LEGAL
CodeAnt AI Data Processing Agreement
Last updated: November 6, 2026
This Data Processing Agreement (“DPA”) forms part of the agreement between CodeAnt AI, Inc. (“CodeAnt AI”) and the customer named in it (“Customer”) for the CodeAnt AI services (the “Agreement” and the “Services”). It applies whenever CodeAnt AI processes Customer Personal Data to provide the Services, and takes effect with the Agreement. No separate signature is needed, but CodeAnt AI will countersign a copy on request.
1. Definitions
“Customer Data” means source code, repositories, configurations, systems Customer authorizes CodeAnt AI to test, and the findings and reports the Services produce.
“Customer Personal Data” means personal data in Customer Data that CodeAnt AI processes on Customer’s behalf.
“Data Protection Laws” means all privacy and data protection laws that apply to that processing, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act and other US state privacy laws, and India’s Digital Personal Data Protection Act, 2023.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
“Subprocessor” means any third party CodeAnt AI engages to process Customer Personal Data.
Terms such as controller, processor, data subject, personal data and processing have the meanings given in the GDPR, and include the equivalent terms in other Data Protection Laws.
2. Roles and scope
2.1 Customer is the controller of Customer Personal Data, or a processor acting for its own controllers. CodeAnt AI is Customer’s processor, and its service provider or contractor under US state privacy laws.
2.2 Annex 1 describes the subject matter, nature, purpose and duration of the processing, and the types of personal data and data subjects.
2.3 Customer is responsible for the lawfulness of the Customer Data it provides and for having all rights and authorizations needed, including authority over any system it asks CodeAnt AI to test.
3. Instructions
3.1 CodeAnt AI processes Customer Personal Data only on Customer’s documented instructions. The Agreement, this DPA and Customer’s configuration of the Services are those instructions. Any further instruction requires written agreement.
3.2 CodeAnt AI will promptly tell Customer if it believes an instruction infringes Data Protection Laws, or if law requires it to process Customer Personal Data in another way, unless the law prohibits that notice.
4. Confidentiality
CodeAnt AI ensures that everyone it authorizes to process Customer Personal Data is bound by confidentiality, is trained in data protection, and has access only to what their role requires.
5. Security
5.1 CodeAnt AI implements and maintains the technical and organizational measures in Annex 2, which are designed to protect Customer Personal Data against Personal Data Breaches and are appropriate to the risk.
5.2 CodeAnt AI may update these measures over time, but will not materially reduce the overall level of protection.
5.3 CodeAnt AI keeps records of its processing of Customer Personal Data as Data Protection Laws require, and will notify Customer if it stops maintaining a current SOC 2 Type II report.
6. Subprocessors
6.1 Customer authorizes CodeAnt AI to use the Subprocessors listed in Annex 3.
6.2 CodeAnt AI will have a written contract with each Subprocessor that imposes data protection obligations no less protective than this DPA. CodeAnt AI remains responsible for each Subprocessor’s performance.
6.3 CodeAnt AI will give at least 30 days’ notice before adding or replacing a Subprocessor, by updating its Trust Center, which Customer can subscribe to, or by email.
6.4 Customer may object on reasonable data protection grounds within that notice period. The parties will discuss the objection in good faith. If it is not resolved, Customer may terminate the affected Services on written notice and receive a refund of any prepaid fees for the unused part of the term.
7. Personal Data Breaches
7.1 CodeAnt AI will notify Customer without undue delay, and in any event within 24 hours, after becoming aware of a Personal Data Breach.
7.2 The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact for more information. CodeAnt AI will provide updates as it learns more.
7.3 CodeAnt AI will promptly take reasonable steps to contain, investigate and remediate the breach, and will cooperate with Customer.
7.4 CodeAnt AI will not notify regulators or Customer’s data subjects about a breach of Customer Personal Data without Customer’s prior approval, unless the law requires it. Notice of a breach is not an admission of fault.
7.5 CodeAnt AI will also notify Customer within 24 hours of any security incident affecting CodeAnt AI’s systems that poses a cybersecurity risk to Customer, including any compromise of access or credentials Customer has provided, and will coordinate its response with Customer.
8. Assistance
8.1 Data subject requests. CodeAnt AI will promptly forward to Customer any request it receives from a data subject about Customer Personal Data, and will not respond except to confirm it has forwarded the request. CodeAnt AI will give Customer reasonable help to respond, through the Services or otherwise.
8.2 Assessments. CodeAnt AI will give Customer reasonable help with data protection impact assessments and consultations with regulators, using the information available to it.
8.3 Government requests. If a public authority requests Customer Personal Data, CodeAnt AI will try to redirect it to Customer, notify Customer unless the law prohibits it, challenge any request it reasonably believes is unlawful, and disclose only the minimum required.
9. AI and data use
9.1 CodeAnt AI will not use Customer Data to train, fine-tune or otherwise improve any AI model, its own or a third party’s.
9.2 CodeAnt AI’s AI model providers are contractually prohibited from training on Customer Data and do not retain prompts or outputs after processing each request.
9.3 Source code is processed in isolated, ephemeral environments and deleted, together with any abstract syntax trees built from it, when each scan or review completes.
9.4 CodeAnt AI will not sell or share Customer Personal Data, use it for advertising or marketing, or combine it with other data except as needed to provide the Services.
9.5 Credentials Customer provides for testing are stored encrypted, used only for the authorized engagement, and deleted when that engagement ends.
9.6 When CodeAnt AI tests Customer’s systems, the security testing terms in Annex 4 also apply.
10. Audits
10.1 Once a year on request, CodeAnt AI will provide its most recent SOC 2 Type II report, under confidentiality, and answer a reasonable security questionnaire.
10.2 If those materials do not reasonably show compliance with this DPA, or a regulator requires it, or after a Personal Data Breach, Customer may audit CodeAnt AI, itself or through an independent auditor bound by confidentiality who is not a CodeAnt AI competitor. Customer will give 30 days’ notice, conduct the audit during business hours without access to other customers’ data, and bear its own costs. Audits under this section are limited to one in any 12 months, except after a breach or where a regulator requires more.
10.3 Where Customer is regulated, including in financial services, energy or critical infrastructure, CodeAnt AI will cooperate with Customer’s regulators, allow them to audit as their rules require, and agree in good faith to any additional contract terms those rules require, such as under the EU Digital Operational Resilience Act, NYDFS Part 500 or NERC CIP-013.
11. International transfers
11.1 CodeAnt AI and its Subprocessors may process Customer Personal Data in the United States and the other countries listed in Annex 3. Customer may choose its hosting region where the Services offer one. If an order form requires it, CodeAnt AI will limit the processing of, and access to, Customer Personal Data to the countries it specifies.
11.2 EEA. For transfers of Customer Personal Data from the EEA to a country without an adequacy decision, the parties incorporate the standard contractual clauses approved by European Commission Decision (EU) 2021/914, or any successor clauses that apply to the transfer (the “SCCs”). Module Two applies where Customer is a controller and Module Three where Customer is a processor. Clause 7 applies; under Clause 9, Option 2 applies with the notice period in Section 6.3; the option in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland. Annexes 1, 2 and 3 of this DPA complete the SCC annexes.
11.3 UK. For transfers from the UK, the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner applies, completed with the information in this DPA. Neither party may end the Addendum when it is revised.
11.4 Switzerland. For transfers from Switzerland, the SCCs apply with the Swiss Federal Data Protection and Information Commissioner as the competent authority and references to the GDPR read as references to the Swiss Federal Act on Data Protection.
11.5 If a transfer mechanism is invalidated, the parties will work together promptly to put a lawful alternative in place.
12. Return and deletion
12.1 Customer can export its data through the Services during the term.
12.2 Within 30 days after the Agreement ends, CodeAnt AI will delete Customer Personal Data, or return it in a commonly used format if Customer asks in writing before the Agreement ends. Copies in backups are overwritten within a further 35 days. CodeAnt AI will confirm deletion in writing on request.
12.3 If the law requires CodeAnt AI to keep any Customer Personal Data, this DPA continues to protect it, and CodeAnt AI will use it for no other purpose.
13. US state privacy laws
Where US state privacy laws apply, CodeAnt AI will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose other than providing the Services, or outside its direct business relationship with Customer; or combine it with personal information from other sources, except as those laws allow. CodeAnt AI will provide the level of protection those laws require, notify Customer if it can no longer meet its obligations, and let Customer take reasonable steps to stop and remediate unauthorized use. CodeAnt AI certifies that it understands and will comply with these restrictions.
14. General
14.1 This DPA lasts as long as CodeAnt AI processes Customer Personal Data.
14.2 If documents conflict on data protection, the SCCs prevail, then this DPA, then the Agreement.
14.3 Each party’s liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the SCCs do not allow liability to be limited.
14.4 If Customer Data will include protected health information, the parties will sign a business associate agreement, which governs that information.
14.5 This DPA is governed by the law that governs the Agreement, except where the SCCs require otherwise.
14.6 CodeAnt AI may update this DPA to reflect changes in law, but no update will reduce Customer’s protections without Customer’s written agreement.
14.7 Notices about this DPA go to security@codeant.ai and to the Customer contact named in the Agreement.
Annex 1: Details of processing
Item
Details
Data exporter
Customer, as controller or processor. Contact details as set out in the Agreement.
Data importer
CodeAnt AI, Inc., 355 Bryant St., Unit 403, San Francisco, CA 94107, USA, as processor. Contact: security@codeant.ai
Subject matter
Providing the Services under the Agreement
Nature of processing
Accessing, analyzing, testing, storing and deleting Customer Data to deliver AI code reviews, code quality and code security analysis, penetration testing and attack surface monitoring
Purpose
Providing, supporting and securing the Services Customer requests
Data subjects
Customer’s employees, contractors and users; contributors to Customer’s repositories; individuals whose data is held in systems Customer authorizes CodeAnt AI to test
Personal data
Names, usernames, email addresses and other identifiers in repository metadata and commit history; account and usage data of Customer’s users; any personal data contained in source code, configurations or systems in scope for testing
Sensitive data
Not intended to be processed. Any encountered during testing is used only as needed to prove a finding and is protected by the measures in Annex 2.
Frequency
Continuous for the term of the Agreement
Retention
Term of the Agreement plus the deletion period in Section 12. Source code is deleted when each scan or review completes.
Subprocessor transfers
As listed in Annex 3, for the same purposes and duration
Competent supervisory authority
As determined under Clause 13 of the SCCs
Annex 2: Security measures
Assurance: SOC 2 Type II report from an annual independent audit; HIPAA compliance program; written security policies reviewed at least annually, with a named owner for the security program.
Encryption: Customer Data encrypted in transit with TLS 1.2 or higher and at rest with AES-256 or equivalent.
Isolation: each scan runs in an isolated, ephemeral environment that is destroyed when the scan completes; each customer’s data is logically separated.
Access control: role-based, least-privilege access; multi-factor authentication for all personnel access to production and administrative systems; access reviewed at least quarterly and removed promptly when no longer needed.
Credentials: integration tokens encrypted and limited to the minimum permissions the Services need.
Data minimization: penetration test evidence limited to what is needed to prove each finding.
Vulnerability management: regular vulnerability scanning and independent penetration testing of the Services, with critical issues fixed within 15 days and high-severity issues within 30 days.
Secure development: peer code review, approval and testing of changes before release to production.
Logging and monitoring: security event logging and alerting, with logs kept for 12 months.
Incident response: a documented incident response plan, reviewed at least annually.
Resilience: backups, redundant infrastructure and a business continuity plan.
People: confidentiality agreements, security training at onboarding and annually, and background checks where lawful.
Devices: full-disk encryption and malware protection on company devices.
Vendors: security review of Subprocessors before engagement and periodically after.
Deployment choice: Enterprise customers may run the Services inside their own environment so Customer Data never leaves it.
Software integrity: software and updates CodeAnt AI supplies for installation in Customer environments come with a way to verify their integrity and authenticity, such as signatures or checksums.
Vulnerability notice: CodeAnt AI tells Customer about known vulnerabilities in the Services that could affect Customer, and how they are being fixed.
Annex 3: Subprocessors
CodeAnt AI’s current Subprocessors, with their purposes and locations, are listed at codeantai.trust.site/subprocessors. That list forms part of this DPA, and changes to it follow Section 6.
Annex 4: Security testing terms
These terms apply whenever CodeAnt AI performs penetration testing or other security testing of Customer’s systems.
1. Authorization. CodeAnt AI tests only the targets, time windows and methods Customer authorizes in writing for each engagement.
2. Safe testing. No denial-of-service, destructive or data-altering tests, and no social engineering, unless Customer approves them in writing. CodeAnt AI stops testing immediately if Customer asks or if testing appears to disrupt Customer’s operations.
3. Source of traffic. On request, CodeAnt AI gives Customer the IP addresses its tests will come from before testing starts.
4. Urgent findings. CodeAnt AI notifies Customer’s designated contact promptly, and in any event within 24 hours, after confirming a critical vulnerability or evidence that a third party has compromised Customer’s systems.
5. Minimal evidence. CodeAnt AI accesses only what is needed to prove a finding, never modifies or deletes Customer data, and keeps all evidence encrypted until it is deleted under Section 12.
6. Confidential findings. Findings and reports are Customer’s confidential information. CodeAnt AI shares them only with Customer’s designated contacts, and never publishes them, uses them in marketing or discloses them to any third party without Customer’s written consent.
7. Testers. Testing is performed by CodeAnt AI’s own systems and personnel, never by crowdsourced testers.
8. Access. Accounts, VPN connections or other access Customer grants are used only for the engagement. Customer may revoke access at any time, and CodeAnt AI will tell Customer as soon as access is no longer needed.
Signatures
Customer
CodeAnt AI, Inc.
Signature
Name
Amartya Jha
Title
Chief Executive Officer
Date
