If you only scan non-personal files (for example CI artifacts with no personal data), this DPA still describes how Threatless handles any personal data that might appear in metadata. For a signed copy or additional security questionnaires, email contact@trythreatless.com.
1. Roles
- Customer is the controller (or processor acting for a third-party controller) of personal data contained in files or URLs submitted to the Scan API or dashboard scanner.
- Threatless is the processor of that content, and a controller of account, billing, and scan-metadata it needs to operate the Service as described in the Privacy Policy.
2. Customer instructions
Customer instructs Threatless to:
- Receive a file upload or fetch a Customer-provided public URL
- Stream bytes to ClamAV in memory
- Return a JSON verdict
- Store scan metadata (filename, verdict, size, duration, timestamps) on the Customer account
- Discard file bytes after the scan attempt completes
Threatless will not process Customer content for advertising or to train unrelated models. Customer is responsible for having a lawful basis to submit the content, including notices to its own users where required.
3. Details of processing
- Subject matter: malware scanning of Customer-submitted files and public URLs
- Duration: the term of the Customer account, plus limited retention of billing records required by law
- Nature: transmission, ephemeral in-memory analysis, metadata storage
- Purpose: provide the Service under the Terms
- Types of personal data: whatever Customer includes in filenames or file contents; Threatless does not require personal data inside payloads and does not inspect content except through ClamAV signatures and metadata fields listed in the Privacy Policy
- Data subjects: Customer’s users, employees, or others whose data Customer chooses to scan
4. Confidentiality and security
Threatless will ensure persons authorized to process Customer content are bound by confidentiality. Security measures include TLS in transit on the hosted product, access control on the API, hashed passwords, session revocation, SSRF protections on URL fetch, and in-memory scanning so file contents are not persisted as a product feature.
5. Subprocessors
Customer authorizes Threatless to use subprocessors necessary to host the Service, send transactional email, and process payments (including Stripe for paid plans). ClamAV runs in Threatless’s API environment rather than as a separate consumer of file contents. Threatless remains responsible for subprocessors’ performance insofar as they process Customer content for the Service.
A current subprocessor list is available on request at contact@trythreatless.com. Material additions will be communicated on request or via product notice where feasible.
6. Assistance
Taking into account the nature of processing (ephemeral scans plus metadata), Threatless will reasonably assist Customer with data-subject requests, DPIAs, and breach notifications that relate to the Service. Because file bytes are not stored, Threatless typically cannot retrieve a copy of a scanned file after the request completes.
7. Personal data breaches
Threatless will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer content, with facts then known: nature, likely consequences, and measures taken or proposed.
8. Deletion and return
File bytes are not retained, so they cannot be returned. On account deletion, Threatless will delete or anonymize scan metadata and account data, except billing or log records it must keep under law. Customer may export dashboard history while the account is active.
9. Audits
Upon reasonable written request, Threatless will provide information reasonably necessary to demonstrate compliance with this DPA, such as this document, the Privacy Policy, and high-level security descriptions. On-site audits are available only by mutual agreement and not more than once per year unless a confirmed breach requires otherwise.
10. International transfers
Where Customer content is transferred outside the EEA, Threatless will use an adequacy decision or Standard Contractual Clauses with the relevant party, as applicable.
11. Precedence
If this DPA conflicts with the Terms on data-protection obligations for Customer content, this DPA controls. The Privacy Policy describes Threatless’s controller activities for account and billing data.