Data processing agreement (DPA)
Last updated: 30 October 2026
This English translation is provided for convenience. Only the French version is legally binding.
1. Parties and roles
Your organisation ("the Customer") is the controller of the data it sends into CheckOps. ClearCloud ("the Processor") processes it on the Customer's behalf, for the sole purpose of providing the service described in the terms of use. This agreement forms part of them.
2. Processor obligations (Article 28(3) GDPR)
- Process the data only on documented instructions from the Customer: using the service constitutes an instruction.
- Ensure the confidentiality of the persons authorised to access it.
- Implement the security measures of Annex II.
- Engage another processor only under the conditions of Annex III.
- Help the Customer respond to requests to exercise rights and meet its security and notification obligations.
- Notify the Customer of any personal data breach concerning it without undue delay, and no later than 48 hours after becoming aware of it.
- Delete the data at the end of the contract, when the account is deleted.
- Make available the information needed to demonstrate compliance with these obligations.
3. Customer obligations
The Customer ensures it has a legal basis for the data it sends and limits that data to what is necessary. SBOMs and scanner results describe software: they should not contain personal data beyond the names of component authors or maintainers.
4. Duration and governing law
This agreement lasts as long as the Customer's account. It is governed by French law.
Annex I · Description of the processing
| Subject matter | Software component inventory, vulnerability detection, alerts, CRA notifications and reports |
|---|---|
| Data subjects | The Customer's users; alert recipients; where applicable, authors named in SBOMs |
| Data | Email addresses, names, roles; content of SBOMs and scanner results |
| Duration | Lifetime of the account |
Annex II · Technical and organisational measures
- Hosting in France; encryption in transit (TLS).
- API tokens stored as a hash; alert channel tokens encrypted (AES-256-GCM).
- Data isolated per organisation, checked on every request; per-member roles.
- Administration console reachable only from authorised IP addresses.
Annex III · Authorised sub-processors
| Subprocessor | Role | Location | Data |
|---|---|---|---|
| OVH SAS (OVHcloud) | Hosting of the platform, the database and the backups | France | All service data |
| Scaleway SAS | Sending emails (alerts, invitations) | France | Recipient email address, alert content |
Any addition or replacement is announced by email at least 30 days in advance; the Customer may object by closing its account.
Annex IV · Transfers outside the European Union
None.