Data Processing Agreement

• The customer is the data controller and determines the purposes and means of processing. LeakIQ is the data processor and processes personal data only on the customer's behalf.
• LeakIQ processes personal data solely to provide its read-only revenue-leakage detection and recovery service (the "Purpose"). LeakIQ only ever reads from the customer's systems: it does not alter, write to, or move the customer's data, and no code path in the platform does so. Where a provider publishes no read-only scope covering the records required, the access the customer grants is broader than LeakIQ's use of it; the per-connector position is published at leakiq.io/trust/access.
• LeakIQ is registered with the UK Information Commissioner's Office under registration number ZC187738.

As required by Article 28(3) of the UK GDPR:

LeakIQ shall:

• process personal data only on the customer's documented instructions, including this DPA and the customer's use of the platform, unless required otherwise by law (in which case it will notify the customer first, unless the law prohibits it);
• ensure that persons authorised to process the personal data are bound by confidentiality;
• implement appropriate technical and organisational measures under Article 32 (see section 6);
• not engage a sub-processor without general or specific authorisation (general authorisation is given for the sub-processors in section 4), and impose data-protection terms equivalent to this DPA on each;
• assist the customer, taking account of the nature of processing, in responding to data-subject requests and in meeting its obligations under Articles 32 to 36;
• notify the customer without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting the customer's data;
• at the customer's choice, delete or return the personal data at the end of the engagement, as set out in section 7; and
• make available the information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, on reasonable notice.

The customer gives general written authorisation for LeakIQ to engage sub-processors for hosting, database, transactional email, billing, rate limiting, error and performance monitoring, and AI-assisted drafting. The current list, with each sub-processor's purpose, location and safeguard, is published at leakiq.io/legal/sub-processors.

• LeakIQ imposes data-protection obligations equivalent to this DPA on each sub-processor and remains liable for their processing.
• LeakIQ will give the customer at least 30 days' advance notice of any intended addition or change of sub-processor, during which the customer may object on reasonable data-protection grounds.

Personal data is stored at rest within the European Economic Area (Amazon Web Services, eu-central-1, Frankfurt) via our database provider, and application compute runs within the EEA, pinned to the eu-central-1 (Frankfurt) region. Several supporting operations, including transactional email, billing, rate limiting and (when enabled) AI-assisted drafting, are performed by sub-processors in the United States. Error monitoring stores within the EEA, with US parent-company support access covered by the same safeguards. The complete position for each is in the register linked below. Where personal data is processed outside the UK or EEA, it is protected by appropriate safeguards, namely the Standard Contractual Clauses together with the UK International Data Transfer Addendum (or the relevant provider's Data Privacy Framework certification), as set out in each sub-processor's data processing terms. The per-sub-processor position is shown on the sub-processor list.

LeakIQ maintains technical and organisational measures appropriate to the risk, including encryption of credentials at rest (AES-256-GCM) and data in transit (TLS 1.2 or higher), tenant isolation, role-based access control, optional multi-factor authentication available to every user, and a tamper-evident, hash-chained audit log. These measures are described in more detail in the Information Security Policy and technical documentation.

On termination of the engagement, LeakIQ makes the customer's data available for export for 30 days. LeakIQ deletes it on the customer's written request, within 30 days of that request, and the customer can also delete workspace data directly from Settings, Security, at any time. Two categories are excepted: copies required by law or held in routine backups, which age out of the backup window and remain subject to this DPA until deleted; and the audit log, which is a tamper-evident hash chain and is retained, with personal identifiers pseudonymised rather than removed, because deleting entries would destroy the integrity of the remaining records. Removing a connector deletes its encrypted credential immediately. Full detail is in the Data Retention & Deletion Policy.

This DPA is governed by the laws of England and Wales. For customers who have signed the Master Subscription Agreement, Schedule 1 of that agreement governs and this page mirrors it; for customers without one, this page is the DPA. LeakIQ Ltd is a company registered in England and Wales (number 17311148), 195 Wood Street, London E17 3NU. Data-protection queries and requests can be sent to support@leakiq.io.