Data Processing Agreement
Effective 2026-10-29 · Related: Terms of use · Privacy policy · GDPR
This Data Processing Agreement (“DPA”) forms part of the agreement between ByteMantle (“ByteMantle”, the processor) and the organization that uses a ByteMantle console tenant (the “Customer”, the controller). It applies automatically when the Customer accepts the Terms of use for an organization tenant, and prevails over them on data protection. A countersigned copy is available on request at dpo@bytemantle.com.
1. Definitions
Terms such as personal data, processing, controller, processor, sub-processor, data subject and personal data breach have the meaning given in the GDPR. “Customer Data” means personal data that ByteMantle processes on behalf of the Customer through the console tenant and the connected browsers.
2. Subject matter and instructions
ByteMantle processes Customer Data only to provide the service described in the Terms and Annex 1, and only on the Customer’s documented instructions. The Customer’s configuration of the console (connected browsers, protections, history period, SIEM destinations, users and roles) and its written requests are its instructions. ByteMantle informs the Customer if, in its opinion, an instruction infringes data protection law.
3. Customer’s responsibilities
The Customer is responsible for the lawfulness of the processing it instructs, including informing its users (for example employees) that their browsers are protected and what is recorded, and for choosing the protections, history period and destinations that suit its purposes.
4. Confidentiality
ByteMantle ensures that everyone authorised to process Customer Data is bound by confidentiality and accesses it only as needed to provide, secure or support the service.
5. Security
ByteMantle implements the technical and organisational measures in Annex 2 and keeps them appropriate to the risk. Measures may evolve, but never to a lower overall level of protection.
6. Sub-processors
The Customer gives general authorisation for the sub-processors listed in Annex 3. ByteMantle announces a new or replaced sub-processor on its GDPR page and, for Customers who ask for it, by e-mail, at least 30 days in advance. The Customer may object on reasonable data protection grounds; if no solution is found, the Customer may end the affected service. ByteMantle imposes on each sub-processor obligations equivalent to this DPA and remains responsible for them.
7. Assistance to the Customer
Taking into account the nature of the processing, ByteMantle assists the Customer with data subject requests (the console lets the Customer find, export and delete events and devices itself), with data protection impact assessments and with prior consultations. Requests that data subjects send to ByteMantle about Customer Data are forwarded to the Customer without undue delay.
8. Personal data breaches
ByteMantle notifies the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Data, with the information available on its nature, the categories and approximate numbers concerned, likely consequences and the measures taken or proposed. It updates the Customer as more information becomes available.
9. International transfers
Customer Data is stored and processed in the European Union. ByteMantle does not transfer it outside the European Economic Area without the Customer’s prior written agreement and the safeguards of Chapter V GDPR.
10. Deletion and return
During the service the Customer can export its data (CSV export, read API where included in the plan) and delete it. Detection records are deleted automatically after the history period. At the end of the service ByteMantle deletes the Customer’s tenant and its data within 30 days, unless the Customer asks for an export first or the law requires longer storage. Backups are overwritten in their normal cycle.
11. Audits
ByteMantle makes available the information needed to demonstrate compliance with Art. 28 GDPR, answers reasonable written questionnaires, and allows audits by the Customer or an auditor it mandates, bound by confidentiality, on 30 days’ notice, at the Customer’s cost and without disrupting the service or exposing other customers’ data.
12. Liability and term
Liability follows the Terms of use. This DPA lasts as long as ByteMantle processes Customer Data. It is governed by the law of Romania.
Annex 1 — Details of the processing
| Nature and purpose | Detecting and blocking web threats in the Customer’s browsers; showing, correlating and reporting detections in the Customer’s console; forwarding them to destinations the Customer sets up; managing the Customer’s browsers, users and policies. |
|---|---|
| Data subjects | Users of the Customer’s protected browsers (typically employees and contractors); the Customer’s console users. |
| Categories of data | Installation and device identifiers, device names chosen by the Customer, browser and OS type and version; detection records (type, rule, risk, time, website address without query string or fragment, the names of the sites that led to it, the addresses of the scripts that loaded the harmful page, short evidence such as a harmful command); the latest IP address each browser connects from; website and smart-contract ratings; where the Customer turns them on (off by default): full website addresses with their query string, resource telemetry (the addresses of the resources the pages load, the IP addresses of the servers that answered, request status) and, on the Enterprise plan, site technology telemetry (the software, versions, cookie names and security headers the visited sites expose, and on which day each browser opened each site); console users’ username, name, e-mail address, role, sign-in times, two-step settings and audit log entries, with IP addresses in security logs. |
| Special categories | None intended. Customers should not configure the service to collect them. |
| Frequency | Continuous, while browsers are connected. |
| Duration and retention | For the term of the service. Detection records: the plan’s history period (30, 90 or 365 days) or a shorter period set by the Customer. Sign-in records: 12 months. |
Annex 2 — Technical and organisational measures
- Minimisation by design: detection runs in the browser; only short detection records are sent; addresses are cut before “?” and “#” unless the Customer turns on full addresses; credentials in addresses are removed; no browsing history, form contents, passwords or cookies are collected, except what the optional resource telemetry and site technology telemetry the Customer may turn on record (cookie names only, never their values).
- Encryption in transit: HTTPS for the console, the API and the website; HSTS on the production hosts.
- Authentication of browsers: each browser holds its own key pair; requests are signed and checked for freshness; licences, policies and detection rules are signed by ByteMantle and verified by the extension.
- Access control: separate tenants per organization; viewer, analyst and admin roles; two-step sign-in (it can be required for a whole organization); sign-in throttling and lockout; sessions with short idle time-outs; CSRF protection.
- Passwords and secrets: passwords stored only as salted hashes; one-time codes and links stored only as hashes and valid for a short time; API keys shown once and stored hashed.
- Logging and monitoring: audit log of console actions; vendor actions in a tamper-evident (hash-chained) log; rate limits and abuse signals on public endpoints.
- Application security: strict Content Security Policy and security headers; output encoding; parameterised database queries; regular security testing of the console and the extension.
- Availability: the extension keeps protecting when the console is unreachable and queues detections; hosting in a professional data centre with backups by the hosting provider.
- Organisation: least-privilege access to production; confidentiality obligations; incident response with Customer notification within 48 hours.
Annex 3 — Sub-processors
| Sub-processor | Service | Location of processing |
|---|---|---|
| Our hosting provider, data centre in the European Union | Data-centre hosting of the console, the API and e-mail | European Union |