Data Processing Agreement

DATA PROCESSING ADDENDUM — MODEL TERMS, 7 OCTOBER 2026 — AI ALIGNMENT REVISION 2

This model Data Processing Addendum (“DPA”) may be incorporated into a signed services agreement, an electronically accepted order or other written agreement between the customer (“Customer”) and the Blaze legal entity identified there (“Blaze”). Visiting this page does not execute or amend an agreement. “Agreement” means the agreement incorporating this DPA. This DPA applies only insofar as Blaze processes personal data on Customer’s behalf in delivering the contracted services. It prevails over inconsistent general terms solely as to the parties’ obligations for that processing. Commercial terms, fees, remedies, limitations of liability, governing law and dispute terms remain governed by the Agreement, except to the extent mandatory law or an applicable transfer instrument requires otherwise. Before affected processing starts, the parties must complete the applicable particulars and finite retention periods under Schedules A–D as described below.

1. Roles, definitions and scope

Customer is controller, or a processor authorized by its controller, and Blaze is processor or subprocessor for “Customer Data”: personal data made available by or for Customer for the services, including data encountered during authorized testing and personal data in findings, evidence and reports. “Data Protection Laws” means the EU GDPR and UK GDPR, Brazil’s LGPD and ANPD rules, the California Consumer Privacy Act as amended and its regulations (“CCPA”), and other laws applicable to the processing. Statutory terms carry their applicable statutory meanings. Each party is responsible for its own legal compliance.

Blaze is an independent controller only for its own account administration, billing, legal compliance and business contact data, as explained in its privacy policy; this DPA does not govern that separate processing. Schedule A specifies the subject matter, duration, nature and purposes, data subjects and data categories for the engagement. The permitted purposes are authorized access, inspection and testing of scoped systems; limited collection and analysis of evidence needed to validate findings; secure reporting, remediation discussion and agreed retesting; scoped vCISO, security advisory, governance and risk-management work specified in the engagement record; and administration and security of those activities. Materially different purposes, categories or operations require documented instructions and an updated Schedule A before they begin.

2. Documented instructions, confidentiality and AI

Blaze will process Customer Data only on documented instructions in the Agreement, this DPA, the completed schedules, scope and rules of engagement and subsequent written instructions, including instructions for transfers, unless EU or Member State law to which Blaze is subject requires otherwise for processing governed by the EU GDPR, or another law applicable to Blaze requires otherwise for other processing. Where that law permits, Blaze will notify Customer before legally compelled processing. Blaze will promptly tell Customer if an instruction appears to infringe applicable Data Protection Laws and may suspend the affected instruction while the parties resolve it. Customer is responsible for lawful collection, notices, permissions and authority for testing, including third-party systems. Blaze will limit access to personnel and contractors with a need to know who are subject to confidentiality obligations.

The Agreement and this DPA give Blaze a standing documented instruction to use AI-assisted tools to perform the contracted services within the purposes, operations and data categories in Schedule A, subject to the safeguards and restrictions here and in the engagement record. Blaze may select and change models and versions for those tasks without separate approval for each prompt, task or model, provided the change does not introduce an unauthorized recipient, processing or access location, purpose, data category or materially reduced safeguard. Customer may request reasonable information to vet models, providers, hosting, data categories and retention arrangements and may at any time give a written instruction restricting or prohibiting a model, provider or AI use for its engagement. That instruction overrides any general AI permission in the Agreement and applies prospectively on receipt; Blaze will stop the affected processing promptly and the parties will address any alternative, schedule, scope or fee impact under the Agreement’s change process. Blaze will not use Customer Data to train, fine-tune or improve a general-purpose or shared AI model for Blaze or any third party, and will contractually prohibit an AI provider from doing so. An AI provider receiving Customer Data must be authorized under section 4 and Schedule C, bound to the required confidentiality, security, deletion and onward-transfer obligations, and covered by Schedule D where necessary. AI use does not expand the agreed purpose or reduce Blaze’s responsibility for its output or processing.

3. Security and assessment data

Blaze will implement and maintain technical and organizational measures appropriate to the risk under Article 32 GDPR and applicable law, including role-based access and least privilege; strong authentication; appropriate encryption in transit and at rest; protected transfer and storage of evidence; logging and access review; vulnerability and patch management; confidentiality and training; backup and recovery; incident response; and periodic assessment of the effectiveness of those measures. The applicable measures actually implemented and engagement variations will be described in Schedule B before affected processing. Measures may evolve without materially reducing the overall protection. Customer will identify heightened measures, prohibited locations and approved evidence channels in Schedule A or B; the parties should use test accounts and masked or synthetic data where feasible. Blaze will minimize evidence, avoid complete datasets where a smaller sample suffices and restrict reports to authorized recipients.

4. Subprocessors

Customer gives general written authorization for the initial subprocessors specifically identified in the completed Schedule C before they access Customer Data and, subject to the notice and objection process below, for subsequent additions or replacements. Schedule C must state each entity, function, relevant data, processing and access locations and applicable onward-transfer safeguard. Blaze will give notice through the agreed channel at least 30 calendar days before a proposed addition or replacement gains access, with its identity, function, processing and access locations and transfer information. Customer may object on documented data protection grounds within 15 calendar days of notice. An unopposed change is authorized under this general authorization after the notice period without another signature, provided the required contract and transfer safeguards are in place and the list is updated. A timely objection prevents the proposed access while the parties seek a practicable alternative. If none is available, either party may terminate the affected unperformed service; fees, refunds and other commercial consequences follow the Agreement, subject to mandatory law and applicable transfer instruments. A different notice or objection period may be agreed in Schedule A, provided advance notice and a meaningful opportunity to object remain. A change of model within an authorized provider is not a new subprocessor merely because its model or version changes, provided no new recipient, location, purpose, data category or materially reduced safeguard results. Customer’s broader AI restriction right in section 2 remains unaffected.

Blaze will bind each subprocessor in writing to obligations providing at least the same level of protection for Customer Data, including applicable CCPA terms, confidentiality, security, deletion, assistance and onward-transfer safeguards, and remains liable to Customer for the subprocessor’s performance. No proposed subprocessor may access Customer Data before the required authorization, contract and transfer mechanism are in place. Posting a list alone does not replace the agreed notice.

5. Assistance, requests and audit

Taking account of the nature of processing and information available, Blaze will assist Customer with data subject and consumer requests, security and breach duties, data protection impact and risk assessments, prior consultations and relevant regulatory inquiries. Blaze will forward a request concerning Customer Data without undue delay unless prohibited, and will not answer for Customer without authorization except where law requires. Customer determines the response.

Blaze will provide information needed to demonstrate compliance with processor obligations and permit and contribute to audits or inspections by Customer or its designated auditor. For routine requests, the parties will use reasonably sufficient current assurance documents first. A routine inspection is limited to once in a twelve-month period, on reasonable prior written notice, during business hours, with reasonable scope, confidentiality, security and non-disruption arrangements; a designated auditor must be suitably qualified, independent and not a Blaze competitor. These arrangements do not displace mandatory audit rights or unreasonably delay appropriate access following a serious incident, credible noncompliance or regulatory request. Appropriate recent independent evidence may meet part of a request but does not remove a mandatory audit right. Where applicable, Blaze will provide information in its possession, custody or control relevant to Customer’s CCPA cybersecurity audit, risk assessment or automated-decisionmaking obligations. Blaze may charge reasonable, previously disclosed fees for extraordinary or bespoke assistance, repeated requests or exceptional audit work, except to the extent caused by Blaze’s breach or prohibited by law; a fee dispute will not delay mandatory assistance.

6. Personal data breach

Blaze will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, using the incident contact in Schedule A or, if unavailable, the established Customer contact. An initial notice will contain facts then available; Blaze will provide further information on nature, likely consequences, affected data and individuals, containment and remediation as it becomes available, with reasonable ongoing updates and an incident response contact. Blaze will preserve relevant evidence and investigate, contain and remediate matters within its control and reasonably assist Customer’s assessment and notifications. Customer decides whether and when to notify a regulator or individual unless applicable law directly obliges Blaze. The parties may agree a shorter operational target in Schedule A; this clause does not replace any regulator deadline applicable to Customer.

7. International transfers and official demands

A restricted international transfer or onward transfer may occur only after the origin, destination, parties’ roles and lawful mechanism are recorded in Schedule D and its required instrument, annexes, assessment and supplementary safeguards are completed. For EU/EEA data, the parties will use the applicable European Commission transfer Standard Contractual Clauses and correct module where required. For UK data they will use the applicable UK Addendum or International Data Transfer Agreement where required. For Brazilian data they will assess LGPD Article 33 and ANPD Resolution CD/ANPD No. 19/2024 as amended; if relying on ANPD standard contractual clauses, exporter and importer will incorporate the approved text in full without alteration and complete required details and transparency information. A legally valid alternative mechanism may be used if its requirements are satisfied. This DPA and Schedule D alone do not constitute any of those instruments.

If Blaze receives a legally binding demand for Customer Data from a public authority, it will, to the extent legally permitted, notify Customer promptly before disclosure, review the demand’s legal validity and scope, challenge it where reasonable grounds exist, disclose only data legally required and document its response. If notification is prohibited, Blaze will seek a lawful waiver where appropriate and provide notice when permitted. A demand from a foreign authority is not, by itself, a lawful basis or mechanism for a restricted transfer. Nothing requires conduct prohibited by law or impairs obligations in an applicable transfer instrument.

8. Return, deletion and retention

At the end of the affected services, Blaze will offer Customer a reasonable opportunity to obtain the Customer Data in an appropriate format and, at Customer’s documented choice, return or securely delete it and delete existing copies within the finite periods agreed in Schedule A, unless applicable law requires retention. The parties must agree finite periods for active evidence, reports, termination return and deletion, and backup expiry before the relevant processing begins; a reference to an undisclosed policy or an open-ended request for later instructions does not complete Schedule A. If Customer gives no choice after reasonable notice, deletion is the default, to be completed without undue delay after the reasonable return opportunity and in any event within the agreed finite termination period. For an engagement governed by this version of the DPA, a missing election or period does not permit indefinite retention; absent an agreed period, deletion follows without undue delay after a reasonable return opportunity.

Legally retained data will remain protected, limited to the legally required purpose and deleted when the obligation ends. Backup copies that cannot immediately be erased will be isolated from ordinary use, protected and deleted by the finite maximum backup expiry recorded in Schedule A; if restored for recovery, the applicable deletion instruction will be reapplied. Blaze will confirm completion on reasonable request. A retention extension requires documented Customer instruction or applicable law and a finite revised period; it is not implied by continued storage.

9. California service provider terms

Where the CCPA applies and Blaze receives California personal information as Customer’s service provider or contractor, Customer discloses it only for these specified business purposes: authorized security testing of systems and assets in Schedule A; minimal collection and analysis of evidence to validate and explain findings; preparation and secure delivery of reports and remediation advice; agreed retesting; scoped vCISO, security advisory, governance and risk-management work specified in Schedule A; and security, administration and documentation of these activities. AI assistance within those specified purposes is instructed under section 2 and Schedule A, subject to Customer’s prospective restrictions and the applicable provider and transfer safeguards. A different purpose must be specifically documented before processing begins.

Blaze will comply with applicable CCPA provisions and provide the same level of privacy protection required of a business for this information. Blaze will not sell or share it, retain, use or disclose it outside those specified purposes or the direct business relationship except as the CCPA permits, combine it with information from another source except as the CCPA permits, or use it for cross-context behavioral advertising. Blaze will notify Customer if it determines it can no longer comply. Customer may take reasonable and appropriate steps to verify compliant use and, on notice, stop and remediate unauthorized use. Customer will inform Blaze of consumer requests it must fulfill and provide information needed, or Blaze will otherwise enable Customer to comply. Blaze will impose required CCPA terms on relevant subcontractors. This section applies only to covered California processing.

10. Brazilian processing

Where the LGPD applies, Customer as controlador determines purposes, legal bases, transparency, retention instructions and responses to titulares. Blaze as operador acts on lawful documented instructions, implements appropriate technical and administrative safeguards and provides reasonably necessary information and assistance for rights, records and incidents. The parties will record their privacy and incident contacts and any appointed encarregado in Schedule A. Blaze will report a security incident affecting Customer Data without undue delay so Customer can assess risk or relevant harm and meet its own duty to notify ANPD and titulares. Under ANPD Resolution CD/ANPD No. 15/2024, the controller’s period for a reportable incident is generally three business days from awareness, subject to specific-law rules and applicable exceptions. Blaze does not take over Customer’s notification decision. Brazilian transfers are governed by section 7 and Schedule D; approved ANPD clauses and mandatory Brazilian rules prevail in their scope.

11. General and schedule operation

If Customer is a processor, it confirms controller authorization for its instructions and use of Blaze as subprocessor and will pass through information and requests needed for this DPA. Neither party must disclose another customer’s confidential information or compromise security in an audit. This DPA controls only conflicting obligations concerning Blaze’s processing of Customer Data on Customer’s behalf; it does not create a separate refund, indemnity, liability cap or commercial remedy. Fees, remedies, liability, governing law and dispute terms follow the Agreement except where mandatory law or an incorporated transfer instrument requires otherwise. No required transfer clause is modified by this DPA.

Schedules A–D form part of an executed DPA only to the extent completed and incorporated by the parties in the signed Agreement, electronically accepted order, statement of work or other documented agreed record. A versioned Trust Center document may complete an applicable schedule if the parties identify its title, version/date and scope in that record and provide Customer access to it before relevant processing. Later posting alone does not amend an agreed schedule, retention period or security variation, authorize a new subprocessor or complete a transfer instrument. The parties will document material changes before affected processing; no provision of this public model retroactively amends an existing contract.

Schedule A — Engagement particulars and retention

The executed Agreement, order, statement of work or incorporated engagement record must specify the Customer and Blaze legal entities and roles; service and system scope; specific purposes and instructions; start and duration; processing operations; categories of data subjects and personal data, including sensitive or regulated data; approved evidence channels and recipients; permitted and prohibited locations; privacy and incident contacts; and any heightened handling or shorter incident target. The standing AI instruction in section 2 covers assistance within those recorded services, purposes, operations and data categories unless this record or a later written Customer instruction restricts it; it need not enumerate each AI task, prompt, model or version. Any engagement-specific AI restrictions and authorized provider arrangements must be recorded or incorporated. Ordinary security-assessment categories may include personnel, users, customers, suppliers and others in scoped systems, with identifiers, contact and account data, authentication information, logs and communications; sensitive data must be expressly identified if reasonably anticipated. Customer will identify prohibited datasets and geographic restrictions before access.

This same record must state finite periods or finite maximum periods for active evidence and reports, the return opportunity and final deletion after service termination, and backup expiry, with any legal retention category and rule. It must record Customer’s return or deletion election if different from section 8’s deletion default. The period may be specified by an objectively determinable event plus a finite maximum, but may not be indefinite. If any material particular or finite period is missing, the parties will agree it in writing before the affected processing begins; the public examples do not supply an operational duration.

Schedule B — Technical and organizational measures

Before affected processing begins, the parties will identify a current, accessible, versioned description of Blaze’s actually implemented technical and organizational measures, or attach a verified measure schedule, and record its title, version/date and engagement-specific variations in Schedule A. It must describe the applicable access, authentication, encryption, evidence transfer/storage, logging, vulnerability management, personnel, backup/recovery, incident response and effectiveness-review controls with sufficient specificity for Customer’s assessment, including any applicable evidence-channel or location restriction. The section 3 commitments remain binding; the incorporated description will reflect applicable implemented controls.

Schedule C — Authorized subprocessors

Before a subprocessor accesses Customer Data, the parties will incorporate a dated list identifying each initial legal entity, its function, relevant data or service, processing and access locations and applicable transfer safeguard, either in the engagement record or by title and version of an accessible list. The change channel and any agreed change to the section 4 notice and objection periods must also be recorded. A subsequent addition or replacement is authorized under the general authorization in section 4 after compliant advance notice and expiry of the section 4 notice period without a timely objection, once its required safeguards are in place and the list is updated; no separate signed amendment is required. An absent or incomplete initial entry gives no authorization to that entity. Model and version changes within an authorized provider follow sections 2 and 4.

Schedule D — Applicable transfers

Before each restricted transfer or onward transfer, the parties will record the exporter, importer, roles, origin, destination, data categories, purpose, onward recipients and selected lawful mechanism. Where required, they will separately execute or incorporate the unmodified official EU clauses with correct module and completed annexes, the applicable UK instrument, or the complete ANPD-approved clauses with required transfer details and transparency information, and document assessments and supplementary safeguards. This schedule is a routing and completion record, not a substitute for an official instrument. A transfer not requiring such instrument must identify its valid legal basis; no restricted transfer begins while a required instrument or assessment is incomplete.

Requests and contact

For an executed DPA, applicable schedules, subprocessor and transfer information, security measures or a data protection request, use Blaze’s contact page (/contact-us) and identify your organization and relevant service, system or report. No order number is required. Data subjects may use the contact in Blaze’s privacy policy (/legal/privacy-policy); where Blaze processes for a customer it may direct the request to that controller after reasonable identity and scope checks. The Blaze Trust Center (https://trust.blazeinfosec.com/) may provide assurance materials and versioned schedule documents. If a required document is unavailable, request it before the affected processing; a Trust Center posting alone has no contractual effect beyond the incorporation rule above.