This translation is provided for information only: only the French version is legally binding.
Data processing agreement (DPA)
Version of 2026-10-31. Agreement concluded under Article 28 of the General Data Protection Regulation (GDPR), between the customer (controller) and Thomas SAMSON (SAMSON Tech) (processor). It forms part of the terms and conditions and applies as soon as an organization is created.
1. Description of the processing
- Purpose
- Providing the Wardpod service: vulnerability analysis and software inventory of the customer's Kubernetes clusters.
- Nature
- Collection by the agent installed by the customer, storage, calculation of scores and priorities, display in the console, sending of alerts and reports.
- Duration
- That of the subscription, followed by erasure in accordance with Article 7.
- Data
- Cluster metadata: names of clusters, namespaces, workloads and containers, images, packages and versions, vulnerabilities, exposure (host names of Ingresses and routes), pod security settings. In principle they contain no personal data, except what the customer itself puts in these names. Console user accounts (username, email address, activity log).
- Data subjects
- Console users designated by the customer; persons who may be named in cluster metadata.
- Exclusions
- The agent never reports the contents of image files, the values of pod environment variables, Secrets, ConfigMaps or logs.
2. Customer's instructions
The processor only processes data on the customer's documented instructions, consisting of the terms and conditions, this agreement and the customer's use of the console. It informs the customer if an instruction appears to it to infringe the GDPR.
3. Confidentiality
Persons authorised to process the data are bound by confidentiality. The processor only accesses an organization's data to provide the service, troubleshoot it at the customer's request or meet a legal obligation.
4. Security
Technical and organisational measures in place:
- encryption of exchanges (HTTPS) between the agent, the console and the service;
- agent tokens specific to each cluster; a cluster cannot change anything the others see;
- isolation of organizations, verified by automated tests; dedicated console for each organization on paid plans;
- passwords stored as hashes, secrets encrypted in the database, two-factor authentication available;
- hardened server (key access, firewall, automatic updates), reachable only through the proxy;
- backups encrypted twice a day, stored separately, restoration tested;
- continuous monitoring and alerts; restricted and logged administrative access.
5. Sub-processors
The customer authorises the use of the following sub-processors:
| Sub-processor | Role | Location |
|---|---|---|
| OVH SAS | Hosting of the service and backups | France |
| Cloudflare, Inc. | Routing and protection of traffic | Global network (Data Privacy Framework, standard contractual clauses) |
| Brevo (Sendinblue SAS) | Sending emails (alerts, reports) | France |
The processor imposes obligations equivalent to this agreement on each of them. It informs the customer by email of any addition or replacement at least 30 days in advance; the customer may object on grounds relating to data protection, and terminate at no cost if no solution is found.
6. Assistance to the customer
- Data subject rights: the processor forwards to the customer without delay any request received from a data subject, and helps it respond.
- Data breach: it notifies the customer of any personal data breach as soon as possible, and at the latest 48 hours after becoming aware of it, with the information useful for notifying the supervisory authority.
- Impact assessments: it provides the customer with the information needed for its impact assessments and prior consultation of the authority.
7. End of processing
When the organization is deleted or the subscription ends, data is erased from the service, then from backups as they rotate, within 6 months at most. Before deletion, the customer can export its data from the console. Billing data is kept by the publisher under its legal obligations.
8. Audit
The processor makes available to the customer the information needed to demonstrate compliance with this agreement. The customer may have an audit carried out, at its own expense, by an independent auditor bound by secrecy, at most once a year, with 30 days' notice, without access to other organizations' data.
9. Transfers
Data is hosted in France. A transfer outside the European Union by a sub-processor only takes place with the safeguards provided by the GDPR (adequacy decision, including the Data Privacy Framework, or the European Commission's standard contractual clauses).
10. Contact
For any question about this agreement: [email protected].