Legal

Hosted report data-processing terms

Version: 19 October 2026

These terms form part of the Dokima subscription or trial agreement when the Customer enables private team publishing. Customer is controller (or an authorised processor acting on its controller’s instructions); Northloom Ltd is processor for personal data contained in hosted reports. Northloom remains an independent controller for account, billing, licensing and service-security administration described in the Privacy Notice. These terms take priority for processing hosted report personal data, subject to a signed data-processing agreement that expressly supersedes them.

Instructions and purpose

Customer instructs Northloom to receive status and complete report snapshots over HTTPS, store the latest report, and display it only to authorised organisation members. Processing lasts while private publishing and retention continue, followed by deletion or return. The subject matter is private software security review reporting; operations are receipt, storage, access control, display, export and deletion. Data can include developer identities, repository names, paths, evidence/source excerpts and vulnerability descriptions. Data subjects can include Customer personnel, contractors and people incidentally identified in submitted evidence. Customer must minimise personal data and must not intentionally submit special-category or criminal-offence data.

Northloom processes this data only on documented Customer instructions, including these terms and authorised account actions, unless law requires otherwise. Northloom informs Customer of such a legal requirement unless prohibited and alerts Customer if an instruction appears to infringe applicable data-protection law. Customer is responsible for lawful collection, disclosure, notices and authority to instruct processing.

Protection and assistance

Northloom limits authorised personnel to a need-to-know basis under confidentiality duties. Technical measures include TLS, isolated service credentials/state, organisation-scoped authorisation, upload-only installation credentials, revocable membership, bounded uploads, secure cookies, escaped report rendering and controlled recovery access. Hosted publishing does not provide end-to-end encryption: authorised service operators can access stored report data to operate and secure the service.

Taking account of the processing and available information, Northloom assists Customer with data-subject requests, security obligations, impact assessments, consultations and personal-data breach duties. Northloom informs Customer without undue delay after becoming aware of a breach involving hosted personal data and provides available information and updates. Northloom directs requests concerning Customer report data to Customer unless legally required otherwise.

Providers, location and transfers

The configured hosted-report infrastructure uses Vultr in Manchester, United Kingdom, and encrypted recovery storage uses Backblaze B2 in Amsterdam, Netherlands. Customer authorises necessary hosting and encrypted recovery-storage subprocessors under equivalent written data-protection obligations. Northloom remains responsible for their performance. Before hosted processing begins, Northloom provides the current subprocessors, processing locations and applicable international-transfer safeguards through the Customer’s service record or written agreement. Northloom gives advance notice of material additions or substitutions and a reasonable opportunity to object on data-protection grounds; if no reasonable alternative resolves the objection, Customer may stop private publishing and request deletion without losing local-report functionality.

Dokima authenticates accounts using passwords or passkeys. Resend delivers transactional verification, recovery and invitation email, not vulnerability reports, and is not authorised to use Customer report content for its own purposes. Restricted international transfers require an applicable adequacy decision or appropriate contractual safeguards before processing begins.

Return, deletion and verification

Customers retain local HTML reports and can read the current hosted snapshot while authorised. Only the latest hosted snapshot is retained per installation. Report/status payloads expire after 30 days without contact, with hourly cleanup. Owner/admin deletion removes the active payload and publishing credential immediately. On termination or Customer instruction, Northloom deletes or returns report data and deletes remaining copies except where law requires retention. Encrypted recovery copies are isolated from ordinary use and can retain deleted data for years. The managed recovery schedule retains snapshots from the most recent 48 hours, plus 30 daily, 12 weekly, 24 monthly and five yearly snapshots; active deletion and 30-day report expiry do not immediately erase those recovery copies. Recovery copies expire through that managed schedule. Deletion, revocation and current access-policy records must be reconciled and reapplied before restored access reopens; otherwise the restored service stays closed.

Northloom provides information reasonably necessary to demonstrate compliance and permits proportionate audits or inspections by Customer or its mandated auditor, subject to reasonable confidentiality, security and scheduling arrangements that do not prevent statutory rights. Customer can request assistance, a processing record, subprocessor/location details or deletion through support@dokima.net.