Data processing addendum

Draft. Lawpatch is in development and has no operating entity behind it yet, so the operator’s name and address below are placeholders and these terms are not in force. They are published so you can read what we intend to commit to, and they will be reviewed by counsel before they bind anyone.

This addendum forms part of the terms of service and applies whenever we process personal data on your behalf. You are the controller; [legal entity name] is the processor.

1. Subject matter and duration

We analyse the signals your deployment of the Lawpatch SDK sends us and store the resulting report for as long as your workspace exists. Deleting a project or the workspace removes it immediately (section 9).

2. Nature and purpose

Scanning, analysis against a precedent corpus and report generation.

3. Categories of data subject and data

Your personnel: the people who sign into your workspace (e-mail, display name, account identifier).
Derived signals: rule identifiers, repository-relative file paths, line numbers, route and entity names, dependency names and versions, and — only if you switch on snippet sharing — one masked line of code per signal. These are normally about software, not people; a path or a variable name can nonetheless incidentally contain a person’s name, which is why they are treated as personal data here.
Text your personnel choose to enter: the project description, answers to the questions the analysis asks, triage notes on findings, and precedent search queries.

4. Your instructions

We process only on your documented instructions, which are these terms plus the settings in your workspace. If we think an instruction breaches data protection law we will tell you before acting on it.

5. Confidentiality and security

Everyone with access is bound by confidentiality. Our technical measures are described in the security model: data in transit is encrypted, API keys are stored only as SHA-256 hashes and are scoped to one project, workspace isolation is enforced by database rules rather than only by application code, the full set of scan signals is held in memory for the duration of the analysis and only the evidence a finding cites is stored with it, and requests to the model provider are sent with response storage switched off. The provider may still keep requests for a limited period to monitor abuse; the sub-processor list states for how long.

6. Sub-processors

You give general authorisation for the sub-processors listed here. We will announce a new one on that page at least 30 days before it starts processing, and you may object on reasonable data protection grounds — if we cannot resolve it, you may terminate the affected service.

7. Assistance

We help you respond to data subject requests, and with data protection impact assessments and prior consultations, taking into account the nature of the processing and the information available to us. Most requests you can satisfy yourself from the dashboard.

8. Breach notification

We notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting your data, with the information you need for your own 72-hour notification.

9. Deletion and return

Delete a project or a workspace and the associated scans, findings, processing model, API keys, pairing codes and outstanding invitations are removed immediately. The JSON export is a button on the project, not a request you have to make of us.

10. Audit

We make available the information needed to demonstrate compliance and will answer a reasonable security questionnaire once a year. On-site audits are available to customers with a negotiated agreement.

11. International transfers

Where a sub-processor is outside the EEA, the UK or Türkiye, transfers are made under the EU Standard Contractual Clauses (Module Two or Three as applicable) with the UK International Data Transfer Addendum, and, for personal data covered by KVKK, under the standard contracts published by the Personal Data Protection Board under Art. 9 as amended by Law No. 7499, notified to the Authority within five business days of signature. Those clauses are incorporated into this addendum by reference.

12. Our own use

We do not use your data for our own purposes. The one exception is anonymised statistics that cannot be linked back to you, a repository or a person — for example how often a detection rule fires — which we use to improve detection. Nothing identifiable is used to train models.

Need this signed on your paper, or with a named contact and jurisdiction filled in? Write to [email protected].