Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between Akarguard (the “Processor”) and the customer using the Akarguard service (the “Controller”). It governs the processing of personal data that Akarguard carries out on the Controller’s behalf when providing DDoS protection.

For the traffic that flows through the Akarguard reverse-proxy edge, the customer decides why and how that data is processed and is the Controller; Akarguard acts only on the customer’s documented instructions and is the Processor, within the meaning of Article 4 GDPR.

The subject matter is the provision of DDoS protection: inspecting inbound HTTP/HTTPS requests at the edge, filtering attack traffic, and forwarding legitimate requests to the Controller’s origin. Processing lasts for as long as the customer uses the service, plus the limited retention periods set out below.

Akarguard processes personal data solely to deliver and secure the service:

• Terminating connections at the edge, inspecting requests, and applying the protection rules the customer configures.
• Detecting and mitigating denial-of-service and abusive traffic.
• Producing traffic statistics, mitigation events and attack reports for the customer’s own domains.
• Operating the customer panel, authentication, billing and support.

Data subjects are the visitors to the customer’s protected websites, and the customer’s own account users. The personal data processed is limited to what passing traffic and account management require:

• Visitor IP addresses and connection metadata (timestamps, requested host and path, HTTP method and status, user agent, approximate country and network/ASN).
• Challenge and session cookies set by the edge to distinguish browsers from automated clients.
• Account data for the customer’s users: email address, hashed password, and audit records of administrative actions.

Akarguard does not ask for, and the service is not designed to process, special categories of personal data (Article 9 GDPR). The customer must not route such data through the service for processing outside ordinary web traffic.

Akarguard shall, in accordance with Article 28(3) GDPR:

• Process personal data only on the Controller’s documented instructions, including this DPA and the service configuration, unless required to act otherwise by EU or Member State law (in which case it will inform the Controller, unless the law forbids it).
• Ensure that persons authorised to process the data are bound by confidentiality.
• Implement the technical and organisational security measures described in Section 6.
• Respect the conditions for engaging sub-processors set out in Section 7.
• Assist the Controller, taking into account the nature of processing, in responding to data-subject rights requests (Articles 15–22).
• Assist the Controller with its obligations under Articles 32–36 (security, breach notification, impact assessments), taking into account the information available to Akarguard.
• At the Controller’s choice, delete or return all personal data at the end of the service, and delete existing copies unless retention is required by law.
• Make available the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, subject to reasonable confidentiality and scheduling.

Akarguard applies technical and organisational measures appropriate to the risk. These currently include:

• Encryption in transit (TLS 1.2+) for the customer panel and API, and free TLS certificates for protected domains.
• Encryption at rest: the control-plane database sits on a LUKS/AES-256 volume, with encrypted nightly backups; account passwords are stored only as bcrypt hashes.
• Two-step sign-in (password plus a one-time code emailed to the account) and email confirmation at signup.
• Tenant isolation: each account can access only its own domains, rules, logs and API keys.
• An append-only audit trail of administrative changes (who, what, and the request IP).
• Network ingress filtering (BCP 38 / RFC 3704) at the edge to reject spoofed-source packets.
• Data minimisation and limited retention: raw edge access logs are rotated after 7 days; aggregated per-minute metrics are kept 90 days; audit records are kept 12 months.

Akarguard is an early-stage service and improves these measures over time; the current state is described honestly rather than as a fixed certification.

The Controller authorises Akarguard to engage sub-processors to provide the service. Akarguard remains fully liable to the Controller for any sub-processor’s performance, and imposes data-protection obligations on each that are no less protective than this DPA.

The current sub-processors are the infrastructure and email providers that host the Akarguard edge, control plane and transactional email. An up-to-date list is available on request from privacy@akarguard.net. Akarguard will give the Controller reasonable notice of any intended change so the Controller may object on reasonable data-protection grounds.

Akarguard’s infrastructure is hosted in the EU (Spain), so personal data processed for the service stays within the EEA under normal operation — there is no routine transfer to a third country. Should any transfer outside the EEA become necessary in the future, Akarguard will rely on an appropriate mechanism under Chapter V GDPR, such as the European Commission’s Standard Contractual Clauses, and update the sub-processor list accordingly.

Akarguard will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data, and will provide the information the Controller reasonably needs to meet its own notification obligations under Articles 33 and 34.

On termination, and at the Controller’s choice, Akarguard will delete or return the personal data it processes on the Controller’s behalf, and delete existing copies, except where EU or Member State law requires further storage. Short-lived operational logs age out automatically under the retention periods in Section 6.

For most customers this page, together with the Privacy Policy and Terms, sets out how Akarguard processes personal data on your behalf. If your organisation needs a countersigned copy, or a version on your own paper, email privacy@akarguard.net and we will arrange it.