Legal - Data processing terms

Roles

For personal data in the systems we test, you are the controller and Meridal Group LLC is the processor. These terms are meant to meet Article 28 of the GDPR and the service provider rules of the CCPA. A signed copy is available on request.

What we process and why

• Purpose. Only to perform the security test, write the report, open fix pull requests and retest.
• Data. Whatever personal data becomes visible in the systems in scope. We aim to see none by using test accounts and synthetic data.
• Duration. The engagement, plus the retention periods below.

Our commitments

• We process personal data only on your documented instructions.
• Everyone who sees it is bound by confidentiality.
• We do not sell it, keep it for our own purposes or use it to train AI models.
• We help you answer requests from data subjects and meet your own security and breach duties.
• We tell you without undue delay, and within 72 hours, after we become aware of a personal data breach affecting your data.

Security measures

• Encryption in transit and at rest for all evidence and reports.
• Full disk encryption and multi-factor authentication on every device and account. No shared logins.
• Credentials received through a password manager, limited to the test and revoked at the end.
• Access to evidence limited to the people named in your statement of work.

Subprocessors

Our current subprocessors are listed on the subprocessors page. We give at least 30 days' notice before adding one, and you may object on reasonable data protection grounds. We remain responsible for every subprocessor we use.

Transfers

Our testers work in the European Union. Where personal data moves between the EU and the United States, the EU Standard Contractual Clauses apply, or the recipient's certification under the EU-US Data Privacy Framework.

Deletion

Raw evidence is deleted 30 days after the retest and the final report after 12 months, unless you instruct otherwise in writing. At the end of an engagement we delete or return personal data on request and confirm it in writing.

Audits

We answer reasonable security questionnaires about our own controls once a year free of charge, and we allow an audit by you or an independent auditor where the law requires it, with reasonable notice.

Contact

Data protection questions and security incidents: security@wardkeylabs.com.