---
title: "Data Processing Addendum (DPA) · Syba"
description: "The terms under which Syba processes personal data on behalf of a customer, and how to request a signed copy of the Data Processing Addendum."
canonical: https://sybainsurance.com/trust/dpa
---

Trust center

# Data Processing Addendum (template).

This is the template SYBA processes org and seat data under when a customer is the controller and SYBA is the processor. It is not a substitute for a countersigned agreement. An Enterprise (25+ seat) customer can request one signed for their organization; see the request link at the bottom of this page.

## 1. Roles

The customer organization is the data controller for its members’ personal data processed through the SYBA Shield extension and console. SYBA (Syba, Inc. / Syba Europe BV, depending on the account’s billing entity) is the processor, acting only on the controller’s documented instructions: running the product as configured.

## 2. Subject matter, nature and duration

Processing phishing-relevant signals (URLs, email metadata, screenshots on escalation) to detect and block phishing for the org’s seats, for as long as the subscription is active plus the retention periods on [the retention page](https://sybainsurance.com/trust/retention). The exact fields per tier, their receivers and their retention are enumerated in `docs/data-flow-contract.md` and summarized at [data flow](https://sybainsurance.com/trust/data-flow).

## 3. Categories of data subjects and data

The controller’s employees (seat holders). Account identifiers (work email, name), device check-in counts, reported-phish URLs, and: only when a seat enables the cloud vision tier: a downscaled page screenshot. No categories of special data (Art. 9 GDPR) are processed by design.

## 4. Sub-processors

SYBA uses the sub-processors listed at [subprocessors](https://sybainsurance.com/trust/subprocessors), rendered directly from the one list this contract is graded against. The controller consents to that list as it stands at the time of signing and to updates SYBA publishes there; material changes affecting an Enterprise contract are notified to the account owner.

## 5. Security measures

The technical and organizational measures SYBA runs are listed, with the file each one is implemented in, at [security](https://sybainsurance.com/trust/security).

## 6. Data subject rights and deletion

SYBA assists the controller in responding to a data subject request. A verified deletion request purges every store enumerated at [retention](https://sybainsurance.com/trust/retention) through the account deletion endpoint, revoking the seat and scrubbing audit rows to a hash: never deleting the org’s own billing or last-owner records outright, for the reasons stated on that page.

## 7. International transfers

Where a sub-processor operates outside the EEA, the transfer relies on that provider’s own Data Processing Addendum incorporating Standard Contractual Clauses. For EU-resident seats, SYBA additionally blocks AI providers with no EU adequacy decision at the routing layer, described on the [security](https://sybainsurance.com/trust/security) page. A signed DPA per sub-processor is an ongoing operational task and is not asserted here as executed for every provider.

## Request a signed copy

Enterprise (25+ seat) customers can request a DPA countersigned for their organization through the same channel as a PO/invoice billing or managed-deployment request.

[Talk to us about Enterprise](https://sybainsurance.com/enterprise)

## More from the trust center

- [Trust center](https://sybainsurance.com/trust)
- [Security](https://sybainsurance.com/trust/security)
- [Data flow](https://sybainsurance.com/trust/data-flow)
- [Subprocessors](https://sybainsurance.com/trust/subprocessors)
- [Retention](https://sybainsurance.com/trust/retention)