Guard data processing addendum
Customer-data processing instructions, security, subprocessors, assistance, breaches, audits, transfers, and return or deletion for Guard.
Last revised: October 23, 2026
This Data Processing Addendum ("DPA") is entered into between Solarius B.V. ("Solarius") and the customer identified in the accepted Guard agreement ("Customer"). It is incorporated into that agreement ("Agreement") and governs Solarius's processing of personal data on Customer's behalf. Each is a "Party" and together they are the "Parties." This DPA takes effect through the Agreement's applicable acceptance mechanism; access to this page alone does not constitute execution or acceptance.
Roles, scope, and precedence
Customer acts as controller and Solarius as processor, or Customer acts as processor and appoints Solarius as its authorized subprocessor, according to the actual processing relationship. Customer represents that it is authorized to issue the documented instructions and make the appointments required for that relationship. The rights and obligations of an upstream controller remain subject to applicable law and Customer's authority to act for it.
"Applicable Data Protection Law" means the laws binding on the relevant Party in respect of the covered processing, including Regulation (EU) 2016/679 ("GDPR") and applicable UK, Swiss, or US state data-protection requirements to the extent they apply. "Personal Data" means personal data processed by Solarius on Customer's behalf under the Agreement. "Subprocessor" means another processor appointed by Solarius to perform part of that processing. "Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data. A blocked attempt or ordinary product detection without such a breach does not, by itself, constitute a Personal Data Breach. "Services" and "Order" carry their meanings under the Agreement. Other data-protection terms carry their meanings under Applicable Data Protection Law.
This DPA covers threat intelligence, traffic protection, vulnerability assessment, endpoint controls, secure access, and managed security operations. Annex 1 specifies the processing. The Privacy Policy separately describes Solarius's controller activities. Solarius shall not reclassify customer content as Solarius's own controller data merely to avoid this DPA.
Applicable mandatory transfer clauses prevail over this DPA where required. This DPA prevails over conflicting agreement terms concerning personal-data processing. Commercial liability terms apply only to the extent consistent with mandatory law, data-subject rights, and binding transfer clauses. Neither a liability cap nor an audit restriction limits a supervisory authority's lawful powers.
Documented instructions and purpose limitation
Solarius shall process Personal Data solely on Customer's documented instructions for delivery of the contracted Services. Those instructions consist of the accepted Order, this DPA and its annexes, Customer-selected settings, authorized requests, and approved integrations, within the Agreement's scope. A further instruction shall be recorded in a form that identifies its authorizing person, purpose, and affected processing. Solarius shall not sell Personal Data, share it for cross-context behavioral advertising, combine it with unrelated datasets for independent profiling, or use it to train general-purpose AI models. Security processing must remain necessary to protect the contracted service and consistent with applicable law and these instructions.
If Union or Member State law binding on Solarius requires processing outside the instructions, Solarius informs the customer before processing unless that law prohibits notice on important public-interest grounds. Other government demands are assessed under the transfer and legal-request safeguards in this DPA and do not create a general exception to your instructions. If Solarius reasonably believes an instruction infringes applicable data-protection law, Solarius promptly informs the customer and pauses only the affected processing while the parties resolve it. Solarius does not expand an instruction merely because the product can technically collect more information.
The customer determines a lawful basis, gives required notices, secures relevant permissions, chooses proportionate settings and retention, and answers controller requests. It must not knowingly direct unlawful processing or submit intentionally unsupported sensitive datasets. Solarius remains responsible for Solarius's own processor duties; the customer's responsibilities do not excuse Solarius's unauthorized processing or inadequate safeguards.
Confidentiality and security
Solarius shall ensure that every person it authorizes to process Personal Data is subject to an enforceable confidentiality obligation or equivalent statutory duty, receives training appropriate to that role, and has access limited to what is necessary for the assigned purpose. Access grants and revocations follow an accountable process. Customer configurations do not give all support staff unrestricted access. Support and operational workflows must respect the product's documented permissions and customer-data boundaries.
Solarius shall implement and maintain technical and organizational measures appropriate to the nature, scope, context, purposes, and risks of the processing, taking account of the state of the art and implementation costs, as required by applicable law, including Article 32 GDPR when applicable. Annex 2 forms part of this DPA and states the minimum control commitments and deployment allocation. Solarius shall periodically assess the effectiveness of those measures. Material changes must preserve the overall contracted level of protection and must not defeat an agreed security control without review and an appropriate alternative.
You are responsible for safeguards you operate, including authorized users, customer keys, devices, independent backups, and self-hosted infrastructure. Solarius remains responsible for the components and processing Solarius operates, including any edge or hosted service enabled alongside a self-hosted installation.
Subprocessors
Subprocessor register
Before covered processing, Solarius supplies the applicable register with the order or through dpo@solarius.me, without requiring premium support. It identifies the actual appointed legal entity, delegated function, data categories, storage and processing locations, remote-access countries, required transfer safeguards, and effective date. The register and accepted deployment schedule identify enabled hosted or connected processing alongside a self-hosted installation; no universal provider list or location follows merely from a feature name.
Appointment and changes
Customer grants general written authorization solely for the Subprocessors identified in the applicable service register supplied to Customer, subject to the notice and objection procedure below. That authorization does not extend to an undisclosed processing function or transfer route. Before appointment, Solarius shall assess the proposed Subprocessor's relevant safeguards and bind it by a written contract imposing the same data-protection obligations applicable to the delegated processing under this DPA, including sufficient guarantees for appropriate technical and organizational measures. Solarius shall remain fully responsible to Customer for the Subprocessor's performance of those obligations. Relevant contractual information shall be made available subject to lawful redaction of confidential commercial terms.
Solarius gives at least 30 days' advance notice of an intended new or replacement subprocessor that will process your covered data, identifying its legal entity, function, locations, and transfer basis. You can object within that period on reasonable, documented data-protection grounds. Solarius discusses a practicable alternative, such as different routing or disabling the affected optional function. If none resolves the objection, either party can terminate the affected service before the change takes effect; Solarius refunds prepaid unused affected subscription fees. Unaffected services continue.
An urgent security or legal replacement can require shorter notice. Solarius explains the necessity promptly, gives as much advance notice as practicable, and preserves the objection and affected-service remedy. A provider engaged solely by you is not Solarius's subprocessor for your direct relationship with it; any separate role it performs for Solarius is assessed independently. The register identifies the actual providers and notice contact; restricted transfers require their own completed safeguards.
Assistance and individual rights
Taking account of the processing and information available to Solarius, Solarius provides appropriate technical and organizational assistance for access, correction, erasure, restriction, portability, objection, and other applicable individual rights. Solarius forwards a request concerning your controlled data without undue delay and does not respond substantively except on your instruction or as law requires. Solarius can acknowledge receipt and identify the responsible contact without disclosing customer records.
Solarius assists with security obligations, breach assessment and notifications, data-protection impact assessments, and required supervisory consultations. Solarius provides relevant information about Solarius's processing and safeguards, not unrelated tenant data. Ordinary self-service assistance and information required to demonstrate Solarius's compliance are included. Exceptional bespoke work can be priced only by advance agreement; a price disagreement does not excuse time-critical statutory cooperation or work required because of Solarius's own breach.
Personal-data breaches
Solarius shall notify Customer's designated incident contact without undue delay after becoming aware of a Personal Data Breach affecting covered Personal Data. The initial notification is permitted to be preliminary and shall not be deferred pending a complete investigation. To the extent available, it shall describe the nature of the breach, the categories and approximate numbers of affected individuals and records, likely consequences, measures taken or proposed to address and mitigate the breach, and a contact for further information. Solarius shall supply unavailable details in phases and provide material updates without undue delay.
Solarius takes reasonable containment, preservation, investigation, and remediation steps, and cooperates with your lawful notification duties. You ordinarily decide controller notifications to authorities and individuals. Solarius does not notify them in your name without authorization unless legally required. Your regulatory deadline is separate from Solarius's processor duty to notify you without undue delay. A notification is not an admission of liability, but does not limit accountability for the underlying event.
Information, audits, and inspections
Solarius shall make available all information necessary to demonstrate compliance with its obligations under this DPA and applicable processor requirements, including Article 28 GDPR when applicable. Solarius shall allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer. Solarius first offers relevant current assurance materials and answers where they can meet the purpose, without making their acceptance a condition of your statutory audit rights. Solarius does not claim certifications or audit reports Solarius does not hold.
Routine audits use reasonable advance notice, confidentiality, a defined scope, and safeguards against disclosure of another customer's data or disruption of the service. An auditor must not use access for competitive intelligence or unauthorized testing. Solarius normally coordinates routine inspections during business hours, but suspected material noncompliance, a relevant breach, or a regulator's request can require urgent or additional access. Routine coordination cannot be used to prevent an effective audit.
Each party ordinarily pays its own audit costs; unusual third-party service work needs advance agreement. Solarius bears reasonable remediation-related audit costs to the extent the audit establishes Solarius's material DPA breach. Solarius promptly addresses substantiated deficiencies and provides an accountable remediation response. Regulatory access and mandatory rights remain unaffected by a commercial audit arrangement.
Restricted transfers and government requests
Solarius shall not transfer Personal Data to a third country or international organization, or permit access constituting a restricted transfer, unless a valid mechanism under Applicable Data Protection Law and any necessary supplementary measures are in place for that route. The deployment and transfer schedule must identify exporter and importer, their roles, destinations, categories, access locations, onward recipients, and retention. A selected resource region does not cover every remote access or support route.
Where appropriate EU transfer clauses are needed, the parties complete and execute the applicable modules, annexes, competent authority, law, and forum before the restricted processing. Required UK or Swiss adaptations must also be completed for the relevant route. Referencing a link to clauses is not completion, and this DPA does not declare every global transfer lawful. If safeguards fail, Solarius works promptly to restore lawful protection or suspend the affected transfer; if that cannot be resolved, the customer can end the affected service with prepaid unused affected fees refunded.
Solarius assesses binding authority and scope before a government disclosure, challenges disproportionate or unlawful demands where reasonably available, discloses the minimum required, and notifies you unless prohibited. Preservation and disclosure are separate. Solarius does not provide governments standing access to customer systems. See government-request handling.
Return, deletion, and end of processing
Upon cessation of the relevant processing Services, Solarius shall, at Customer's choice, return Personal Data in the available documented formats or delete it, and shall delete remaining copies unless applicable binding law requires retention. Customer is entitled to instruct earlier deletion within its lawful authority. The product-specific retention and deletion policy defines export windows, recovery records, backups, holds, and verification; it is incorporated into these instructions.
Where immediate removal from a protected backup is not feasible, remaining data is isolated from ordinary use, retained only until the documented backup expiry, and protected under this DPA. A recovery must reapply outstanding deletion instructions before resumed ordinary use. Lawfully retained information remains limited to that purpose, with access restricted and the obligation reviewed. On request Solarius confirms completion and identifies lawful exceptions without implying impossible instantaneous erasure from every medium.
A personal-data rights request and an instruction to delete the organization's business dataset have different authorities. Solarius verifies that authority and escalates conflicts rather than letting an unrelated requester destroy customer records. Processing and confidentiality obligations survive for any covered data still held.
US service-provider terms and changes
To the extent California service-provider or contractor rules or equivalent state processor rules apply, Solarius processes covered information only for the specified business purposes and direct relationship described here. Solarius does not sell or share it, retain or disclose it outside those purposes, or combine it with information from other customers or Solarius's independent interactions except as applicable law expressly permits for the contracted purpose. Solarius certifies that it understands and complies with those restrictions.
You can take reasonable steps to verify compliant use, require information and assessments permitted by law, and require Solarius to stop and remediate unauthorized processing. Solarius notifies you if it can no longer meet the applicable obligations. Subcontracting imposes the corresponding required restrictions and oversight. This section adds protections rather than reducing an applicable state's requirements.
No amendment to this DPA shall be effective except through the Agreement's valid amendment process. An amendment shall not retrospectively authorize incompatible processing, waive an accrued data-subject right, or derogate from a binding transfer safeguard. A change necessary to comply with binding law is limited to that purpose and communicated promptly. Materially reduced protection or a new independent purpose requires an appropriate new agreement and lawful basis before processing.
Annex 1 — Processing particulars
The contracted processing has the following scope:
| Item | Contracted particulars |
|---|---|
| Subject matter | Delivery of the purchased Guard capabilities and their authorized support and security operations |
| Duration | Service term plus the documented return/deletion process and any narrowly justified lawful retention |
| Nature and purpose | Traffic inspection, threat detection, authorized scanning, endpoint enforcement, triage, evidence preservation, access decisions, incident response, and approved reporting |
| Data subjects | Customer administrators and responders, employees and contractors, endpoint users, service visitors, account holders, and people identified in security events or submitted evidence |
| Personal-data categories | Asset and endpoint inventory, device and user identifiers, process and network events, protected traffic, scan credentials, vulnerability findings, detections, incident records, response approvals, quarantined artifacts, evidence, and reports |
| Frequency | Continuous or scheduled processing for enabled functions; event-driven support, exports, and response actions |
| Sensitive information | Only incidentally necessary evidence or an expressly agreed supported processing scope, with restricted access and appropriate safeguards; no blanket authorization for bulk special-category collection |
| Instructions and rights | Customer's lawful purpose and documented controls; access, assistance, objection, audit, export, and deletion rights in this DPA |
| Deployment particulars | Accepted order, enabled integrations, effective retention settings, supplied subprocessor register, and any required completed transfer schedule |
The customer selects actual targets, data categories, and enabled capabilities. Materially different data or processing requires review of this annex and safeguards before use. Self-hosted data not transmitted to or remotely processed by Solarius does not become Solarius's hosted dataset merely because the software was supplied by Solarius.
Annex 2 — Technical and organizational measures
The following minimum commitments allocate controls between Solarius and the customer:
| Control area | Minimum commitment and allocation |
|---|---|
| Governance and confidentiality | Named responsibility, confidentiality obligations, security training, risk assessment, and documented handling procedures |
| Identity and access | Role-scoped access, protection of privileged accounts, controlled credential lifecycle, and timely revocation for systems Solarius operates |
| Tenant and deployment separation | Authorization checks at service and resource boundaries; no cross-customer access merely through a common hosting platform |
| Transmission and storage | Protected service transport, risk-appropriate encryption at rest for managed sensitive data, controlled keys and secrets, and documented key responsibilities |
| Monitoring and accountability | Security and administrative logging, proportionate investigation, restricted audit access, and retention appropriate to the recorded purpose |
| Change and vulnerability management | Reviewed changes, maintenance of operated components, vulnerability handling, and updates proportionate to severity |
| Availability and recovery | Documented recovery procedures, backup controls for agreed managed scope, and appropriate testing; customer workload recovery remains subject to its purchased scope |
| Data lifecycle | Separate retention classes, authorized export and deletion, lawful hold review, and reapplication of deletion after backup recovery |
| Assurance and incident response | Periodic control assessment, breach escalation and investigation, supplier oversight, and evidence for lawful customer review |
| Customer-operated components | Customer maintains self-hosted hosts, databases, storage, workers, endpoint permissions, keys it controls, independent backups, and connected provider settings |
Deployment-specific evidence and any stronger purchased control belong in the accepted security schedule. This annex is a contractual allocation, not a claim of universal certification, end-to-end encryption, or a recovery objective absent from the order.