LEGAL
Data Processing Agreement
Version 1.8 · Effective 2026-10-20
Defines how Trixent handles personal data processed on a client's behalf during authorised security engagements. It explains the parties' responsibilities for permitted use, security safeguards, incident notification, approved providers, retention and deletion.
Your assessment evidence is part of your security boundary. We treat its handling as a contractual responsibility, not an afterthought.
When you need this
When Trixent processes personal data on your behalf during an authorised engagement, this agreement sets out how that information must be handled. It applies alongside the relevant Services Agreement. The Statement of Work and Rules of Engagement define the services, approved targets and testing permissions.
What's inside
- What this agreement covers
- Who is responsible for what
- How Trixent may use Client information
- Confidentiality, ownership and disclosure
- Security measures and encryption
- Personnel, access and engagement separation
- Sub-processors and subcontracted testing
- Processing locations and international transfers
- Security Incidents and notification
- Privacy requests and compliance assistance
- Retention, return and deletion
- Audit and assurance
- Liability and responsibility
- Suspension, termination and survival
- Notices and operational contacts
- How the contract documents work together
- Amendments and general terms
- Annex A — Processing Description
- Annex B — Sub-processor Register Requirements
- Annex C — Technical and Organisational Security Measures
Need to discuss your DPA?
Have questions about our data-processing terms or need to discuss your own DPA? Contact Trixent before processing begins. Proposed changes are reviewed against the engagement scope, data categories, approved providers, processing locations and security requirements.