Data Processing Addendum (DPA)

DmarcLock Platform · Last updated: September 2026

Standard Data Processing Agreement Framework

This Addendum sets forth the technical and organizational terms governing the processing of technical email telemetry data on behalf of customer organizations. It defines roles, technical security measures (TOMs), subprocessor authorizations, and strict retention schedules.

01. Roles & Definitions

For the purposes of this Addendum:

Customer (Data Controller): The entity or organization that controls the domain name(s) configured for DMARC monitoring and dictates the processing instructions.
DmarcLock (Data Processor): The service provider that processes technical aggregate telemetry solely to deliver email authentication, delivery intelligence, and spoofing defense.
Applicable Privacy Law: Refers to applicable data protection regulations including the GDPR, the Indian DPDP Act, and other applicable privacy laws.

02. Scope of Processing & Excluded Data

The subject matter of data processing is strictly limited to RFC 7489 aggregate DMARC feedback XML reports generated by receiving mail systems worldwide.

Categories of Data Processed:

Sending Mail Relay IP Addresses (<source_ip>)
Message Volume Counts during the reporting cycle
SPF and DKIM cryptographic alignment verdicts (pass / fail)
Policy evaluation outcomes (none, quarantine, reject)
Claimed Header From domain names

Strict Exclusion: DmarcLock does not ingest, process, store, or inspect the contents of email messages, email subjects, personal body text, recipient mailboxes, or attachments.

03. Technical and Organizational Measures (TOMs)

DmarcLock implements rigorous security safeguards to protect customer telemetry against unauthorized access, destruction, loss, or alteration:

Cryptographic Controls

All telemetry in transit is encrypted using modern TLS 1.3 transport security. Database stores are encrypted at rest using AES-256 standard encryption.

Multi-Tenant Isolation

Tenant workspace boundaries are enforced at the database query layer via tenant foreign keys. Unauthorized cross-tenant queries return explicit 403 Forbidden responses.

Parser Immunization

XML ingestion is protected against XXE injection, Billion Laughs entity expansions, and compression bombs via defusedxml and 10MB uncompressed byte limits.

Storage Limitation

Raw sender IP telemetry is governed by an automated 30-day hard retention schedule. IP subnet masking (/24 for IPv4, /48 for IPv6) is provided for zero-PII regimes.

04. Authorized Subprocessors

Customer grants general written authorization for DmarcLock to engage the following third-party infrastructure subprocessors:

Subprocessor	Purpose	Location
Supabase Inc.	Managed database infrastructure & encrypted storage	AWS ap-south-1 / eu-central-1
Cloudflare Inc.	DNS resolver verification, DDoS mitigation, and edge delivery	Global Edge Network
Stripe Inc.	Payment processing and subscription billing tokens	United States / Global

DmarcLock shall provide at least thirty (30) days' advance notice of any intended changes concerning the addition or replacement of subprocessors.

05. Incident Notification SLA

In the event of a confirmed Personal Data Breach affecting customer telemetry, DmarcLock shall notify the Customer without undue delay and, where feasible, no later than 72 hours after becoming aware of the incident, providing details regarding the nature of the breach, affected records, and remediation measures taken.

06. Telemetry Purge & Deletion Rights

Upon request, you can erase all stored domain data via the dashboard or through API endpoint DELETE /api/v1/dmarc/domains/{domain}/telemetry. All data is purged permanently and without delay.

07. Governing Law

This Addendum shall be governed by and construed in accordance with the laws of India, without prejudice to mandatory provisions of applicable data protection law governing data controllers in other jurisdictions.

Loading…