Data Processing Terms

These terms are a draft of the Article 28 processor terms KROMSE intends to offer. They are published so that a design partner's legal reviewer can see the shape of the arrangement and the gaps in it early, rather than after a procurement process has started.

This draft is not an executed data processing agreement and does not become one by being read or by anyone accepting the Terms of Service. Signature, effective date, and the relationship between this document and any negotiated agreement have not yet been confirmed by legal counsel.

For personal data contained in the scan inputs, documents, and workspace content you connect to KROMSE, you are the controller and KROMSE is the processor.

For the account data of the individuals who log in to KROMSE, KROMSE is a controller in its own right. The Privacy Policy covers that.

A separate AI processing policy (Configured providers / EU-only / Deterministic-only) applies in addition to the AI data setting. Both settings must permit an AI request. EU-only and Deterministic-only currently block all customer AI, with no fallback provider: no EU AI endpoint is approved. A deterministic-only scan never sends repository source code or excerpts to AI; chat and verdicts can use its findings metadata, including attached scans and findings. Workspace Off blocks new requests. Stored verdicts remain visible with their recorded model and date.

KROMSE analyzes repository code, SBOMs, firmware and container images, records the resulting evidence, and presents it in the workflows you use. Automated analysis includes external vulnerability lookups using component and advisory identifiers, as described in section 5 of the Privacy Policy. AI processing occurs when you select optional code review, send a chat message or request a finding verdict. Chat and verdict requests may include paths and line numbers. Automatic source excerpts and repository tools require workspace code-excerpts permission and an AI-eligible scan. Free verdicts do not list or read repository files. Workspace Off blocks new AI requests. Deterministic-only scan choice blocks source code and excerpts, while chat and verdicts may use findings metadata. Stored verdicts remain visible with their recorded model and date.

Temporary repository copies, retained firmware inputs, scan evidence and workspace records have different lifecycles, described in section 4 of the Privacy Policy. This draft does not establish an account-closure deletion deadline.

KROMSE does not choose what personal data is in your inputs; you do. Personal data may reach KROMSE through:

• Source code and repository contents, which routinely contain author names and email addresses, and may contain test fixtures, seed data, comments, or configuration containing personal data of your employees, customers, or end users.
• Uploaded SBOMs and firmware, and selected container images, which may include author information, configuration, files or other personal data.
• Scan evidence, which can quote fragments of that code.
• Supported text and Office documents uploaded during onboarding and parsed within KROMSE. External OCR and PDF/image reading are disabled.
• Workspace content your team types into products, cases, and report drafts.
• Account data of your personnel who use KROMSE.

Data subjects are therefore your personnel and any individual whose personal data happens to be present in the inputs or documents you connect.

Whether special-category data may be processed, and on what conditions, has not yet been confirmed by legal counsel. KROMSE applies no technical control that prevents special-category data from being present in a scanned repository.

Product actions give processing instructions: attaching a Git source or container reference, uploading an SBOM or firmware, starting a scan, selecting optional AI code review, sending a chat message, requesting a finding verdict and uploading a supported document for local parsing. Section 5 of the Privacy Policy describes what each external processing path sends.

KROMSE does not use your data for its own purposes, does not sell it, and does not use your source code or workspace content to train machine learning models.

Personnel authorized to process customer data are bound by confidentiality obligations.

The form of that obligation (employment terms or contractor agreements) is not yet set out in this document, and it makes no background-check or training commitment.

The technical measures KROMSE implements today are listed below. This is a description of the running system, not a target state.

• Workspace scoping: every record carries its organization identifier and data access is filtered by it, so one customer's data is not reachable from another's workspace.
• Role-based access control within a workspace, with permissions enforced on the server.
• Scan evidence written to private object storage with server-side encryption, verified for both encryption and content digest at the moment of writing. Local-disk evidence storage is rejected in the production configuration.
• Repository working copies held in a temporary per-scan workspace and deleted when the scan finishes; retained evidence may contain code fragments, and uploaded firmware has its own retention lifecycle.
• Secret redaction applied to any code selected for AI review, and exclusion of files in which the secret scanner found a secret.
• GitHub installation credentials confined to API calls, never forwarded to the archive download host and never written to storage, logs, or error messages.
• Archive extraction hardened against path traversal, symlinks, oversized members, and archive bombs.
• A tamper-evident audit trail: entries are chained with SHA-256 over the preceding entry so that alteration is detectable.
• Scanners executed as a non-root user in an isolated container image built from checksum-pinned binaries.
• Database protection on the Hetzner database server: the volume holding the PostgreSQL database is encrypted at rest, the API and workers are configured to connect over the private network with TLS and certificate verification, and database backups are encrypted before they are stored. This describes configuration, not an independent audit.

KROMSE holds no SOC 2 report and no ISO 27001 certification, and has not undergone a third-party penetration test. This document makes no commitment to obtain, maintain or evidence such a certification.

KROMSE uses the following sub-processors for the platform. Consent-based website analytics are described in section 3 of the Privacy Policy.

• Hetzner — hosting in Germany of the web application, API, CRM, scanner workers and PostgreSQL database, with encrypted database backups. Hetzner processes all customer data handled by the platform. Temporary scanner disks have no verified encryption-at-rest assurance.
• Cloudflare R2 — scan evidence and uploaded firmware, through the EU jurisdiction endpoint with automatic region selection; this identifies the configured endpoint, not an individual storage country.
• Clerk — authentication, sessions, workspace membership and invitation emails. Account data: name, email address, organization membership and role.
• Stripe — subscription billing and payments through Stripe's hosted pages. Billing contact, address, tax ID and payment details entered at Stripe; KROMSE provides the workspace identifier as a reference and holds no card numbers.
• Google Workspace — application email sent through Google's mail service (SMTP server smtp.gmail.com), including contact-form enquiries and configured operational notifications (sender and recipient addresses and message content).
• OpenAI — the AI provider for every AI feature that sends your content: chat, finding verdicts, triage of static-analysis findings and optional code review, as described in section 5 of the Privacy Policy.
• Anthropic (United States) — named as an AI sub-processor. No KROMSE feature sends your content to Anthropic today, as section 5 of the Privacy Policy describes.
• Mistral AI — named as an AI sub-processor, with Mistral's EU endpoint (api.eu.mistral.ai) as its configured endpoint. No KROMSE feature sends your content to Mistral today. External document OCR stays disabled.
• GitHub, other attached Git hosts and container registries — the sources of the repositories and images you select, accessed on your authorization.

US-based providers include OpenAI, Anthropic, Clerk, Stripe, Cloudflare, Google and GitHub; the contracting entity may differ. These providers do not establish whole-product EU-only processing or a signed transfer mechanism.

Section 6 of the Privacy Policy lists the current service providers and external data services, with their technical purposes. Contractual roles, applicable agreements and transfer arrangements remain to be reviewed for this draft.

Clerk manages sign-in, workspace membership and invitation emails. When you invite a colleague, Clerk receives their email address and workspace details and sends the invitation on your instruction.

OpenAI processes current chat messages, relevant retrieved workspace context and web-search requests. Chat and finding verdicts may send paths and line numbers in metadata-only mode. Repository source reads require code-excerpts permission and an AI-eligible scan, and are unavailable to Free verdicts. There is no Mistral fallback and external document OCR is disabled. Optional AI code review sends a bounded, redacted code selection only when enabled for the scan. Deterministic scans still make external advisory requests; disabling AI does not disable those requests.

Planned provider changes are reviewed by Kromse Labs S.L. and communicated manually to verified workspace contacts, identifying the provider, purpose, affected data and intended date. Questions or objections go to info@kromse.com and are recorded before a decision on the affected processing. Any contractual authorisation, notice period or objection window must be agreed in the applicable customer agreement; this draft does not establish them. There is no automated advance-notice service.

For data return, correction or closure, contact info@kromse.com. Kromse Labs S.L. verifies the requesting workspace owner and records the scope, delivery channel and target date. Existing downloads cover their stated scope. A wider export and deletion are handled manually, with checks for missing objects, shared accounts and retained records. Database rows, object files, provider records and backups are separate steps. Archiving is not erasure. A completion statement identifies what was removed and what remains; there is no self-service whole-workspace deletion or fixed completion deadline.

Requests for additional documentation or assessment assistance are reviewed individually with the verified customer contact. The response records available evidence, gaps and next steps; it does not certify the customer’s compliance.

Report a suspected incident to info@kromse.com, identifying the affected workspace and what you observed without sending passwords or unnecessary personal data. Kromse Labs S.L. coordinates the response: record the report, preserve relevant evidence, assess affected data and services, contain the incident, and track recovery. Customer communications distinguish confirmed facts from unknowns and identify outstanding actions. The responsible people and their advisers assess any applicable notification requirements; this notice does not make that legal determination or promise a fixed response deadline.

A periodic job attempts to delete expired scan-evidence objects in bounded batches and retries failures. Successful deletion replaces the stored object location with a deletion marker and records the time. The database row retains its digest and other metadata; findings, reports, audit records and database backups are not erased by that object-expiry job. Normal scan cleanup removes the temporary source copy; a forcibly stopped worker can leave temporary files until cleanup or service replacement. Uploaded firmware remains stored while its product input is active; archiving that input starts its plan-based retention period rather than deleting the bytes immediately.

For data return, correction or closure, contact info@kromse.com. Kromse Labs S.L. verifies the requesting workspace owner and records the scope, delivery channel and target date. Existing downloads cover their stated scope. A wider export and deletion are handled manually, with checks for missing objects, shared accounts and retained records. Database rows, object files, provider records and backups are separate steps. Archiving is not erasure. A completion statement identifies what was removed and what remains; there is no self-service whole-workspace deletion or fixed completion deadline. Backup copies may retain previously stored data until their verified expiry or separate removal. A restricted deletion ledger records completed requests so they can be reapplied before a restored database is returned to service. Removing live data does not establish that every backup or provider copy has been erased.

Audit and inspection rights under Article 28(3)(h), including their frequency, notice, cost, and whether documentation may replace an on-site visit, are not yet set out and have not yet been confirmed by legal counsel. KROMSE has no audit report to offer in place of an inspection.

Several sub-processors process data outside the EEA. The transfer mechanism for each (standard contractual clauses, an adequacy decision or another mechanism) and any transfer impact assessment have not yet been confirmed by legal counsel, so this draft incorporates no standard contractual clauses.