Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (“DPA”) is between the Customer (the “Controller”) and Radrly Sp. z o.o., Poland (registered office: ul. Tarczyńska 68, 05-831 Krakowiany, Poland; KRS 0001215510, NIP 5342706013, REGON 543658680) (the “Processor”). It forms part of the End User License Agreement and applies to personal data that the Processor processes on the Controller's behalf through LeakRadar. Terms such as “personal data” and “processing” have the meaning given in Regulation (EU) 2016/679 (GDPR).

2. Subject matter, duration and nature

• Subject matter: providing LeakRadar: scanning Jira and Confluence content for credentials and personal data, triage, remediation actions requested by users, reports and evidence.
• Duration: for as long as the Controller has the app installed, plus the deletion period described in section 9.
• Nature and purpose: reading data inside Atlassian Forge, storing results in Forge hosted storage, and showing them to authorised users.
• Infrastructure: the app runs only on Atlassian Forge (Runs on Atlassian). It declares no remote hosts, uses no Forge Remote or Connect, and makes no egress to servers outside Atlassian. No processing of Controller data takes place on Radrly-operated servers.

3. Data and data subjects

• Data subjects: people whose personal data appears in scanned content, authors and editors of scanned content, and users of LeakRadar.
• Categories of personal data stored:
  • masked snippets and masked item titles, keyed hashes (HMAC-SHA256 with a per-installation secret) and locations of findings
  • AI labels, confidence and short reasons, which never quote the value, and monthly AI usage counters
  • statuses, severity overrides, owners, due dates and the decision history, including free-text triage notes that users type, which LeakRadar masks before storing
  • suppressions, saved views, in-app notifications, sensitivity labels with undo data for restrictions, auto-remediation policies and their runs, custom detectors, delegated role grants and settings
  • erasure records (counts, locations and hashes, no values), reports, report hashes and the audit log of settings changes, scans and exports
  • Atlassian account IDs of owners, actors in the decision history and audit log, LeakRadar team members, people with delegated roles, policy approvers and people who request an erasure
• Not stored: Raw secret or personal data values, rendered page or work item content, AI prompts and responses, IP addresses, email addresses of users and cached display names. Content, including attachment text, is processed in memory during a scan and discarded.

4. Instructions

The Processor processes personal data only on the Controller's documented instructions, which are these terms, the Controller's configuration of the app and the Controller's use of its features. If the Processor believes an instruction infringes data protection law, it will inform the Controller.

5. Confidentiality and personnel

The Processor ensures that people authorised to process personal data are bound by confidentiality obligations. As the app runs on Atlassian Forge and has no code path that sends Controller data to Radrly, Radrly staff have no routine access to Controller data.

6. Security

The Processor implements appropriate technical and organisational measures under Article 32 GDPR, described in Annex II and on the Security page.

7. Sub-processors

The only sub-processor is Atlassian (Atlassian Pty Ltd and affiliates), which hosts Forge and the Atlassian Cloud products. The Controller gives general authorisation for the sub-processors in Annex III. The Processor will inform the Controller of intended changes so that it can object.

8. Assistance, personal data breaches and audits

• Data subject rights: the Processor will help the Controller to respond to data subject requests.
• Breach notification: the Processor will notify the Controller without undue delay, and in any event within 48 hours after becoming aware of a personal data breach affecting the Controller's data.
• Audits: the Processor makes available the information needed to show compliance and allows reasonable audits, which may be satisfied by documentation, Atlassian's published compliance reports or a written questionnaire.

9. Return and deletion

Open, confirmed and accepted risk findings are kept while they stay in that state. Resolved and false positive findings are kept for 13 months by default; a Jira administrator can change this period in Settings (90 days to 24 months). The audit log is kept for 13 months and signed report hashes for 7 years, so earlier evidence can still be verified. When Atlassian reports an account as closed, the Processor removes or pseudonymises that account ID. After uninstall, the Forge platform deletes the app's data according to Atlassian's policy.

10. International transfers

The Processor does not transfer personal data itself. All LeakRadar data is stored in Forge hosted storage under the Controller's Atlassian data residency choice. Any transfers by Atlassian are governed by Atlassian's own transfer mechanisms.

11. Liability, term and law

Liability under this DPA is subject to the limitations in the End User License Agreement, to the extent the law allows. This DPA lasts as long as the Processor processes personal data for the Controller and is governed by the laws of Poland. If this DPA and the EULA conflict on personal data, this DPA prevails.

Annex II: Technical and organisational measures

• Hosting on Atlassian Forge (Runs on Atlassian). Encryption at rest and in transit provided by Atlassian.
• Storage in Forge hosted storage only, following the Controller's data residency.
• No egress: no calls to remote hosts, no Forge Remote or Connect, no public API.
• Server-side permission checks before every read; validated input; prepared SQL statements.
• Data minimisation as described in section 3; logs without personal data.
• Automated checks before every production deployment; a vulnerability reporting process.

Annex III: Sub-processors

No other sub-processors.

Contact

Privacy and DPA questions: marcin@radrly.com.