1. Definitions
In this Data Processing Agreement ("DPA"):
- "Controller" means the Customer (you), who determines the purposes and means of processing Personal Data.
- "Processor" means Admiresty Corporation, which processes Personal Data on behalf of the Controller.
- "Personal Data" means any information relating to an identified or identifiable natural person, including IP addresses and DNS query logs where these relate to an identified individual.
- "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
- "Data Subject" means an individual whose Personal Data is processed.
- "Sub-processor" means any third party engaged by Admiresty to process Personal Data in the course of providing the Service.
- "GDPR" means the EU General Data Protection Regulation 2016/679 and, where applicable, the UK GDPR as incorporated into UK law by the Data Protection Act 2018.
- "Applicable Data Protection Law" means GDPR, the California Consumer Privacy Act (CCPA/CPRA), and any other applicable data protection legislation.
- "Service" means the DNSAFE DNS security platform as described in the Terms of Service.
2. Nature and Purpose of Processing
Subject matter: Processing of Personal Data associated with DNS queries resolved by the DNSAFE Service on behalf of the Customer.
Duration: For the term of the Customer's subscription, plus any applicable retention periods described in this DPA.
Nature: Collection, storage, analysis, and deletion of DNS query logs including source IP addresses, domain names queried, timestamps, and filtering actions taken.
Purpose: To provide the DNS security filtering service, including threat detection, query logging for the Customer's dashboard, and generation of security reports.
Types of Personal Data: IP addresses of registered devices; domain names resolved (which may indirectly reveal browsing patterns); account email addresses; billing contact information.
Categories of Data Subjects: The Customer's employees, contractors, household members, or end users whose devices are configured to use DNSAFE resolvers.
3. Processor Obligations
Admiresty Corporation (as Processor) shall:
- Process Personal Data only on documented instructions from the Controller (i.e., as described in this DPA and the Terms of Service), unless required to do so by applicable law. In such cases, we will inform the Controller before processing, unless prohibited by law.
- Ensure that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations.
- Implement and maintain the technical and organisational security measures described in Section 5 of this DPA.
- Assist the Controller in fulfilling its obligations to respond to Data Subject rights requests, to the extent possible given the nature of the processing.
- Assist the Controller in ensuring compliance with obligations relating to security, breach notification, data protection impact assessments, and prior consultation.
- At the Controller's choice, delete or return all Personal Data upon termination of the Service, and delete existing copies unless applicable law requires retention.
- Make available all information necessary to demonstrate compliance with this DPA and cooperate with reasonable audits requested by the Controller, with reasonable notice and at the Controller's cost.
- Promptly inform the Controller if, in our opinion, an instruction infringes Applicable Data Protection Law.
4. Controller Obligations
The Controller (Customer) shall:
- Ensure a lawful basis exists for all Personal Data provided to or generated by the Service.
- Provide any required notices to Data Subjects about the use of DNSAFE to process their Personal Data.
- Comply with Applicable Data Protection Law with respect to its instructions to Admiresty Corporation.
- Not instruct Admiresty to process Personal Data in a manner that would violate Applicable Data Protection Law.
5. Technical and Organisational Security Measures
Admiresty Corporation implements the following measures to protect Personal Data:
- Encryption in transit: All data transmitted between users and DNSAFE systems is encrypted using TLS 1.2 or higher. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) are supported.
- Encryption at rest: Passwords are stored as one-way hashes (bcrypt). Backups are encrypted at rest in Amazon S3 (AES-256).
- Access controls: Logical access to production systems is restricted to authorised personnel. Multi-factor authentication (Duo) is required for all DNSAFE administrator accounts, and available for partner accounts.
- Network security: Infrastructure is protected by firewalls, rate limiting, intrusion detection monitoring, and regular vulnerability assessments.
- Data minimisation: We collect only the DNS query data necessary to provide the Service (domain name, timestamp, action). We do not log full URLs, query content, or payload data.
- Backup and recovery: The database is backed up daily. Backups are encrypted and stored in Amazon S3, separately from the production servers, and kept for up to 90 days.
- Incident response: A documented incident response procedure including breach notification timelines as described in Section 7.
- Sub-processor security: All sub-processors are required to maintain security standards at least equivalent to those described in this section.
6. Sub-processors
The Controller provides general authorisation for Admiresty to engage the following sub-processors. We will notify the Controller at least 30 days in advance of adding or replacing any sub-processor by updating this page and/or sending email notice to the Controller's account email address.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services, Inc. | Hosting of the DNS resolvers, API, databases, encrypted backups, content delivery (CloudFront) and transactional email (SES) | United States; DNS resolvers also in the United Kingdom and Singapore |
| Stripe, Inc. | Payment processing and subscription management (card data never reaches our servers) | United States |
| Google LLC | reCAPTCHA (bot protection on sign-in forms), Google sign-in (if you choose it), Safe Browsing reputation checks, and Google Analytics (only with your consent) | United States |
| Microsoft Corporation | Microsoft sign-in (if you choose it) | United States |
| Cisco Systems, Inc. (Duo, Umbrella) | Multi-factor authentication for partner and administrator accounts (Duo); domain reputation checks in the domain checker and Threat Intel (Umbrella — receives only the domain being checked) | United States |
| Anthropic, PBC | AI features: the help assistant and Threat Intel analysis. Receives the questions you type and the lookup results being analysed | United States |
The Controller may object to a new sub-processor within 30 days of notice. If the objection cannot be resolved, the Controller may terminate the Service without penalty, subject to the Refund Policy.
7. Data Breach Notification
In the event of a Personal Data breach affecting the Controller's data, Admiresty Corporation will:
- Notify the Controller without undue delay, and in any event within 72 hours of becoming aware of the breach.
- Provide, to the extent known at the time, a description of the nature of the breach, the categories and approximate number of Data Subjects and records affected, likely consequences, and measures taken or proposed to address the breach.
- Cooperate with the Controller and take reasonable steps to mitigate and remediate the breach.
We will not make any public statement about a breach affecting the Controller's data without the Controller's prior consent, unless required to do so by law.
8. Data Subject Rights
If Admiresty receives a request directly from a Data Subject exercising rights under Applicable Data Protection Law (access, erasure, restriction, portability, objection), we will promptly forward it to the Controller and will not respond on the Controller's behalf without the Controller's instruction, except where required by law.
We will assist the Controller, using appropriate technical and organisational measures, to fulfil its obligations to respond to Data Subject rights requests within the legally required timeframes.
9. International Transfers
Personal Data processed under this DPA may be transferred to and processed in the United States and other countries where Admiresty's infrastructure or sub-processors are located. For transfers from the EEA or UK to the US, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission. Customers may request a copy of applicable SCCs by emailing legal@dnsafe.net.
10. Return and Deletion of Data
Upon termination of the Service, Admiresty will, at the Controller's choice:
- Delete all Personal Data within 90 days of account closure, unless applicable law requires longer retention; or
- Export the Controller's query logs in CSV format upon written request submitted within 30 days of account closure.
Requests for data export must be submitted to privacy@dnsafe.net before account deletion.
11. Liability
Each party's liability under this DPA is subject to the limitations set out in the Terms of Service. To the extent required by Applicable Data Protection Law, the parties may each be held liable for their own non-compliance with obligations under this DPA and Applicable Data Protection Law.
12. Term and Termination
This DPA is effective for the duration of the Customer's subscription and terminates automatically upon the Customer's account closure. Obligations relating to confidentiality, data deletion, breach notification, and international transfer safeguards survive termination.
13. Governing Law
This DPA is governed by the laws of the State of Delaware, USA, without regard to its conflict of law principles, except to the extent that Applicable Data Protection Law (such as GDPR) requires otherwise.
14. Requesting a Countersigned DPA
This DPA is automatically incorporated into your Terms of Service. If you require a signed copy for your compliance records or vendor management process, email legal@dnsafe.net with the subject line "DPA Request" and include your company name and account email address. We will return an executed copy within 5 business days.
15. Contact
Admiresty Corporation
Data Privacy — DNSAFE
legal@dnsafe.net