Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") is part of the Terms of Service or of the contract signed between the Customer and GZ Segurança e Defesa Cibernética LTDA, CNPJ 40.988.106/0001-60, headquartered in Cascavel, Paraná, Brazil ("Moatgator"). It applies whenever Moatgator processes personal data on the Customer's behalf. By accepting the Terms or signing an order, the Customer accepts this DPA without any further signature.

If documents conflict, this order applies: (1) the ANPD standard contractual clauses in Annex III, for international transfers; (2) this DPA; (3) the main contract (MSA or signed order); (4) the Terms of Service. This is a courtesy translation: if language versions differ, the Portuguese version prevails.

1. Definitions

"Personal data", "data subject", "controller", "processor" (*operador*), "processing", "anonymization", "international transfer" and "ANPD" have the meaning given by Brazil's General Data Protection Law (Law 13,709/2018, the "LGPD") and the ANPD regulations. Also:

• Customer Data: personal data that the Customer, its apps or its users send to the platform so that Moatgator can provide the service.
• Telemetry: security events sent by the SDK or by Attest from the devices of the Customer's end users.
• Subprocessor: a third party engaged by Moatgator that processes Customer Data.
• Security incident: a confirmed adverse event that compromises the confidentiality, integrity or availability of Customer Data.

2. Roles

2.1. Moatgator as processor. For Customer Data, the Customer is the controller and Moatgator is the processor (LGPD, art. 5, VI and VII). This includes:

• Telemetry (rotating device pseudonym, app session identifier, detection type, technical signals, OS and app versions, time);
• Attest verdicts and the technical data that comes with an integrity check;
• app packages (APK, AAB, IPA) sent by a signed-in Customer for analysis or protection, if they contain personal data;
• the content of repositories that the Customer allows the GitHub App to read in order to open fix pull requests (Solve).

2.2. Moatgator as controller. For the data of people who use the console (name, e-mail, credentials, audit trail of console actions), billing and tax data, website data and the anonymous public Scan, Moatgator is the controller and follows the Privacy Notice. That data is not governed by this DPA.

2.3. Customer duties. The Customer represents that it has a legal basis to process the Telemetry, that it informs its end users about it (for example, in the app's privacy policy) and that its instructions to Moatgator are lawful. The Customer is the channel for data subjects: people who use a protected app contact the app's developer.

3. Instructions

Moatgator processes Customer Data only to provide the service, following the Customer's documented instructions. Instructions are: the Terms and the contract, this DPA, the configuration made in the console (policies, retention, region, integrations, AI investigation) and written requests accepted by both parties.

Moatgator does not use Customer Data to train models, for advertising or for profiling. It may produce anonymized, aggregated statistics about threats (for example, "share of rooted devices in Brazil"), provided no Customer, app or data subject can be identified.

If an instruction appears to breach the LGPD, Moatgator tells the Customer and may suspend it until it is confirmed or corrected (art. 39).

4. Description of processing

The full description (purpose, categories of data subjects and data, retention) is in Annex I. Moatgator was designed to collect the minimum: it does not collect name, phone, e-mail, contacts, precise location, the list of installed apps or the content of the end user's app, and it does not store the IP address with Telemetry. The device identifier arrives as a hash and becomes a pseudonym that changes every 30 days and differs in each app.

5. Confidentiality

Only Moatgator personnel who need Customer Data to provide the service can access it, with individual accounts, two-step verification and audit logging, all bound by confidentiality duties that survive the end of their engagement.

6. Security

Moatgator maintains technical and organizational measures suitable to protect Customer Data (LGPD, art. 46), described in Annex II, and reviews them at least once a year. Moatgator may replace a measure with an equivalent or better one, without lowering the overall level of protection.

7. Subprocessors

7.1. Authorization. The Customer authorizes Moatgator to use the subprocessors in the public subprocessor list, for the purpose, data and region shown there.

7.2. New subprocessors. Before adding or replacing a subprocessor that processes Customer Data, Moatgator updates the list and notifies the Customer by e-mail or in the console at least 30 days in advance. In an emergency (for example, a vendor shutting down) the notice may be shorter, given as soon as possible.

7.3. Objection. The Customer may object in writing, with reasonable grounds related to data protection, within the notice period. The parties will look for a solution in good faith; if there is none, the Customer may terminate the affected service without penalty and receive a pro-rata refund of prepaid, unused fees.

7.4. Obligations. Moatgator engages each subprocessor in writing, with data protection obligations at least equivalent to this DPA, and remains liable to the Customer for the subprocessor's acts, within the limits of the contract.

8. International transfers

8.1. Where data is. Today the whole platform (API, database, file storage and services) runs on Railway, in the United States (California), and transactional e-mail is sent through Resend, also in the US. An organization can pick a region (Brazil, US or EU) at sign-up, but separate infrastructure per region does not exist yet: until it does, all data is processed in the US, whatever region was chosen. Moatgator will notify the Customer before changing where data is processed.

8.2. Mechanism. The United States has no adequacy decision from the ANPD. Transfers of Customer Data to subprocessors abroad therefore use the standard contractual clauses approved by the ANPD (Annex II of ANPD Resolution CD/ANPD No. 19 of August 23, 2024), adopted in full and without changes, as allowed by art. 33, II, "b", of the LGPD. Moatgator is the exporter (a processor acting on the Customer's behalf) and each subprocessor abroad is the importer. The fields the parties fill in are in Annex III.

8.3. Transparency. The subprocessor list shows each subprocessor's country. When a data subject asks, the Customer can obtain from Moatgator, free of charge, a copy of the standard clauses in force with the relevant subprocessor.

8.4. Customers outside Brazil. If the Customer is in the European Union, the United Kingdom or another country with its own rules, the parties may sign, at the Customer's request, the instrument required there (for example, the European Commission's standard contractual clauses) as an addendum.

9. Data subject requests

Moatgator gives the Customer tools to honor the rights in art. 18 of the LGPD: export of the organization's data, erasure by period, by device (pseudonym) or by the app's identifier, and access to the audit trail. If a data subject contacts Moatgator directly about Telemetry, Moatgator forwards the request to the Customer without answering on the merits, unless the law requires otherwise. When the Customer needs help beyond the tools, Moatgator responds within 5 business days.

10. Security incidents

10.1. Notice to the Customer. On becoming aware of a security incident involving Customer Data, Moatgator notifies the Customer without undue delay and within 24 hours, so that the Customer, as controller, can meet the deadline to notify the ANPD and data subjects (art. 48 of the LGPD and ANPD Resolution CD/ANPD No. 15 of April 24, 2024, which gives the controller 3 business days).

10.2. Content. The notice includes, as far as is known at the time and completed later: the nature of the incident and the data affected; the approximate number of data subjects and records; the security measures in place; the likely risks; the measures taken and proposed to reduce the effects; the contact of the person handling the case; and, if applicable, why the notice was delayed.

10.3. Cooperation. Moatgator cooperates with the Customer on the investigation, the notices to the ANPD and data subjects and the containment measures, and keeps a record of the incident for at least 5 years, even when the ANPD is not notified. Moatgator does not notify the ANPD or data subjects on the Customer's behalf without its authorization, unless Moatgator has its own legal duty to do so.

10.4. No admission. Notifying an incident is not an admission of fault.

11. Audits

11.1. Information. On request, Moatgator provides the information needed to demonstrate compliance with this DPA: the description of security measures, answers to security questionnaires and, when they exist, third-party audit or penetration test reports (under confidentiality).

11.2. Audit. If that information is not enough, or if the ANPD requires it, the Customer may carry out, once a year, an audit by itself or by an independent auditor under confidentiality, with 30 days' notice, during business hours, without access to other customers' data and without disrupting operations. Each party bears its own costs, unless the audit finds a material breach, in which case Moatgator bears reasonable costs.

12. Return and deletion

12.1. During the contract. The Customer can export and delete its data in the console at any time. Telemetry is deleted automatically at the end of the plan's retention period.

12.2. At the end of the contract. Once the service ends, the Customer has 30 days to export its data. After that, Moatgator deletes Customer Data from active systems within 30 days and from backups within their retention cycle (up to 12 months, encrypted and unused), unless retention is required or allowed by law (art. 16 of the LGPD). Moatgator confirms deletion in writing if the Customer asks.

13. Liability

Each party is liable for the damage it causes by breaching the LGPD or this DPA, under arts. 42 to 45 of the LGPD. The liability limits of the main contract apply to this DPA, except where the law does not allow limitation, and without prejudice to data subjects' rights.

14. Term

This DPA applies while Moatgator processes Customer Data and continues, where relevant, until that data is deleted. Moatgator may update it to reflect changes in the law or the service with 30 days' notice; changes that reduce the protection of Customer Data require the Customer's agreement.

15. Contact

Data protection officer (*encarregado*): ⟦name of the DPO⟧, dpo@moatgator.com. Privacy: privacidade@moatgator.com. GZ Segurança e Defesa Cibernética LTDA, ⟦full registered address⟧, Cascavel/PR, Brazil.

Annex I. Description of processing

Annex II. Security measures

• Encryption: TLS for all external traffic; data at rest encrypted by the provider; sensitive fields (integration secrets, service accounts) encrypted in the application with per-organization keys; backups encrypted on the client side before they leave the server.
• Tenant isolation: row-level security (RLS) enforced on every table with organization data, with an automated test that fails any table without the rule.
• Minimization: IP removed at Telemetry ingestion and kept out of its logs; device identifier turned into a rotating pseudonym with a secret per-app salt; no raw ID, no app list, no app content.
• Access: role-based access in the console; individual staff accounts with strong passwords and mandatory two-step verification, short sessions and their own audit trail; production access limited to those who operate the platform.
• Audit trail: administrative actions recorded in a verifiable hash chain, per organization.
• Scan isolation: package analysis runs in a separate service with no application secrets, and the package is deleted within 24 hours.
• Secure development: code review, automated tests, dependency and secret scanning in CI, reviewed migrations.
• Continuity: encrypted logical backups with restore tests; RPO target of 1 hour and RTO of 4 hours (estimates).
• Incidents: response plan with severities, roles, communication templates and a record of each incident.
• Vendors: subprocessors assessed before engagement and reviewed once a year.

Annex III. ANPD standard contractual clauses

The standard clauses in Annex II of ANPD Resolution CD/ANPD No. 19/2024 are adopted in full and without changes in each contract between Moatgator and a subprocessor abroad. The official text is in Brazil's Official Gazette of August 23, 2024 and on the ANPD website. Below are only the fields the parties fill in the spaces provided in Section I.

Note for legal review: confirm, for each subprocessor, whether it already offers the ANPD standard clauses (some large providers publish their own signable version) or whether they must be negotiated; without signed clauses, the transfer has had no valid mechanism since 08/23/2025.