Roles
For personal data contained in your account and assessments, you act as the data controller and Pencheff acts as the data processor, processing that data only on your documented instructions to provide the service.
Scope of processing
Pencheff processes target metadata, scan artefacts, and findings that you submit or that the platform generates while running assessments you commission. You are responsible for having authorisation to test any target you submit.
Sub-processors
We use a limited set of infrastructure and authentication providers to operate the platform (for example, hosting and identity). Sub-processors are bound by data-protection terms consistent with this addendum. A current list is available on request at [email protected].
Security measures
We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls, tamper-evident audit logging, and least-privilege operational practices.
International transfers
Where data is transferred across regions, we rely on appropriate safeguards (such as standard contractual clauses) as required by applicable law.
Return and deletion
On termination, and on request during the term, we return or delete customer data in accordance with the retention terms of your plan and applicable legal, security, and audit obligations.
Contact
For data-processing questions or to request our sub-processor list, contact: [email protected].