Data processing addendum

You act as the controller and Fortify Core acts as the processor for personal data contained in account records, audit metadata and infrastructure plan output that you choose to route through the platform. We process that data only to provide the service, to secure it, and to comply with law.

Account identity data (name, work email, organisation, authentication identifiers), usage and audit metadata (scan schedules, drift records, actions taken), and technical data present in Terraform plan output. Fortify Core does not require special categories of personal data and asks customers not to submit them.

Encryption in transit with TLS 1.3 and at rest with AES-256-GCM; least-privilege access with mandatory multi-factor authentication for staff; segregated production environments; automated secret redaction on ingest of plan output; logging of all administrative access; annual penetration testing and continuous dependency scanning.

We engage the providers listed on the sub-processors page under written terms no less protective than this addendum, and we remain responsible for their performance. Customers on annual agreements receive 30 days' notice of additions.

Where personal data is transferred outside the EEA or UK, transfers are made under the European Commission's standard contractual clauses together with the UK international data transfer addendum, supported by a transfer impact assessment available on request. EU data residency is available on the Enterprise plan.

We assist you in responding to access, correction, deletion, restriction and portability requests, and in carrying out data protection impact assessments and prior consultations, taking into account the nature of the processing and the information available to us.

We notify you without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting your data, with the information reasonably available at the time and updates as the investigation progresses.

Drift records are retained according to your plan's retention setting. On termination we delete or return customer data within 30 days, except where retention is required by law, and purge encrypted backups within a further 60 days.

On request and no more than once per year, we provide our current third-party audit report and complete a reasonable security questionnaire. On-site audits are available to Enterprise customers subject to confidentiality and reasonable notice.

Data protection enquiries: privacy@fortifycore.io