Version 1.0 | Last Updated: 09.22.2026
This Data Processing Addendum (this “DPA”) is part of the Agreement between Discern and Customer described in the Discern Security Master Subscription Terms at https://www.discernsecurity.com/terms-of-service (the “Terms”). This DPA applies to the extent Discern Processes Personal Data contained in Customer Data on Customer’s behalf in providing the Service. For data-protection matters, this DPA controls over the Terms, as stated in Section 18.10 of the Terms. Capitalized terms used and not defined in this DPA have the meanings given in the Terms.
1.1 “Data Protection Laws” means the laws that apply to the Processing of Personal Data under the Agreement, including, as applicable, the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as retained in United Kingdom law (“UK GDPR”), the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), and other US state privacy laws.
1.2 “Personal Data” means information contained in Customer Data that relates to an identified or identifiable natural person or that is otherwise regulated as personal data or personal information under Data Protection Laws.
1.3 “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data Processed by Discern.
1.4 “Process” and “Processing” mean any operation performed on Personal Data, such as collection, storage, use, disclosure, or deletion.
1.5 “SCCs” means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Decision (EU) 2021/914, as incorporated under Section 8.
1.6 “Sub-processor” means a third party engaged by Discern to Process Personal Data on Customer’s behalf, including hosting providers and foundation-model providers.
1.7 “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0), as incorporated under Section 8.
2.1 Roles. Customer is the controller of the Personal Data (or, where Customer acts on behalf of its own controllers, a processor), and Discern is Customer’s processor. Under the CCPA, Discern is a service provider and Customer is the business. Annex 1 describes the subject matter, duration, nature and purpose of the Processing, the types of Personal Data, and the categories of data subjects.
2.2 Instructions. Discern shall Process Personal Data only on Customer’s documented instructions, including to provide the Service under the Agreement, as configured by Customer in the Service, and as required by law (in which case Discern shall inform Customer of the legal requirement before Processing unless the law prohibits it). The Agreement and Customer’s configurations are Customer’s complete instructions. Discern shall inform Customer if, in Discern’s opinion, an instruction infringes Data Protection Laws.
2.3 No Training; No Sale. Discern shall not (a) use Personal Data to train, fine-tune, or improve any artificial intelligence or machine learning model, except through Aggregated Data as permitted by Section 6.3 of the Terms; (b) sell or share Personal Data within the meaning of the CCPA; (c) retain, use, or disclose Personal Data outside the direct business relationship with Customer or for any purpose other than providing the Service and as permitted by Data Protection Laws; or (d) combine Personal Data with personal information Discern receives from other sources, except to provide the Service. Discern certifies that it understands and will comply with the restrictions in this Section 2.3. Discern shall notify Customer if it determines that it can no longer meet its obligations under Data Protection Laws.
2.4 Customer Responsibilities. Customer is responsible for the lawfulness of the Personal Data it makes available to the Service, including providing any required notices and obtaining any required consents from data subjects, and for configuring the Service and its Connected Systems in a way that complies with the Data Protection Laws that apply to Customer.
3.1 Discern shall ensure that each person it authorizes to Process Personal Data is bound by a duty of confidentiality and Processes Personal Data only as needed to provide the Service.
4.1 Measures. Discern shall implement and maintain the technical and organizational measures described in Annex 2, which include encryption of Personal Data in transit and at rest, access controls, tenant isolation, monitoring, vulnerability management, and personnel training. Discern shall maintain certifications or attestations at least as protective as SOC 2 Type II and ISO 27001 during each Subscription Term. Discern may update the measures from time to time, provided no update materially reduces the overall protection of Personal Data.
5.1 Authorization; Customer generally authorizes Discern to engage Sub-processors. Discern shall maintain a current list of Sub-processors, including their functions and locations, and shall offer a mechanism for Customer to subscribe to notice of changes.
5.2 Flow-Down; Liability. Discern shall impose on each Sub-processor, by written contract, data-protection obligations no less protective than those in this DPA, including, for each foundation-model provider, that it not use Personal Data to train its models and not retain Personal Data beyond what is needed to process the request. Discern remains responsible for each Sub-processor’s performance.
6.1 Data Subject Requests. Taking into account the nature of the Processing, Discern shall assist Customer by appropriate technical and organizational measures in fulfilling Customer’s obligation to respond to data subject requests (access, correction, deletion, portability, objection, restriction, and opt-out rights). If a data subject contacts Discern directly about Personal Data Processed for Customer, Discern shall direct the data subject to Customer and shall not respond substantively except as required by law.
6.2 DPIAs; Consultations. Discern shall provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities, to the extent required of Customer by Data Protection Laws and related to the Service, taking into account the information available to Discern.
7.1 Notice. Discern shall notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach. Section 7.3 of the Terms governs the content of the notice, and Discern shall supplement the notice as more information becomes available.
7.2 Response. Discern shall investigate, mitigate, and remediate the Personal Data Breach, shall cooperate with Customer’s reasonable requests for information, and shall not publicly refer to Customer in connection with the Personal Data Breach without Customer’s consent, except as required by law. Customer is responsible for any notices to data subjects or regulators that Data Protection Laws require of Customer. Discern’s notice of a Personal Data Breach is not an admission of fault.
8.1 Transfer Mechanisms. Where Data Protection Laws require a transfer mechanism for Personal Data transferred to Discern in the United States or another third country: (a) the SCCs, Module Two (controller to processor) and, where Customer is a processor, Module Three (processor to processor), are incorporated into this DPA; (b) for transfers subject to the UK GDPR, the UK Addendum applies the SCCs as modified for the UK; and (c) for transfers subject to Swiss law, the SCCs apply with the adaptations required by the Swiss data protection authority.
8.2 SCC Elections. For the SCCs: the optional docking clause in Clause 7 is included; in Clause 9, Option 2 (general written authorization) applies with the notice period in Section 5.2; the optional language in Clause 11 is not included; under Clause 17, the SCCs are governed by the law of Ireland; under Clause 18, disputes are resolved in the courts of Ireland; Annex I and Annex II of the SCCs are completed by Annex 1 and Annex 2 of this DPA. If the SCCs conflict with this DPA or the Terms, the SCCs control for the transfers they govern.
9.1 Reports. Discern shall make available to Customer, on request and under confidentiality, its then-current SOC 2 Type II report, ISO 27001 certificate, and responses to a standard security questionnaire. These reports and this DPA are Discern’s primary means of demonstrating compliance.
9.2 Audits. To the extent Data Protection Laws grant Customer an audit right that the materials in Section 9.1 do not satisfy, Discern shall allow an audit by Customer or its independent auditor, limited to the information and facilities relevant to the Processing of Customer’s Personal Data, no more than once in any 12-month period, on at least [30] days’ notice, during business hours, under confidentiality, and without access to any other customer’s data or to information that would compromise Discern’s security. Each party bears its own audit costs.
10.1 Section 9.4 of the Terms governs the export, return, and deletion of Customer Data, including Personal Data, on expiration or termination. On Customer’s request, Discern shall confirm deletion in writing. Discern may retain Personal Data to the extent required by law, and any retained Personal Data remains subject to this DPA.
11.1 Liability. Liability arising out of or relating to this DPA is subject to Section 15 of the Terms, including the cap in Section 15.3(a).
11.2 Term. This DPA applies for as long as Discern Processes Personal Data under the Agreement.
11.3 Updates. Section 17 of the Terms governs updates to this DPA, except that Discern may also update this DPA as needed to comply with Data Protection Laws. Discern shall post each updated version at https://www.discernsecurity.com/data-processing-addendum with a new version number and “Last Updated” date and shall maintain an archive of prior versions.
Annex 1 — Description of Processing
Subject matter and nature: hosting and Processing of Customer Data to provide the Service described in the Agreement, including security posture assessment, risk scoring, dashboards, reporting, and Automated Actions authorized by Customer.
Duration: the term of the Agreement, plus the export and deletion periods in Section 9.4 of the Terms.
Purpose: providing, securing, supporting, and maintaining the Service.
Categories of data subjects: Customer’s employees, contractors, and other users whose identities, devices, accounts, or activity appear in the Connected Systems that Customer connects to the Service.
Categories of Personal Data: user identifiers and business contact details (such as names, email addresses, and usernames); device and asset identifiers and configurations; authentication, access, and directory data; security event and alert data; and support communications.
Special categories: none intended. Customer shall not use the Service to Process special categories of Personal Data except as permitted by Section 6.6 of the Terms.
Frequency: continuous, for the duration of the Agreement.
Competent supervisory authority (SCCs): determined under Clause 13 of the SCCs based on Customer’s establishment.
Annex 2 — Technical and Organizational Measures
Discern maintains an information security program aligned to SOC 2 Type II and ISO 27001, including: encryption of Customer Data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent); logical tenant isolation; role-based access controls with multi-factor authentication and least-privilege administration; secure credential and token storage for Connected Systems; logging and monitoring of production systems; vulnerability management, including periodic penetration testing; secure software development practices; personnel security, including background checks where permitted by law and security training; business continuity and disaster recovery procedures; incident response procedures; and vendor security review of Sub-processors. Further detail is available in Discern’s security documentation at [URL].
Annex 3 — Sub-processors
The current list of Sub-processors, including their functions and locations, is maintained at [URL]. As of the Last Updated date, the Sub-processors include: [hosting provider]; [foundation-model provider(s)]; [support and analytics providers].
