Data Processing Agreement

Parties#

This Data Processing Agreement ("DPA") is entered into between:

• Processor: LIMITLESS KNOWLEDGE, a French simplified joint-stock company with a single shareholder (SASU) with a share capital of 500 euros, registered office at 10 Place de Wicklow, 78180 Montigny-le-Bretonneux, France, registered with the Versailles Trade and Companies Register under number 994 833 143 (SIRET 994 833 143 00013, VAT FR46994833143), owner of the Narvy brand, operating narvy.io ("we", "us", "Narvy")
• Controller: the customer subscribed to a Narvy paid plan ("you", "Customer")

This DPA forms part of the Terms of Service and applies whenever you upload or process personal data through the Service.

Subject matter and duration#

Narvy processes Customer data solely for the purpose of providing the security testing services (SAST, DAST, SCA, source code analysis, autofix). Processing duration matches the active subscription term plus retention period defined per plan.

Nature and purpose of processing#

• SAST/SCA: static analysis of uploaded binaries (APK, AAB, IPA) and source code archives
• DAST: dynamic runtime analysis of the submitted application in an instrumented test environment, for the duration of the scan
• AI assistance and autofix: scan summaries, explanations, false-positive triage and patch generation, using AI models from an artificial intelligence sub-processor established in the European Union (section 7)
• Reports: generation of SARIF, PDF, and HTML deliverables
• CI/CD Integration: webhook delivery to GitHub, GitLab, Bitbucket, Jenkins

Categories of personal data#

The Service may incidentally process the following personal data contained in customer uploads:

• Developer email addresses present in git history or app metadata
• API keys, OAuth tokens, secrets detected by the secrets scanner (redacted before display)
• User account data of the Customer (name, email, billing address)
• End-user data potentially present in third-party application binaries scanned by Customer

Narvy does not request, require, or knowingly process special categories of personal data (GDPR Article 9).

Categories of data subjects: the Customer's staff and other users of the Service; developers and other persons whose data appears in submitted code, binaries or repositories; and end users of the Customer's applications whose data may appear in submitted material or in network traffic captured during a dynamic analysis.

Processing on documented instructions#

Narvy shall process the personal data only on documented instructions from the Customer, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which Narvy is subject. In such a case, Narvy shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The Customer's documented instructions are set out in, and comprise, this DPA, the Terms of Service, and the configuration and scan choices the Customer makes through the Service. Any additional or amended instruction outside the ordinary use of the Service must be agreed in writing.

Narvy shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other applicable Union or Member State data protection provisions.

Confidentiality of authorized persons#

Narvy shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Access to Customer personal data is limited to personnel who need it to provide, operate, or support the Service, and such access is subject to the access controls and audit logging described in the Security Measures section below.

Sub-processors#

Under Article 28(2) GDPR, the Customer grants Narvy general written authorisation to engage the sub-processors described below, and to engage further sub-processors in the course of providing the Service, subject to the notice and objection procedure in this section.

Narvy uses the following sub-processors:

• Hosting provider (Germany, European Union): servers, database, storage and backups
• Artificial intelligence provider established in the European Union (processing in the European Union): AI models for scan summaries, explanations, false-positive triage and autofix; receives finding details and, where needed, a minimised code excerpt
• Payment provider (European Union, with onward transfers to the United States, SCC-bound): billing and payment processing
• Transactional email provider (United States, SCC-bound): delivery of service emails
• Error-monitoring provider (United States company, data stored in its EU region, SCC-bound): application error monitoring
• Anti-bot provider (United States, SCC-bound): bot protection on the registration form and on the store readiness check page only
• Appointment-scheduling provider (United States, SCC-bound): remediation consultation booking, only if the Customer opens /consultation

The up-to-date list of sub-processors, with their names, is available on request at dpo@narvy.io.

Apart from the hosting provider, none of these sub-processors receives Customer uploaded binaries or source code; the artificial intelligence provider receives only finding details and the code excerpts described above. Customer data otherwise remains on infrastructure operated by Narvy or by its hosting provider within the European Union.

Where Narvy intends to add or replace a sub-processor, it shall notify the Customer at least 30 days in advance by email and update the list available on request. If the Customer has a reasonable data protection ground to object to the new sub-processor, the Customer shall notify Narvy in writing within 30 days of that notice. The parties shall work in good faith to resolve the objection; where no resolution is reached, the Customer may terminate the affected part of the Service as its remedy.

Narvy imposes on each sub-processor, by written contract, data protection obligations that are no less protective than those set out in this DPA, and remains fully liable to the Customer for the performance of each sub-processor's obligations.

Data location and international transfers#

Customer data is stored and processed in the European Union, on infrastructure operated by Narvy or by its hosting provider, including for dynamic analysis. Transfers of personal data to sub-processors that are located in, or may transfer data to, the United States (the transactional email, anti-bot, appointment-scheduling and error-monitoring providers, and the payment provider's onward transfers) are covered by Standard Contractual Clauses (SCC) per Commission Implementing Decision (EU) 2021/914 and, where the provider is certified, by the EU-US Data Privacy Framework adequacy decision.

Security measures#

• Encryption in transit (TLS) for all connections to the Service
• Passwords stored only as salted one-way hashes; two-factor authentication available on every account
• Administrative access restricted to authorised personnel; sensitive administrative actions logged
• Logical separation of Customer data per account and organisation; submitted files analysed in isolated processes, with temporary working copies deleted at the end of each scan
• Cloud access keys and SSH credentials supplied by the Customer stored encrypted
• Daily database backups, kept on a rolling cycle of at most 12 months

Assistance to the controller#

Taking into account the nature of the processing and the information available to Narvy, Narvy shall assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests for exercising data subject rights under Chapter III of the GDPR.

Narvy shall further assist the Customer in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to Narvy. This includes assisting the Customer, on reasonable request, with data protection impact assessments (Article 35) and with prior consultation of the supervisory authority (Article 36) where the Customer's processing through the Service is likely to result in a high risk to the rights and freedoms of natural persons.

Routine assistance is included in the Service. For assistance that materially exceeds routine support, Narvy may charge a reasonable fee, which it will agree with the Customer in advance.

Data subject rights#

You may request data export (GDPR Article 20) and deletion (Article 17) via /settings/data-export and the account deletion option in the account settings, or by emailing privacy@narvy.io. We respond within 30 days as required by GDPR.

Data breach notification#

Narvy will notify the Customer without undue delay and no later than 72 hours after becoming aware of a personal data breach. Notification will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and mitigation measures.

Retention and deletion#

Two separate retention rules apply, mirroring the Privacy Policy:

• Scan record (report, findings, history): deleted automatically after Community 7 days, Solo 30 days, Starter 90 days, Pro 180 days, Business 365 days; on Enterprise, retained until the Customer deletes it.
• Plan changes: an upgrade applies the longer retention at once. Where a downgrade or a cancellation (which returns the account to Community, 7 days) shortens retention, the new plan's retention applies to all existing Customer data, scan records and raw uploads alike, 30 days after the change; until then the previous plan's retention applies. The Customer is notified by email at the change with the exact deletion date and an export link, and reminded 7 days before that date. Returning within those 30 days to a plan with equal or longer retention cancels the scheduled deletion.
• Raw uploaded binary only (the APK/AAB/IPA/source-archive bytes, with the report retained): Community 7 days, Solo 30 days, Starter 90 days, Pro 180 days, Business 365 days, Enterprise until deletion.

At the choice of the Customer, Narvy shall delete or return all the personal data to the Customer after the end of the provision of services relating to processing, and delete existing copies unless Union or Member State law requires storage of the personal data. Upon a written deletion request or an account deletion, Narvy deletes all Customer personal data within 30 days. Upon subscription termination, the account continues on the Community plan and the plan-change rule above applies. Residual copies held in database backups disappear as those backups are overwritten on the rolling cycle described in section 9, within 12 months at most. Statutory records that Narvy is legally required to keep (for example invoices under the French Commercial Code) are retained for their mandatory period and cannot be deleted on request.

Audit rights and demonstration of compliance#

Narvy shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR, and shall allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer.

The Customer's audit right may be satisfied in the first instance by the audit documentation Narvy makes available on request to privacy@narvy.io. Narvy holds no ISO 27001 or SOC 2 certification.

Where that documentation does not reasonably satisfy the Customer's audit requirements, the Customer may conduct an on-site or remote audit on at least 30 days' prior written notice, no more than once per calendar year (save where required by a supervisory authority or following a personal data breach), during business hours, and subject to confidentiality obligations, carried out so as not to unreasonably disrupt Narvy's operations or compromise the security of other customers' data. Where an audit reveals a material non-compliance by Narvy, Narvy shall remediate it at its own cost.

Liability and limitations#

Liability and indemnification are governed by the Terms of Service, except where statutory liability under GDPR Articles 82-84 applies.

Contact#

For DPA-specific questions, signature requests, or to receive a counter-signed copy:

A counter-signed PDF version of this DPA is available on request for Business and Enterprise customers.