Data Processing Addendum.

Customer acts as Controller (or Business under CCPA/CPRA) and EarlyBird AI, LLC d/b/a Threat.Blue acts as Processor (or Service Provider). Threat.Blue processes Personal Data incidentally contained in Customer repositories, commit histories, build logs, or engineering workflows (such as developer names, work email addresses, and code review metadata) strictly on Customer’s documented instructions for the sole purpose of discovering, reproducing, and patching software vulnerabilities.

• No secondary use: Threat.Blue never sells, rents, combines, or retains Customer Personal Data for marketing or cross-customer profiling.
• Zero AI training: Customer Materials and Personal Data are never used to train, fine-tune, or distill foundation models.
• Confidentiality obligations: All personnel authorized to access engagement environments are bound by written confidentiality agreements, hardware MFA, and least-privilege role controls.

Threat.Blue maintains technical and organizational security controls appropriate to high-sensitivity source code and vulnerability data:

• Single-tenant ephemeral compute: Every customer audit runs inside dedicated, network-isolated compute instances with no cross-tenant filesystem, memory, or container sharing.
• Encryption in transit & at rest: All external connections enforce TLS 1.2+ with modern AEAD cipher suites; EBS volumes and S3 buckets enforce AES-256 server-side encryption and aws:SecureTransport policies.
• Hardware-backed access control: Administrative access requires phishing-resistant authentication over private overlay networks (zero public SSH/RDP exposure, IMDSv2 hop-limit 1, and IAM Permissions Boundaries).
• Incident notification (48 hours): Threat.Blue notifies Customer without undue delay—and within forty-eight (48) hours—upon confirming any Personal Data Breach affecting Customer Materials, including root-cause forensics and containment actions.
• Post-engagement deletion & certification: Within seven (7) calendar days of engagement completion (or immediately upon Customer’s written request), ephemeral volumes and cloned repositories are destroyed. Written deletion confirmation is available on request.

Customer authorizes the following infrastructure sub-processors. Threat.Blue provides at least thirty (30) days’ advance notice before engaging any new sub-processor handling Customer Materials:

Where an engagement uses dedicated self-hosted models on EarlyBird AI’s isolated AWS compute instances, no Customer source code leaves our dedicated VPC. If a specific engagement scope optionally invokes frontier commercial model APIs under zero-data-retention (ZDR) enterprise agreements, the applicable model provider is disclosed and approved in Customer’s Statement of Work prior to execution.

To request a countersigned PDF copy of this DPA or submit security audit inquiries, contact security@threat.blue.