Agreement status
This page is an information framework, not an executed data processing agreement. A legally reviewed agreement must be provided before a customer relationship requires one.
Scope
The expected processing scope is limited to account, project, scan, report and support data needed to deliver Vybentis. Repository access is read only and scan processing remains bounded by the documented limits.
Subject and duration
The subject is the processing of customer controlled personal data solely to provide the contracted Vybentis services. Processing begins when the customer submits such data and continues for the service term plus the documented deletion and statutory retention periods.
Nature and purpose
Processing may include collecting, transmitting, structuring, analyzing, storing, retrieving, reporting, restricting and deleting data for account operation, authorized scans, report generation, support, security and billing. Customer data is not used for unrelated advertising or to train models for Vybentis.
Data and data subjects
Possible data includes account and contact data, project metadata, public target data, bounded source derived evidence, repository provenance, technical logs and support content. Data subjects may include customer users, authorized project collaborators, website operators and persons incidentally represented in customer controlled technical content. Special category data is not intended and must not be submitted unless separately agreed and lawfully instructed.
Instructions and confidentiality
Core Industry processes customer controlled personal data only on documented instructions, including the service configuration and authorized scan request, unless Union or Member State law requires otherwise. Persons authorized to process such data are bound to confidentiality. An instruction believed to violate data protection law is flagged before execution where legally permitted.
Security measures
Measures include tenant isolation and Row Level Security, least privilege access, encryption in transit, envelope encryption for provider credentials, keyed hashes for API token lookup, secret redaction, bounded disposable scanner workers, access and security event logging, deletion jobs, recovery controls and regular security testing. The final executed agreement contains the verified technical and organizational measures for the production environment.
Subprocessors and transfers
Only subprocessors needed for the documented service may process customer data. Core Industry remains responsible for imposing equivalent data protection obligations. International transfers require a valid Chapter V GDPR mechanism and any necessary supplementary measures. The current categories and prelaunch verification status are published on the subprocessor page.
Assistance
Core Industry provides reasonable assistance with data subject requests, security obligations, personal data breach assessment, data protection impact assessments and prior consultation, taking into account the nature of processing and the information available. The customer remains responsible for its own legal bases, notices and instructions.
Deletion and return
At the end of the service, customer controlled personal data is deleted or returned as agreed, unless law requires retention. Project deletion removes tenant data through the documented workflow. Raw repository archives are deleted immediately after normalization and anonymous raw scan artifacts are retained for no more than 24 hours. Legally required billing records remain separately minimized.
Evidence and audits
Core Industry makes information necessary to demonstrate Article 28 GDPR compliance available under the executed agreement and supports proportionate audits. Audit access must protect other customers, security controls, confidential information and provider obligations. Independent reports may replace repetitive onsite inspection where appropriate.
Execution
Request the legally reviewed and production specific agreement at info@vybentis.dev. It becomes binding only when accepted by both parties through the documented contracting process. This public page alone does not create an Article 28 agreement.