Data processing

1. Application and incorporation

This Data Processing Addendum ("DPA") is between the contracting SwiftSafe Entity under the Terms of Service ("SwiftSafe", "we", "us", "our") and the Customer that has accepted the Terms of Service or signed an Order Form for Prava AI. The contracting SwiftSafe Entity is named in the Order Form. It is:

• SwiftSafe LLC, a limited liability company registered in Wyoming, USA, for Customers based in the Americas (the United States, Canada, Mexico, Central and South America, and the Caribbean); or
• SwiftSafe Cybersecurity Technologies India Pvt Ltd, a private limited company incorporated in India under the Companies Act, 2013, for all other Customers, including those in India.

This DPA is incorporated into the Terms of Service and applies automatically, without separate signature, whenever SwiftSafe processes Personal Data on the Customer's behalf in providing the Platform and the Services. A separately signed data processing agreement replaces this DPA to the extent it covers the same subject matter. Read this DPA with the Privacy Policy, the AI and Data Use Policy, the Acceptable Use Policy and the Module Terms, all available in the Legal centre.

2. Definitions

Capitalised terms have the meaning given in the Terms of Service unless defined here. In this DPA:

• "Data Protection Law" means all Applicable Law on the processing of Personal Data, including the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, "DPDP"), the Information Technology Act, 2000 and rules under it to the extent still applicable, the EU General Data Protection Regulation ("EU GDPR"), the UK GDPR and Data Protection Act 2018 ("UK GDPR"), and US state privacy laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), each where applicable.
• "Data Fiduciary", "Data Processor" and "Data Principal" have the meanings given in DPDP and include, respectively, a "controller" or "business", a "processor" or "service provider", and a "data subject" or "consumer" under other Data Protection Law.
• "Customer Personal Data" means Personal Data in Customer Data or Telemetry that SwiftSafe processes on the Customer's behalf.
• "Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data in the possession or control of SwiftSafe or its Sub-processors. It excludes unsuccessful attempts, such as blocked log-ins or port scans.
• "Sub-processor" means a third party, or an Affiliate of SwiftSafe including the other SwiftSafe Entity, engaged by SwiftSafe that processes Customer Personal Data in providing the Services.
• "Other SwiftSafe Entity" means whichever of SwiftSafe LLC and SwiftSafe Cybersecurity Technologies India Pvt Ltd is not the contracting SwiftSafe Entity.
• "Board" means the Data Protection Board of India.
• "CERT-In Directions" means the directions of the Indian Computer Emergency Response Team dated 28 April 2022 under section 70B(6) of the Information Technology Act, 2000, as amended.
• "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914, and "UK IDTA" means the UK International Data Transfer Agreement or the International Data Transfer Addendum to the SCCs, each as amended or replaced.

3. Roles of the parties

3.1 Customer as Data Fiduciary, SwiftSafe as Data Processor

For Customer Personal Data, the Customer is the Data Fiduciary (or controller) and SwiftSafe, meaning the contracting SwiftSafe Entity, is the Data Processor (or processor). The Customer decides which assets, users, mailboxes, devices and environments are in scope, which Modules are enabled and how they are configured. SwiftSafe processes Customer Personal Data only to provide the Services, on the Customer's instructions under section 4. Where the Customer is itself a processor, it warrants that its Data Fiduciary has authorised its instructions and SwiftSafe's appointment.

3.2 Where SwiftSafe acts independently

SwiftSafe is an independent Data Fiduciary (or controller), not the Customer's processor, for the following, which are described in the Privacy Policy:

• account, contact and authentication data of Authorised Users and Customer representatives;
• billing, payment, tax and contract records;
• website, marketing and support-interaction data; and
• usage analytics and Service Data used to operate, secure, maintain and improve the Platform.

3.3 Model improvement

By accepting the Terms of Service, the Customer agrees that SwiftSafe may use Customer Data, Telemetry, Service Data and Outputs to research, develop, train, fine-tune, evaluate and red-team the Prava AI models, as described in the AI and Data Use Policy. This is SwiftSafe's own purpose, not processing on the Customer's behalf. For this use SwiftSafe determines the purpose and means of processing, acts as an independent Data Fiduciary (or controller), and is responsible for its own compliance with Data Protection Law. SwiftSafe will apply the safeguards in that policy, in particular:

• data is de-identified, pseudonymised or aggregated wherever reasonably possible, and secrets, credentials and tokens are removed;
• training and fine-tuning on the Customer's data take place only in data centres in the Customer's region;
• only non-personal security artefacts, such as malware hashes, indicators of compromise, detection signatures and malicious infrastructure, once stripped of any Personal Data and Customer Confidential Information, and anonymised, aggregated model parameters or weights, may be used across regions and across SwiftSafe's customer base for collective defence;
• Customer Confidential Information, and Personal Data in identifiable form, is never disclosed to other customers; and
• access to training datasets is limited to authorised personnel with a need to know.

The Customer may restrict or opt out of this use in an Order Form or signed DPA. An opt-out does not affect processing to deliver, secure and support the Services, or the use of security artefacts for collective defence unless the Order Form says otherwise. The Customer must cover this use in its notices to Data Principals under section 6.

4. Customer instructions

SwiftSafe will process Customer Personal Data only on the Customer's documented instructions. At the effective date, the Customer's complete instructions are to process Customer Personal Data:

• to provide, maintain, secure and support the Platform and the enabled Modules under the Terms of Service, the Module Terms and any Order Form;
• as initiated by Authorised Users through the Platform, including assistant queries, policy and playbook configuration, and approval of response actions;
• within scoped engagements such as penetration testing or digital forensics and incident response (DFIR), as set out in the written authorisation, statement of work or rules of engagement; and
• as otherwise reasonably instructed in writing, consistent with the Terms of Service.

SwiftSafe may also process Customer Personal Data where Applicable Law requires, and will tell the Customer first unless the law prohibits it. SwiftSafe will promptly inform the Customer if it considers an instruction infringes Data Protection Law, and need not follow an instruction it reasonably believes is unlawful.

5. Details of processing

5.1 Subject matter

Processing of Customer Personal Data to provide the Prava AI Platform, Modules and professional services ordered by the Customer, including monitoring, detection, investigation, response, testing, threat intelligence, compliance management and AI-assisted analysis.

5.2 Duration

The term of the subscription and any scoped engagement, plus the export and deletion period in section 14, plus any retention period required by Applicable Law, including the 180-day log retention requirement of the CERT-In Directions where it applies.

5.3 Nature and purpose

Collection, storage, structuring, analysis, enrichment, correlation, retrieval, disclosure to the Customer, restriction and erasure of Customer Personal Data, continuously and in real time, in order to:

• analyse endpoint, server, application, cloud, network, IoT/OT and email Telemetry for threats, vulnerabilities, misconfigurations and policy violations;
• take response actions the Customer has configured or approved, such as isolating hosts, terminating processes, quarantining files and blocking messages;
• carry out authorised penetration testing and attack-surface discovery within agreed scope;
• correlate threat intelligence, including dark-web sources, with the Customer's assets, domains and identities;
• analyse malware, detonate samples in a sandbox and generate detection rules;
• collect, preserve and analyse evidence and support incident reporting;
• monitor controls, generate Outputs through the Prava AI assistant, and provide support.

5.4 Categories of Data Principals

• the Customer's employees, contractors and other workforce members, and Authorised Users;
• the Customer's customers and end users, and senders and recipients of email analysed by the phishing defence Module;
• individuals named in leaked datasets, credential dumps or threat-actor communications found through threat intelligence;
• suspected threat actors and others whose activity appears in Telemetry or evidence; and
• any other individuals whose Personal Data the Customer brings into scope.

5.5 Categories of Personal Data

• identifiers such as names, usernames, employee IDs, email addresses, phone numbers and account IDs;
• device and network data such as hostnames, IP and MAC addresses, device identifiers and software inventory;
• activity and log data such as authentication events, processes, command lines, file access, network connections, DNS queries, browsing records and application and API logs;
• email and message data such as headers, senders, recipients, subjects, bodies, links and attachments;
• credentials and secrets appearing in Telemetry or leaked data, such as passwords, hashes and tokens;
• forensic data such as disk images, memory captures and cloud audit logs;
• approximate location inferred from IP addresses, and prompts submitted to the Prava AI assistant.

5.6 Special or sensitive categories

SwiftSafe does not require special categories of Personal Data or sensitive personal data, and the Customer should not configure the Services to collect them deliberately. Because the Services inspect Telemetry, email, files, forensic images and leaked datasets, such data may incidentally appear, including health, financial, biometric, password, sexual orientation, religious or political belief, trade union, children's and criminal offence data. SwiftSafe protects such data in the same way as all Customer Personal Data, processes it only as needed to provide the Services, and does not intentionally use it in identifiable form for model improvement. The Customer is responsible for configuring scope, exclusions and content-capture settings to minimise such collection, and for any additional legal basis or notice it needs.

5.7 Location

Customer Data, Telemetry and Customer Personal Data are stored and processed only in data centres in the Customer's selected or home region, which is set at onboarding or in the Order Form, as described in section 10.

6. Customer obligations

The Customer is responsible for:

• the lawfulness of its instructions and of the Customer Personal Data it brings into scope;
• giving clear and specific notices to, and obtaining any required consents from, the employees, contractors, end users and other Data Principals whose devices, accounts, email or activity the Platform monitors, including for workplace monitoring and for the uses in the AI and Data Use Policy;
• having a valid legal basis under DPDP, such as consent or a legitimate use under section 7, and under any other Data Protection Law;
• handling its Data Principals' requests and grievances, including withdrawal of consent, and updating its instructions to SwiftSafe accordingly;
• configuring the Services appropriately, including user access, scope, exclusions and approval workflows for autonomous actions; and
• its own regulatory reporting, including to CERT-In, the Board and sectoral regulators.

Withdrawal of consent by a Data Principal does not affect processing that was lawful before withdrawal, but may mean that some Services can no longer be provided for that individual's devices or accounts.

7. Confidentiality of personnel

SwiftSafe will ensure that everyone it authorises to process Customer Personal Data, including employees, contractors and responders, is bound by a written or statutory duty of confidentiality that continues after their engagement ends, is trained in data protection and information security, and has access only to the data needed for their role.

8. Security measures

8.1 General commitment

SwiftSafe will maintain appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the cost of implementation, the nature, scope, context and purposes of processing, and the risks to Data Principals. These measures are intended to be reasonable security safeguards under section 8(5) of DPDP and reasonable security practices under section 43A of the Information Technology Act, 2000.

SwiftSafe does not currently hold formal certifications or third-party attestations. Its controls are designed to align with recognised frameworks, as described on the Compliance page, where any certification will be listed when it is issued. Support for frameworks such as ISO/IEC 27001 in the compliance Module is not a certification claim.

8.2 Annex: technical and organisational measures

• Encryption in transit: data moving between Agents, Customer systems, the Platform and Sub-processors is encrypted using current industry-standard protocols such as TLS 1.2 or higher, with mutual authentication for Agents where supported.
• Encryption at rest: Customer Data is encrypted at rest using strong algorithms such as AES-256, with keys held in a key-management service, rotated on a schedule and separated from the data. Customer-managed keys may be agreed in an Order Form.
• Server and application hardening: servers, production workloads and applications are secured and hardened regularly against industry benchmarks, with routine patch management, automated vulnerability scanning and container security.
• Continuous systems and log monitoring: infrastructure, applications and security events are monitored 24/7. System and administrative logs are centralized, protected against tampering, synchronised to NTP time sources and retained for at least 180 days within India where CERT-In Directions require.
• Employee security and access control: role-based access and least privilege for personnel, mandatory multi-factor authentication (MFA) across all production and administrative consoles, background screening where permitted, and continuous privacy and security training.
• Third-party and supply-chain governance: formal security and compliance due diligence on all Sub-processors, cloud hosting providers and external vendors before onboarding, with ongoing monitoring to secure and strengthen supply-chain integrity.
• Segregation of tenants: each Customer's data is logically separated using tenant identifiers enforced at the application, storage and query layers, with tested controls against cross-tenant access. Dedicated deployment may be agreed in an Order Form.
• Vulnerability management: regular scanning of infrastructure, dependencies and container images, periodic independent penetration testing, risk-based remediation timelines, and a responsible disclosure programme.
• Business continuity and disaster recovery: redundant infrastructure, encrypted backups held separately from primary systems, documented recovery objectives and periodic restoration and failover testing.
• Secure development lifecycle: threat modelling for significant changes, peer code review, static and dynamic security testing, separated development, test and production environments, signed builds and controlled release of Agent updates.
• Evidence chain of custody: forensic evidence is collected by forensically sound methods, hashed on acquisition, recorded in a chain-of-custody log covering every transfer and access, stored encrypted in the Customer's region with restricted access, and preserved or destroyed under the engagement terms and any legal hold.
• AI controls: controls against disclosure of one Customer's data to another through Outputs, automated removal of secrets from model-improvement datasets, and logged, restricted access to training data.

9. Sub-processors

The Customer gives SwiftSafe general authorisation to engage Sub-processors, including SwiftSafe affiliates. Sub-processors that store or process Customer Personal Data do so only in data centres in the Customer's region. The current list, with each Sub-processor's location and function, is at [Sub-processor list]. SwiftSafe will carry out due diligence on each Sub-processor, bind it by written contract to data protection obligations no less protective than this DPA so far as relevant to its service, and remain responsible to the Customer for its performance.

The Other SwiftSafe Entity. The Other SwiftSafe Entity is an Affiliate of SwiftSafe and may act as a Sub-processor, mainly to provide support, and also incident response, engineering and other professional services. It is bound by an intra-group data processing agreement on terms no less protective than this DPA, and by the data residency commitment in section 10: it does not store Customer Personal Data in its own country, and any access it needs is remote access under section 10.2. SwiftSafe remains responsible to the Customer for its performance, and it is shown on the Sub-processor list.

SwiftSafe will give at least 30 days' notice before adding or replacing a Sub-processor, by updating the list and emailing the Customer's account administrator or subscribed contacts. The Customer may object on reasonable data protection grounds by writing to privacy@prava.dev within that period. The parties will discuss the objection in good faith, and SwiftSafe may offer an alternative such as not using that Sub-processor for the Customer's data. If no solution is agreed within 30 days of the objection, the Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees for the unused period.

10. Data residency and international transfers

10.1 Local data centres and zero foreign storage

SwiftSafe stores and processes each Customer's data, including Customer Data, Telemetry and Customer Personal Data, only in local data centres within the Customer's own country or region, without storing your data in foreign countries. The Customer's region is its selected or home region, set at onboarding or in the Order Form, and is not changed without the Customer's written agreement. This strict local residency applies to real-time processing, storage, backups, Sub-processor processing, and model training and fine-tuning on the Customer's data.

The only data used across regions is: non-personal security artefacts, such as malware hashes, indicators of compromise, detection signatures and malicious infrastructure, after they have been stripped of any Personal Data and Customer Confidential Information; and anonymised, aggregated model parameters or weights. These are not Customer Personal Data.

10.2 Remote access and India

Authorised personnel of SwiftSafe or the Other SwiftSafe Entity may need to access Customer data remotely from outside the Customer's region, for example from India or the United States, to provide support or incident response. The location of the contracting SwiftSafe Entity does not change where Customer data is stored or processed. Such access is limited to what the task needs, logged, and does not involve moving the data's storage out of region. To the extent it is a transfer under Data Protection Law, sections 10.3 and 10.4 apply. For data subject to DPDP, any processing outside India will be only as permitted by section 16 of DPDP and the DPDP Rules, 2025, never to a country or territory restricted by Central Government notification, and subject to stricter sectoral requirements the Customer notifies to SwiftSafe, such as Reserve Bank of India data localisation directions. SwiftSafe's own system logs that the CERT-In Directions require to be kept in India are kept in India.

10.3 EU, EEA and Switzerland

Where Customer Personal Data subject to the EU GDPR is accessed from or transferred to a country without an adequacy decision, including India, the SCCs are incorporated into this DPA: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor. The Customer is the data exporter and SwiftSafe the data importer. Clause 7 (docking) applies; Clause 9(a) Option 2 applies with the notice period in section 9; the optional wording in Clause 11 does not apply; Clauses 17 and 18 refer to Ireland unless the Order Form names another Member State; and Annexes I and II are completed by section 5 and section 8. The competent supervisory authority is that of the Customer's establishment or EU representative.

10.4 United Kingdom

Where Customer Personal Data subject to the UK GDPR is accessed from or transferred to a third country, the UK IDTA (in its form as an addendum to the SCCs) is incorporated, with its tables completed by reference to section 10.3 and this DPA. If the SCCs or UK IDTA conflict with this DPA, they prevail.

11. Assistance with rights requests and impact assessments

11.1 Rights requests

Taking into account the nature of the processing, SwiftSafe will give reasonable assistance, including through self-service features, to help the Customer respond to Data Principals exercising their rights under Data Protection Law. Under DPDP these include access, correction, erasure, withdrawal of consent, nomination and grievance redressal. If SwiftSafe receives such a request about Customer Personal Data directly, it will promptly forward it to the Customer where the Customer can be identified, and will not otherwise respond unless the Customer authorises it or the law requires. Requests about data for which SwiftSafe is an independent Data Fiduciary are handled under the Privacy Policy by our Grievance Officer at grievance@prava.dev.

11.2 Impact assessments

SwiftSafe will give reasonable information and assistance for the Customer's data protection impact assessments, transfer impact assessments, any assessments required of a Significant Data Fiduciary under section 10 of DPDP, and any prior consultation with a regulator, so far as they relate to SwiftSafe's processing and the information is not otherwise available to the Customer.

12. Personal Data Breach notification

12.1 Notice to the Customer

SwiftSafe will notify the Customer of a Personal Data Breach without undue delay, and in any event within 24 to 48 hours after confirming it. Where SwiftSafe reasonably suspects a breach that may affect the Customer's ability to meet a shorter regulatory deadline, it will give an early warning before confirmation is complete. Notice will go to the Customer's security and administrative contacts and may also be given in the Platform. It will describe, so far as then known, the nature of the breach, the categories and approximate number of Data Principals and records affected, the likely consequences, the measures taken or proposed, and a contact point.

12.2 Cooperation for CERT-In and Board reporting

The Customer, as Data Fiduciary, is responsible for informing the Board and affected Data Principals under DPDP, for reporting cyber security incidents to CERT-In within 6 hours of noticing them where the CERT-In Directions apply, and for notifying other regulators. So that the Customer can meet these deadlines, SwiftSafe will:

• share information needed for an initial report as soon as it is known, without waiting for its investigation to finish;
• provide relevant logs, indicators and timelines with accurate, synchronised time stamps;
• support follow-up and detailed reports, including root cause and remedial steps; and
• name a point of contact for the duration of the response.

SwiftSafe will make any reports it must make itself under Applicable Law, including, where they apply, under the CERT-In Directions. Unless the law requires, it will not notify regulators or Data Principals about a breach of Customer Personal Data without first consulting the Customer. Notification is not an admission of fault or liability.

12.3 Detections in the Customer's environment

Alerts and incidents the Platform detects in the Customer's own environment are part of the Services and are not Personal Data Breaches of SwiftSafe. The Customer decides whether they are reportable, and SwiftSafe's DFIR Module can support that assessment where ordered.

13. Audits

SwiftSafe will make available the information reasonably necessary to demonstrate compliance with this DPA. The Customer will first rely on reports: any third-party audit reports or attestations SwiftSafe holds at the time (listed on the Compliance page), security documentation, summaries of independent penetration tests, and answers to a reasonable security questionnaire not more than once a year, all under confidentiality terms.

If that information is insufficient, or a regulator with authority over the Customer requires it, the Customer may conduct an on-site or remote audit:

• no more than once in any 12-month period, except where a regulator requires it or after a Personal Data Breach affecting the Customer;
• on at least 30 days' written notice, with scope and plan agreed in advance;
• during business hours, without unreasonable disruption, and without access to other customers' data or privileged or third-party confidential information;
• by the Customer or an independent auditor that is not a SwiftSafe competitor and is bound by confidentiality; and
• at the Customer's cost, including reasonable charges for SwiftSafe personnel time, unless the audit reveals a material breach of this DPA by SwiftSafe.

Audit results are Confidential Information of both parties. Where the SCCs apply, the Customer agrees that their audit rights will be exercised in this way.

14. Return and deletion

After the Services end, the Customer may export Customer Data through the Platform or by request to privacy@prava.dev for 30 days (the "export window"), during which SwiftSafe continues to protect it but provides no monitoring. Forensic evidence from a DFIR engagement is returned or destroyed as the engagement terms provide. After the export window, SwiftSafe will delete Customer Personal Data from active systems within 30 days, and from backups within its backup cycle, not exceeding 90 days, and will confirm deletion in writing on request.

These obligations do not apply to:

• data SwiftSafe must keep under Applicable Law, such as logs required by the CERT-In Directions, tax and accounting records, and data under legal hold;
• data needed to establish, exercise or defend legal claims;
• data for which SwiftSafe is an independent Data Fiduciary under section 3.2; and
• de-identified or aggregated data that is no longer Personal Data, model parameters that contain no recoverable Customer Personal Data, and non-personal security artefacts kept for collective defence, as described in the AI and Data Use Policy.

15. Liability

Each party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability in the Terms of Service, which apply to the Terms of Service and this DPA together as a single aggregate. This does not limit either party's liability to Data Principals under the SCCs or UK IDTA, or any liability that cannot be limited under Applicable Law. Regulatory penalties are allocated as the Terms of Service provide.

16. GDPR and CCPA terms

16.1 EU and UK GDPR

Where the EU GDPR or UK GDPR applies to SwiftSafe as processor, this DPA is intended to meet Article 28(3). SwiftSafe will process Customer Personal Data only on documented instructions, including on international transfers, and will apply the confidentiality, security, sub-processor, assistance, breach, deletion and audit terms of this DPA. Where SwiftSafe uses such data for model improvement under section 3.3, it acts as an independent controller relying on its legitimate interests in improving the security and accuracy of the Platform and in collective defence, applies the safeguards in the AI and Data Use Policy, and will honour objections and opt-outs. The Customer will include this use in the information it gives Data Principals under Articles 13 and 14, or exercise the opt-out if it cannot.

16.2 CCPA and US state privacy laws

Where the CCPA or a similar law applies, SwiftSafe is a "service provider" or "processor", and the Customer discloses Customer Personal Data for the business purposes in section 5.3. SwiftSafe will not sell or share it (as defined in the CCPA); will not retain, use or disclose it for any other purpose, or outside the direct business relationship with the Customer, except as the CCPA regulations permit service providers; and will not combine it with personal information from other sources except as those regulations permit, such as for security and fraud prevention. Use for improving the Platform, including model improvement, is limited to what the CCPA regulations permit service providers, and SwiftSafe will not use the data to build or modify profiles for another business. SwiftSafe will provide the level of privacy protection the CCPA requires, notify the Customer if it can no longer meet these obligations, and allow the Customer to take reasonable steps to stop and remediate unauthorised use. SwiftSafe certifies that it understands and will comply with these restrictions.

17. Term, precedence and contact

This DPA applies for as long as SwiftSafe processes Customer Personal Data and survives termination of the Terms of Service to that extent. If documents conflict, the order of precedence is: the SCCs or UK IDTA where applicable; a signed Order Form or signed data processing agreement that expressly varies this DPA; this DPA; then the Terms of Service. Whichever SwiftSafe Entity is the contracting SwiftSafe Entity, this DPA is governed by the law of India, and disputes are resolved by arbitration under the Arbitration and Conciliation Act, 1996, seated at [Arbitration seat city], as set out in the Terms of Service, except where the SCCs or UK IDTA require otherwise.

SwiftSafe may update this DPA to reflect changes in law or the Services, with at least 30 days' notice of any change that materially reduces protection for Customer Personal Data. Such a change will not apply during a prepaid term unless the law requires.

Contact privacy@prava.dev or legal@prava.dev with questions. Our privacy team can be reached at privacy@prava.dev, and our Grievance Officer at grievance@prava.dev. Report security incidents to security@prava.dev.