Data Processing Addendum

1. How this DPA applies

This DPA forms part of the Agreement when Customer accepts it, by signing it or by an order form that incorporates it. Publishing it here does not by itself bind either party.

If this DPA conflicts with the rest of the Agreement, this DPA governs the processing of personal data. If it conflicts with transfer clauses incorporated under Annex 3, those clauses govern.

2. Roles

Customer Data includes information collected from the cloud accounts and repositories Customer connects, what the Service derives from it, and what Customer’s users enter about Customer’s environment. For personal data in Customer Data, Customer is the controller (or a processor acting for its own controller) and Kultarr. is its processor (or subprocessor).

For account, authentication, billing and Service-security data about Customer’s users, Kultarr. is an independent controller, as the Privacy Policy describes. This DPA does not apply to that processing.

3. Details of the processing

Subject matter and duration

Providing the Service under the Agreement, for its term and until Customer Data is deleted under section 9.

Nature and purpose

Reading, storing, analysing, correlating and displaying cloud configuration, identity and activity information from Customer’s connected environments, to produce inventories, findings, investigations, identity-activity analysis, permission explanations and remediation proposals for Customer. The Service does not currently make changes in Customer’s cloud accounts.

Categories of data subjects

• Customer’s employees, contractors and other people whose identities appear in Customer’s cloud accounts, for example as IAM users, role-session names or CloudTrail actors;
• people named in resource tags, policies, repository files or other configuration Customer connects;
• Customer’s users of the Service, as authors of notes, comments and decisions.

Categories of personal data

• identifiers in cloud metadata: names, email addresses and user names in IAM principals, role sessions, tags and policies;
• activity records: CloudTrail actions, timestamps, source IP addresses, user agents and regions;
• derived information: identity sessions, activity baselines and scores, and (where a local geolocation database is installed) approximate country and network operator for IP addresses;
• repository content Customer connects, including contributor names and email addresses;
• free text Customer’s users enter.

Location

The Service’s database, backups, stored credentials and related application infrastructure are hosted in the United States using Amazon Web Services infrastructure.

Special categories

None intended. Customer must not connect sources intended to send workload content, secrets, payment-card data or special categories of personal data.

4. Instructions

Kultarr. processes Customer Data only on Customer’s documented instructions, which are the Agreement, this DPA, and Customer’s configuration and use of the Service, including the remediation mode Customer selects and any change an authorized user approves. If the law requires other processing, Kultarr. will tell Customer first unless the law forbids it.

Kultarr. processes Customer Data only to provide, secure and support the Service for the customer that connected it, on that customer’s instructions, and as the law requires.

Kultarr. does not use raw Customer Data to develop or improve the Service for other customers. To maintain and improve the Service, Kultarr. may use (a) information about how the Service itself operates, such as error rates, job timings and which features are used, and (b) aggregated or de-identified information derived from Customer Data that cannot reasonably be used to identify the customer or any individual, and that Kultarr. does not attempt to re-identify.

Kultarr. does not use Customer Data to train a general-purpose artificial-intelligence model, and does not send it to an artificial-intelligence provider, unless the customer has separately and expressly agreed to that in writing.

Kultarr. will tell Customer if, in its opinion, an instruction infringes applicable data-protection law.

Customer is responsible for having a lawful basis for the processing it instructs, and for giving notices to, and obtaining any permissions from, the people whose information its connected accounts contain.

5. Confidentiality

Kultarr. ensures that everyone it authorizes to process Customer Data is bound by confidentiality, and that access is limited to what their role requires.

6. Security

Kultarr. implements the technical and organizational measures in Annex 2. It may change them provided the overall level of protection is not reduced.

Customer is responsible for the security of its own accounts, credentials, identity provider and cloud environments, for configuring the access it grants, and for its decisions on findings and recommendations.

7. Subprocessors

Customer authorizes Kultarr. to engage the subprocessors listed in Annex 1 and at /subprocessors. Kultarr. imposes data-protection obligations on each that are no less protective than this DPA, and remains responsible to Customer for their performance.

Kultarr. will provide at least 30 days’ advance notice before a new subprocessor begins processing Customer Data. Notice is given by updating the subprocessor page and by email to Customers who ask to be notified. Customer may object on reasonable data-protection grounds within that period. The parties will then discuss the objection in good faith; if it cannot be resolved, Customer may terminate the affected Service and receive a refund of fees prepaid for the period after termination.

8. Assistance and breaches

Requests from individuals

If Kultarr. receives a request from an individual about Customer Data, it will refer the individual to Customer and will not respond itself unless Customer instructs it to or the law requires it. Kultarr. will provide reasonable assistance, taking into account the nature of the processing, to help Customer respond.

Personal data breaches

Kultarr. will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide the information Customer reasonably needs to meet its own obligations, as it becomes available.

Assessments

Kultarr. will provide reasonable information to help Customer carry out data-protection impact assessments and any prior consultation with a supervisory authority concerning the Service.

9. Return and deletion

On request, Kultarr. will export available Customer Data during the term. After termination, Customer may request an export of available Customer Data for up to 30 days. After that period, Customer Data is deleted in accordance with the Privacy Policy and this DPA, except where applicable law requires retention. Copies in encrypted backups are deleted as those backups expire, within 35 days after deletion from the live Service.

Self-service workspace deletion is not yet available in the Service. Deletion is carried out by the operator on request, removing all of the workspace’s data in one operation and checking that nothing remains.

10. Information and audits

Kultarr. will make available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires, and will allow for and contribute to audits by Customer or an independent auditor it appoints, on reasonable notice, no more than once in any twelve months unless a supervisory authority requires it or a personal data breach has occurred. Audits are at Customer’s cost and subject to confidentiality.

Kultarr. holds no ISO 27001 certification, SOC 2 report or other third-party security certification, and does not claim to be certified as compliant with the GDPR, the CCPA or any other framework. Where a safeguard is described, it is implemented in the Service; it has not been attested by an independent auditor.

11. International transfers

Customer Data is transferred only by the routes listed in Annex 3, each on the mechanism stated there. Kultarr. will not add a route without updating Annex 3 and, where it involves a new subprocessor, following section 7.

Where the law that applies to Customer requires a transfer mechanism that Annex 3 does not already provide (for example, Standard Contractual Clauses between Customer and Kultarr. for an onward transfer out of the EEA), the parties will rely on the mechanism that law recognizes, completed for the relevant module and attached to this DPA or an order form.

12. Contact

Operator

Ofir Benav

Postal address

Ofir Benav, Bernstein 29, Rishon LeZion, Israel

Notices under this DPA

ofirbe@kultarr.io

Annex 1. Subprocessors

The current list, which governs if it differs, is at /subprocessors.

Annex 2. Technical and organizational measures

These measures are implemented in the Service and its infrastructure definition. None is attested by an independent auditor.

• Encryption in transit: HTTPS only, with TLS 1.2 or later at the load balancer and HTTP Strict Transport Security.
• Encryption at rest: the database, its backups, application logs and stored secrets are encrypted with AWS KMS keys.
• Customer access keys: stored only in AWS Secrets Manager under a KMS key dedicated to customer credentials; never shown again; no retrieval endpoint; deleted, with a seven-day recovery window, when replaced or disconnected.
• Least-privilege cloud access: collection uses a customer-created role with a unique ExternalId and read permissions only, enforced by a build test. The Service makes no changes in Customer’s cloud accounts; remediation is delivered as proposed changes and pull requests for Customer to review.
• Tenant isolation: enforced in application queries and by PostgreSQL row-level security.
• Authentication: Argon2id password hashing; time-based multi-factor authentication; rate-limited sign-in; session expiry and invalidation on sign-out.
• Authorization: role-based access control enforced on the server.
• Logging: an append-only audit log of security-relevant actions; credentials and secrets redacted from application logs.
• Network: the application runs in private subnets behind a load balancer with a web application firewall; outbound requests to configurable destinations are restricted to public HTTPS addresses.
• Resilience: automated, encrypted database backups kept for 30 days, and deletion protection on the production database.

Annex 3. Transfer routes and mechanisms

Version

This is version 2026-10-06 of the DPA. It is read with the Privacy Policy (/privacy) and the Terms of Service (/terms).