Data Processing Addendum
The terms that apply when we process personal data for you: roles, data categories, processor obligations, sub-processors, transfers and technical measures.
1. Scope, parties and roles
This addendum forms part of the Terms of Service (section 9.2) between you and Siva M, sole proprietor trading as Dokimore (registered office: Chennai, Tamil Nadu, India) and applies whenever we process personal data on your behalf in providing the Service.
You are the controller of that personal data, or a processor acting for your own customers; we are your processor. We process the data only to provide the Service as you have configured it and as the Terms describe, and on your documented instructions. If an instruction would in our view breach applicable data-protection law, we tell you before acting on it.
2. Subject matter, duration, nature and purpose
Subject matter: recording browser sessions, running the tests, scans and audits you configure, storing the results and the evidence they produce, and administering your account and workspace.
Duration: the term of your subscription, plus the retention periods in the Privacy Policy after it ends.
Nature and purpose: automated software testing of applications you are entitled to test, and the reporting that goes with it. We do not process customer data for our own purposes, do not sell it, and do not use it to train any model.
3. Categories of data and data subjects
- Your users and administrators: name, work email, authentication data (password hashes, passkey public keys, two-factor secrets), role, activity in the audit log, and billing contact details.
- People who use the applications you test: whatever your recordings capture. A recording captures what the browser sees, including form inputs, cookies, headers and request and response bodies, because that is what a test needs to replay.
- Recognised credentials and secrets are redacted at capture time; secrets you store deliberately are kept in the credential vault, encrypted with AES-256-GCM.
- You are responsible for choosing what to record, for having the right to record it, and for using synthetic data where production personal data is not needed. The data factory exists for that purpose.
4. Our obligations as processor
- Instructions: we process personal data only on your documented instructions, which include the Terms, this addendum and the settings you choose in the product.
- Confidentiality: the people who operate the platform are bound by confidentiality obligations and have access only where their role needs it.
- Security: we maintain the technical and organisational measures in the annex below and do not reduce them during your subscription.
- Sub-processors: we use only the sub-processors listed on the sub-processors page, and we announce a change on that page before a new sub-processor processes customer data.
- Assistance with rights requests: the product includes a self-service data export, an erasure that reaches every row we hold for a subject, and an operator queue with a 30-day deadline. We assist you with requests your users send to you.
- Breach notification: we notify you without undue delay after confirming a personal-data breach that affects your data, with what we know, what we have done and what you may need for your own notifications. Our own regulatory clocks (CERT-In: six hours; the Data Protection Board: 72 hours) run independently of yours.
- Deletion and return: at the end of your subscription you can export your data; after the retention period in the Privacy Policy we delete it, including from backups as they expire.
- Audits and information: we answer written security questionnaires and share the evidence we hold, including the vendor evaluation checklist with our answers. On-site audits are available to Enterprise customers by agreement, at reasonable notice and no more than once a year unless a regulator requires otherwise.
5. International transfers
Customer data is hosted in Mumbai, India, on infrastructure we operate. India has no adequacy decision from the European Commission or the United Kingdom, so a transfer from those regimes needs an instrument. The table lists what we sign, per regime, at contract stage.
No representative in the EU under GDPR Article 27 has been appointed yet. We state this rather than hide it; EU customers who need one should raise it at contract stage.
No representative in the United Kingdom under UK GDPR Article 27 has been appointed yet.
| Your regime | Instrument we sign | Notes |
|---|---|---|
| United Kingdom (UK GDPR) | International Data Transfer Agreement, or the EU SCCs with the UK Addendum | A transfer risk assessment is completed with you; the Data (Use and Access) Act 2025 test applies from February 2026. |
| EU and EEA (GDPR) | Standard Contractual Clauses (Decision 2021/914), Module Two, controller to processor | A written transfer impact assessment is required; we provide our part, covering the Indian legal environment. |
| Canada (PIPEDA, Quebec Law 25) | This addendum plus a comparable-level-of-protection clause | Quebec requires a privacy impact assessment on your side before the transfer. |
| Japan (APPI) | An APPI-specific processing agreement | The EU clauses alone are not sufficient under the APPI. |
| Singapore (PDPA) | Transfer clauses in this addendum | The transfer limitation obligation is met by the recipient’s controls; the annex below is the evidence. |
| United States | None required by federal law | State privacy laws may require this addendum; no US law restricts the transfer to India. |
| India (DPDPA) | This addendum | No instrument is required for processing in India. |
6. Sub-processors
The current list, with the purpose, the data and the location for each, is the sub-processors page. It is dated; a change is announced there before it takes effect, and account owners receive the notice in the platform inbox.
7. Liability, governing law and precedence
The liability provisions and the governing law of the Terms of Service apply to this addendum. Where this addendum and the Terms conflict on the processing of personal data, this addendum prevails. Where the Standard Contractual Clauses conflict with either, the clauses prevail.
8. How this addendum is executed
Self-serve plans: this addendum applies by reference from the moment you accept the Terms; no signature is needed. Enterprise agreements include it as a schedule, countersigned. If your procurement process needs a signed copy on any plan, request one through the contact form (topic: legal) and we return it within five business days.
Annex: technical and organisational measures
- Tenant isolation: every tenant’s rows are isolated by row-level security in PostgreSQL, enforced in the database in addition to application-level checks.
- Encryption in transit: traffic to the platform on its public domain is served over HTTPS (TLS).
- Encryption at rest: credentials and secrets in the vault are encrypted with AES-256-GCM; backups are encrypted before they are stored.
- Identity: passkeys (WebAuthn) and two-factor authentication on every plan; single sign-on on Enterprise; access granted per feature; sessions visible to the workspace admin.
- Audit trail: administrative actions and every privacy operation are written to a tamper-evident, hash-chained audit log.
- Backups and recovery: encrypted backups daily, fourteen retained; a restore drill every week into a scratch database that checks tables, policies, indexes and row counts against production.
- Log retention: system and security logs are retained for 180 days in India, as the CERT-In directions require.
- Model inference: test intelligence runs on local models inside the platform; no customer data is sent to an external AI provider by default, and none is used for training.
- Vulnerability handling: a published disclosure policy with response targets, and health-gated deployments with automatic rollback.
Related documents
Questions about this document go to the contact form with the topic set to legal; a reply comes from a person within one business day.