DPA & Sub-processors

This page summarizes the Data Processing Addendum (DPA) that applies when Graneth processes personal data on your behalf as a data processor and you, the customer, act as data controller. A signed, full-form DPA is available on request.

For code, findings, and GitHub identity data tied to your organization's repositories, you are the controller and Graneth is the processor. For Graneth's own account and billing records, Graneth is the controller.

Processing covers scanning, storage, and analysis of your connected repositories' code and metadata, for as long as your account remains active, plus any retention period required by law.

Developers and contributors in your organization whose GitHub identity appears in scanned commits, pull requests, or code comments.

GitHub identity (username, email, avatar), source code and diffs, scan findings, and pull-request metadata.

Graneth processes personal data only on documented instructions, keeps it confidential, applies the technical and organizational measures described on the Trust & Security page, notifies you of a personal data breach without undue delay, and deletes or returns data at the end of the engagement on request.

Each sub-processor listed below is bound by data-protection terms consistent with this DPA. We will notify customers of material sub-processor changes where required.

For a signed, full-form DPA, Standard Contractual Clauses, or any data-protection question, use the contact details at the bottom of this page.