Data Processing Addendum

Effective date: 2026-02-23

Parties and Roles

This Data Processing Addendum ("DPA") supplements the Terms of Service between the Customer and Sterile Networks (operated by SaaStack LLC). For purposes of the GDPR and similar data protection laws, Customer is the Controller (or an entity acting on behalf of a Controller) and Sterile Networks is the Processor.

1. Scope and Purpose

Sterile Networks will process personal data on Customer's behalf only to perform the Services described in the Agreement, including DDoS mitigation via GRE tunnels, BGP anycast routing, traffic scrubbing, analytics dashboarding, billing support, and related support activities.

2. Categories of Data Processed

Personal data categories that may be processed in connection with the Services include:

• Account & billing identifiers (name, email, company, billing address, VAT/tax id, payment references)
• Authentication & security metadata (login timestamps, sign-in IPs, 2FA status)
• Network traffic metadata and logs (source/destination IPs, packet headers, protocol/port info, timestamps, metric deltas)
• Support and communications content (tickets, attachments, messages)
• Analytics and product telemetry (usage events, dashboard metrics)
• Any other Customer Data the Customer elects to transmit to the Services

3. Data Subjects

Data subjects include Customer personnel (administrators, users), end users of the Customer’s services whose traffic is routed through Sterile, and other contacts provided by the Customer.

4. Processing Instructions

Sterile Networks will process Customer Data only on the Customer’s documented instructions as set out in the Agreement and this DPA. Any additional processing will require prior written instruction and written agreement.

5. Duration

Processing will continue for the term of the Agreement and for any additional short retention periods as required by law or to meet legitimate operational needs described in the Agreement.

6. Sub-processors

Sterile maintains a list of sub-processors and will provide notice of additions or changes per the Sub-processors page. Sterile will enter written agreements with sub-processors requiring them to meet data protection obligations consistent with this DPA and remains responsible for their acts and omissions.

7. Security Measures

Sterile implements appropriate technical and organizational measures proportionate to the risks, including:

• Encryption of databases and stored logs (encryption at rest)
• Access controls and authenticated access to management interfaces
• Mandatory multi-factor authentication (MFA/2FA) for internal accounts with sensitive access
• Logging and monitoring of administrative access and security events
• Regular security reviews and incident response procedures

Note: GRE traffic between Customer infrastructure and Sterile is not re-encrypted by Sterile; Sterile does not terminate TLS as a standard product behavior.

8. Incident Response and Breach Notification

Sterile will notify the Customer without undue delay after confirming a personal-data security incident affecting Customer Data. Sterile’s internal target for notifying Customers is within 14 days of discovery; the Customer and Sterile agree to cooperate in incident investigation and remediation.

9. Assistance with Data Subject Rights

Taking into account the nature of the processing, Sterile will provide reasonable assistance to Customers to respond to Data Subject requests (access, correction, deletion, portability, objection) insofar as those requests relate to processing performed by Sterile.

10. International Transfers

Where transfers of Personal Data occur across borders, Sterile will implement appropriate safeguards required by applicable law (e.g., SCCs or other lawful transfer mechanisms).

11. Return or Deletion of Data

Upon termination or expiration of the Agreement, Sterile will, at the Customer’s choice, return or delete Customer Data, subject to any legal obligations to retain data. Sterile will delete network logs and related volatile telemetry in line with published retention policies (typically up to 30 days for network logs).

12. Audit Rights

Upon reasonable request and subject to confidentiality protections, Sterile will provide information reasonably necessary to demonstrate compliance with this DPA. Customers requiring on-site audits must request them with reasonable notice and may be subject to mutual non-disclosure terms.

13. Liability

Liability related to processing under this DPA is governed by the liability provisions in the Parties’ Agreement, subject to applicable mandatory laws.

14. Governing Law

This DPA is governed by the governing-law and jurisdiction provisions in the Parties’ Agreement.

15. Contact

For DPA and privacy matters: support@sterile.network