Varaxon Scan Hub — Data Processing Addendum

Document set version: v3.5, effective October 27, 2026
Last updated: October 27, 2026
Business: Varaxon Technologies LLC
Service: Varaxon Scan Hub (https://scan.varaxontech.com)
Contact: support@varaxontech.com
Effective date: The date the customer accepts the Terms of Service, of which this Addendum forms part

This Data Processing Addendum (the "DPA") forms part of the Varaxon Scan Hub Terms of Service between Varaxon Technologies LLC ("Varaxon") and the customer organization identified in the account ("Customer"). It applies whenever Varaxon processes Customer Data on behalf of a Customer that uses the service for a business. For an individual using the service for personal purposes, the Privacy Policy describes how that individual's data is handled, with the same commitments on AI training, retention, and deletion. A countersigned copy is available on request from support@varaxontech.com.

1. Roles and scope

"Customer Data" means personal data and other information that Customer submits to the service or directs the service to collect, including uploaded scan exports, files submitted through the upload API, data pulled from a connection Customer sets up (such as Microsoft Defender Vulnerability Management or ConnectSecure), the findings and reports created from that data, ticket drafts, and report branding such as logos and "Prepared for" names. It does not include account, billing, security, support, or service-usage records, for which Varaxon determines the purposes of processing.

For Customer Data, Customer is the Controller (or equivalent "business") and Varaxon is the Processor (or "service provider"). If Customer processes the data for an end client, Customer may be a Processor and Varaxon acts as Customer's Subprocessor. In either case, Customer represents that it has authority from the relevant Controller to appoint Varaxon and give the instructions in this DPA, and that it will pass on any legally required instructions. Customer remains responsible for having a lawful basis, giving required notices, obtaining required permissions, and ensuring its scans, exports, and connections are authorized.

For account registration, billing, security, support, and service-usage records, Varaxon is an independent controller as described in its Privacy Policy, outside the processor scope of this DPA.

2. Processing instructions and purpose

Varaxon will process Customer Data only to provide, secure, maintain, and support the service; to parse, enrich, and track findings; to generate reports and ticket drafts; to deliver approved tickets to the systems Customer connects; to comply with Customer's documented instructions; or as required by law. Customer's use of the service's features, including starting a report, turning on an automatic report schedule, submitting a file through the upload API, or approving tickets, is an instruction.

Varaxon will not sell or share Customer Data, use it for advertising, retain, use, or disclose it for any purpose other than providing the service, or combine it with personal information from other sources except as the service requires. Varaxon will not use Customer Data to train an AI model and will not permit its subprocessors to do so.

3. Data and data subjects

Depending on what Customer submits, Customer Data may include hostnames, IP and MAC addresses, ports and services, operating systems and installed software, user or account names appearing in scanner or device data, vulnerability identifiers and descriptions, and other system or security information. Data subjects are typically Customer's or its clients' personnel whose names or devices appear in that data. Customer determines the categories it submits and must not submit data it is not authorized to process or that the Terms of Service prohibit.

Customer Data also includes risk acceptances Customer records and sign-off records for them: the signer's name, job title, email address, the time, IP address and browser of the signature, and the wording agreed to. Data subjects then also include the people at Customer's clients who are asked to sign.

4. AI processing

The service uses Anthropic's Claude models to read unfamiliar file layouts (including locating the findings in an unusually structured export), enrich findings, and write reports, proof pack summaries, and ticket drafts. Risk rankings, ticket priorities, and TLS audit ratings are set by Varaxon's software, not by the AI. Before Customer Data is sent to Anthropic, the service automatically replaces hostnames, IP and MAC addresses, email addresses, and fields that name a host, user, client, or tenant with placeholders. The key linking placeholders to real values stays with Varaxon. Public vulnerability identifiers, finding titles, remediation text, the export's field names, and Customer's own "Prepared by" name are sent as they are. For file reading, the field names, the location and size of each record set, and a bounded sample of records (up to 22 records, and two records per candidate record set) are sent; for a file with that few records, the sample can be the whole file. Placeholder replacement is pattern-based and is a safeguard, not a guarantee. Anthropic processes this data under its commercial terms, which prohibit training on it and provide for deletion within 30 days, subject to Anthropic's policy-enforcement and legal exceptions. For a proof pack summary, only the pack's counts and dates, a bounded number of issue titles, and Customer's "Prepared by" name are sent. Proof pack control mappings and insurance answers are set by Varaxon's software, not by the AI. Signer details in risk acceptances and sign-off records, the client's name, and acceptance reasons are never sent to Anthropic for a proof pack.

Varaxon personnel also use Anthropic's Claude as a tool to operate, maintain, and support the service. When they investigate a support request, a failed report, or a security event, that tool can read the records involved, including account records and Customer Data such as real hostnames, without the placeholder replacement described above. Varaxon uses it only for the task at hand, under Anthropic terms that do not permit Anthropic to train its models on that data.

5. Confidentiality and personnel

Varaxon will restrict access to Customer Data to personnel and contractors who need it to provide or support the service and are bound by confidentiality obligations. Varaxon designs its application logs and emails to exclude scan contents, findings, hostnames, and report text.

6. Security measures

Varaxon maintains a security program designed to use reasonable technical and organizational measures appropriate to the nature and risks of processing. Depending on the service configuration, those measures include:

• encryption of Customer Data in transit (TLS) and at rest;
• database row-level security that limits each organization's data to its own members;
• multi-factor authentication required for every user before Customer Data can be read;
• strong-password rules and leaked-password checks;
• an activity log of security-relevant actions, visible to Customer's owners and admins;
• private file storage reachable only through short-lived signed links;
• storage of connection credentials in an encrypted vault, deleted when the connection is removed;
• storage of upload API keys only as one-way hashes, with keys created and revoked by Customer's owners and admins;
• read-only, tenant-specific access for Microsoft Defender connections, revocable by Customer's administrator;
• review-and-approve before any ticket is sent to a connected system;
• pseudonymization of identifiers before AI processing; and
• automated deletion of raw uploads within 7 days.

Varaxon may update these measures over time, provided the overall level of protection is not materially reduced. Varaxon maintains an internal security-control summary that may be made available for reasonable due-diligence purposes under confidentiality obligations. The summary is informational, is not incorporated into this Addendum, and does not modify or expand Varaxon's contractual obligations.

Customer is responsible for its own endpoint security, for its users' credentials and MFA devices, for managing who belongs to its organization and their roles, for its authorization to scan and connect systems, and for secure handling of downloaded reports.

7. Subprocessors

Customer authorizes the following subprocessors, used only as needed for the service:

Microsoft, ConnectSecure, HaloPSA, and ConnectWise are not Varaxon's subprocessors. They are Customer's own providers, and Varaxon exchanges data with them only when Customer sets up a connection and only within the access Customer grants.

Public vulnerability-intelligence sources (such as CISA, FIRST, NVD, and the Greenbone community feed) are not subprocessors either. Varaxon downloads copies of their public data to its own servers, and the service never sends Customer Data to them.

Public DNS resolvers (Google Public DNS and Cloudflare DNS) and domain registries' public registration (RDAP) services are not subprocessors. When Customer runs an email and domain check, the service sends them only the domain names being checked, as ordinary public lookups, and no other Customer Data.

A material subprocessor change is the addition or replacement of a vendor that processes Customer Data or account data on Varaxon's behalf. Varaxon will keep this list current and give at least 30 days' advance notice of a material change, by email to Customer's owners or in the service, unless an urgent security or legal circumstance requires a shorter period. Customer may raise a reasonable, documented objection on data-protection grounds. If the parties cannot resolve it, they will discuss a commercially reasonable alternative or termination of the affected service with a pro-rata refund of prepaid fees for it. Varaxon remains responsible for its subprocessors' performance of the obligations in this DPA.

8. Assistance

Taking into account the nature of processing, Varaxon will reasonably assist Customer with data-subject requests, security assessments, and legally required breach or regulator inquiries. Varaxon will acknowledge a specific, verified request without undue delay and, where reasonably practicable, provide the requested assistance within 10 business days, provided Customer supplies the information reasonably needed to identify the account or request. Customer remains responsible for responding to data subjects and regulators and for meeting deadlines that apply to it as Controller.

9. Personal-data incidents

Varaxon will notify Customer without undue delay and, where reasonably practicable, within 24 hours after confirming a breach of Customer Data in Varaxon's or its subprocessors' possession or control. The notice will describe the known nature of the incident, the likely categories affected, the steps taken to contain it, and a contact for follow-up, The first notice may be brief and give only what is known at the time; Varaxon will update it as more becomes known. Varaxon will not include unnecessary Customer Data in an incident notice.

10. Retention, return, and deletion

• Raw uploaded files and raw data pulled from connections are deleted automatically within 7 days, or sooner if Customer selects a shorter period. A scan that is still being processed when its period ends is kept at most one more day.
• Findings, reports, report PDFs, report logos, ticket records, risk acceptances, and sign-off records are kept until Customer deletes them, asks Varaxon to delete them, or closes its account. Customer's owners and admins can delete a client or a scan in the service, which deletes the findings and reports created from it and the related files in storage.
• Customer's owners and admins can download an export of Customer Data at any time in the service: a ZIP file of CSV tables (including findings, reports, tickets, risk acceptances and sign-off records, and the activity log) and report PDFs, without connection secrets and without raw uploads.
• An owner can close Customer's organization in the service once its plan is no longer active, which deletes Customer Data immediately. On a verified written request from an owner of Customer's organization, Varaxon will delete Customer Data within 30 days, unless the law requires it to be kept.
• Deleted Customer Data can remain in encrypted database backups for up to 7 days until those backups expire. Backups are used only to recover from failures.

Account, billing, and security records may be kept as described in the Privacy Policy.

11. Audits and information

Varaxon will make available reasonable information necessary to demonstrate compliance with this DPA, including its subprocessor list and a summary of its security measures. Any audit must be reasonable in scope, give reasonable notice, protect other customers' confidentiality, avoid access to other customers' data, and occur no more than once a year unless a confirmed incident or a regulator requires otherwise. Customer bears its own audit costs.

12. International transfers

Varaxon does not accept Customer Data subject to European Union, United Kingdom, or Swiss data-protection transfer restrictions unless the parties have first executed an appropriate written transfer arrangement. Standard Contractual Clauses are an actual transfer mechanism that must be executed, not a general undertaking to adopt one later. Customer must not submit such data before that arrangement is in place.

Varaxon stores Customer Data in the United States. Anthropic, Resend, Stripe, Cloudflare, and Namecheap may process data in other locations under their terms, as noted in Section 7. If Customer's own obligations require a specific transfer mechanism, the parties will agree it in writing before Varaxon processes the affected data.

13. Order of precedence and term

This DPA remains in effect while Varaxon processes Customer Data. If it conflicts with the Terms of Service on data-protection matters, this DPA controls to the extent of the conflict. Liability limits, fees, and other commercial terms remain governed by the Terms of Service unless this DPA expressly states otherwise.