the WipeCert Terms of Service, the Enterprise Plan Terms and this DPA. Stripe records the choice with the payment. WipeCert's acceptance is the offer of the service on these terms.

• Encryption in transit and at rest, including backups.
• Per-organization separation of records, enforced by database access rules.
• Passwords stored only as one-way hashes. API keys stored hashed and shown once.
• Authenticator-app MFA required to reach the dashboard. Optional Microsoft sign-in.
• Role based access within each organization.
• Rate limiting on wipe creation, device check-in and public verification.
• Certificates signed with Ed25519 so they are tamper-evident, with key rotation that keeps old certificates verifiable.
• Intune connection secrets encrypted at rest.
• Audit log of sign-in blocks and administrative actions.
• Vulnerability disclosure at security@wipecert.com.
• Access to production systems is limited to authorized personnel who need it for their role.
• Not claimed: SOC 2, ISO 27001, penetration test attestation, 24 hour staffed monitoring, SCIM.