legal

Data Processing Agreement

Last updated: 2026-07-17. Governing law: Israel.

Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the Terms of Service (/legal/terms) between the customer ("Controller", "you") and EyalSec, of Yehoshua Stampfer 39, Petah Tikva, Israel ("Processor", "EyalSec"), and applies where EyalSec processes personal data on the Controller's behalf in providing the EyalSec / es2 Service (the "Service"). It is intended to satisfy Article 28 of the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR.

Terms such as "personal data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given in the GDPR.

1. Subject-matter

The subject-matter of the processing is the provision of the Service: the ingestion, storage, and display of security events ("Events") that the Controller's deployment of es-python sends to EyalSec, together with related account operations. Event Payloads (the fields where, repr, trace, location, origin) can contain personal data and secrets drawn from the Controller's process memory.

2. Duration

Processing continues for the term of the Controller's Subscription and until all personal data is deleted or returned in accordance with Section 9. The obligations herein survive for as long as EyalSec processes personal data on the Controller's behalf.

3. Nature and purpose of processing

EyalSec processes personal data only to provide, maintain, secure, and support the Service on the Controller's documented instructions, i.e., to receive Events via the agent API, store them, aggregate and de-duplicate them, apply the Controller's filters, and make them available in the dashboard and via the API. EyalSec does not process the personal data for its own purposes.

4. Types of personal data and categories of data subjects

The Controller is responsible for ensuring it has a lawful basis and authorization for the data it routes through es-python, and for minimizing unnecessary sensitive data.

5. Controller instructions

EyalSec processes personal data only on the Controller's documented instructions, including with regard to transfers, unless required by EU/Member State or other applicable law (in which case EyalSec will inform the Controller of that legal requirement before processing, unless the law prohibits it on important grounds of public interest). The Terms, this DPA, and the Controller's use of the Service's configuration constitute the Controller's complete documented instructions. EyalSec will inform the Controller if, in its opinion, an instruction infringes the GDPR or other applicable data-protection law.

6. Processor obligations

EyalSec shall:

(a) Documented instructions: process personal data only as set out in Section 5.

(b) Confidentiality: ensure persons authorized to process the personal data are bound by confidentiality obligations.

(c) Security (Art. 32): implement appropriate technical and organizational measures appropriate to the risk, including encryption in transit (TLS) and at rest, access controls, hashed credentials, secrets management, IP access control, logging, and least-privilege practices; and a process for regularly testing and assessing effectiveness.

(d) Sub-processors: see Section 7.

(e) Data-subject requests: taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures, insofar as possible, to respond to requests to exercise data-subject rights under GDPR Chapter III. Where a data subject contacts EyalSec directly about Controller data, EyalSec will refer them to the Controller.

(f) Assistance with Arts 32–36: assist the Controller in ensuring compliance with the obligations on security (Art. 32), personal data breach notification (Arts 33–34; EyalSec will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data), data protection impact assessments (Art. 35), and prior consultation (Art. 36), taking into account the nature of processing and the information available to EyalSec.

(g) Deletion or return: at the Controller's choice, delete or return all personal data after the end of the provision of services, and delete existing copies unless EU/Member State or other applicable law requires storage (Section 9).

(h) Audits and information: make available to the Controller all information necessary to demonstrate compliance with Art. 28 and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates, on reasonable prior notice, during business hours, subject to confidentiality and EyalSec's security policies, and not more than once per year except where required by a supervisory authority or following a breach. EyalSec may satisfy audit obligations by providing relevant certifications or third-party reports where available.

7. Sub-processors

The Controller provides a general authorization for EyalSec to engage sub-processors. EyalSec's current sub-processors are listed at /legal/subprocessors. EyalSec will:

(a) impose data-protection obligations on each sub-processor that are substantially the same as those in this DPA, in particular providing sufficient guarantees under Art. 28(4);

(b) remain liable to the Controller for the performance of each sub-processor's obligations; and

(c) give the Controller reasonable prior notice of any intended addition or replacement of a sub-processor, giving the Controller the opportunity to object on reasonable data-protection grounds. If the parties cannot resolve a reasonable objection, the Controller may terminate the affected Service.

8. International transfers / SCCs

Where the processing involves transfer of personal data out of the EEA or the UK to a country without an adequacy decision, the parties incorporate by reference the European Commission's Standard Contractual Clauses (Module Two: Controller-to-Processor) adopted under Commission Implementing Decision (EU) 2021/914, and, for UK transfers, the UK International Data Transfer Addendum issued by the ICO. The Controller is the data exporter and EyalSec the data importer; the descriptions in Sections 1–4 and Annex details populate the SCC annexes; and the SCCs prevail over conflicting terms of this DPA to the extent of the conflict. The Service is hosted by EyalSec in the il-central-1 (Israel) AWS region. Israel benefits from an EU adequacy decision.

9. Deletion or return

On termination or expiry of the Service, or earlier on the Controller's written request, EyalSec will, at the Controller's election, delete or return the Controller's personal data and delete existing copies, unless retention is required by applicable law. The Controller's self-serve account deletion in Settings cascade-deletes the Controller's machines, Events, and filters. Backups are purged on EyalSec's standard rotation cycle.

10. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms (including the liability cap and its carve-outs), to the maximum extent permitted by applicable law. Nothing in this DPA limits a data subject's rights under the GDPR or the SCCs, or either party's liability that cannot be excluded by law.

11. Order of precedence

In case of conflict: the SCCs prevail over this DPA; this DPA prevails over the rest of the Terms with respect to processing of personal data on the Controller's behalf.

Signature blocks

Controller (Customer)

Processor (EyalSec)

EyalSec Pricing Docs Security Login Start free
TermsPrivacyDPAAcceptable UseLicensesRefund Python is a trademark of the Python Software Foundation. EyalSec is not affiliated with or endorsed by the PSF.