⚡ Direct Answer Summary (AI Overview / Key Takeaway)
Contractual commitments governing personal data processing, sub-processor management, and regulatory compliance.
eTrepid Data Processing Addendum (DPA)
Governing Standard: GDPR Art. 28 / CCPA/CPRA / Applicable US State Privacy Laws
1. Scope and Hierarchy
This Data Processing Addendum ("DPA") supplements the Master Services Agreement or Master Service Order entered into between eTrepid Inc. ("eTrepid" or "Processor") and the contracting customer ("Customer" or "Controller").
This DPA applies to the processing of Personal Data in connection with the delivery of the ThreatKrusher Cyber Defense System, customer support, and managed IT/security operations. In the event of any conflict between this DPA and the underlying service agreement, this DPA governs regarding personal data processing.
2. Processing Principles and Instructions
Role of the Parties: Customer is the Controller of Personal Data; eTrepid processes Personal Data strictly as a Processor acting on documented customer instructions.
Scope of Processing: Processing is limited to activities necessary to provide 24/7 SOC monitoring, endpoint protection, user identity management, and compliance advisory services.
No Commercial Exploitation: eTrepid does not "sell" or "share" Personal Data as defined under the California Consumer Privacy Act (CCPA/CPRA) and state privacy regulations.
3. Security Measures (Technical & Organizational)
eTrepid implements and maintains robust technical and organizational measures aligned with NIST SP 800-171 and ISO/IEC 27001 to ensure a level of security appropriate to the risk, including:
Access Controls: Role-based access control (RBAC), multi-factor authentication (MFA) enforcement for all administrative sessions, and least-privilege credential allocation.
Encryption: Transport Layer Security (TLS 1.3) for data in transit; AES-256 encryption for data at rest.
Personnel Integrity: Mandatory background screening, annual data privacy training, and binding confidentiality agreements for all personnel with data access.
4. Authorized Subprocessors
Customer grants general written authorization for eTrepid to engage approved subprocessors to support service delivery. eTrepid's current authorized infrastructure subprocessors include:
Microsoft Corporation: Azure Cloud & M365 (Hosting, sovereign enclaves, directory authentication).
Amazon Web Services (AWS): Cloud hosting and secure data storage (GovCloud).
ThreatKrusher ITSM Telemetry & RMM Platform: Endpoint monitoring, automated patching, and management infrastructure.
ThreatKrusher Trust ZTNA Fabric: Micro-segmentation and Zero Trust access broker routing.
eTrepid binds each subprocessor to data protection terms at least as protective as those in this DPA.
5. Security Incident Notification
In the event of a confirmed Security Incident resulting in the unauthorized access, disclosure, or destruction of Customer Personal Data:
Notification Timeline: eTrepid notifies Customer without undue delay and in all cases within 48 hours of confirmation.
Notification Details: Provides a description of the incident nature, categories of affected records, estimated impact, and corrective mitigation steps taken.
