GDPR Article 30
A structured record of all personal data processing activities conducted by Find The Breach LLC, as required by GDPR Article 30.
Last Updated: February 23, 2026
| Processing Activity | Purpose | Legal Basis | Data Categories | Recipients | Retention | Transfer Mechanism |
|---|---|---|---|---|---|---|
| Account Registration & Authentication | Provide access to scanning platform | Art. 6(1)(b) — Contract performance | Email, hashed password, name, company, MFA secrets (encrypted) | Hetzner (hosting), Cloudflare (CDN/WAF) | Account lifetime + 30 days | EU-US DPF, SCCs |
| Vulnerability Scanning | Execute security scans on authorized targets | Art. 6(1)(b) — Contract performance | Target URLs/IPs, scan results, vulnerability findings, HTTP responses | Hetzner (hosting), NVD API (CVE enrichment) | 90 days (configurable) | EU-US DPF |
| Vulnerability Reports & Evidence | Generate downloadable compliance and security reports | Art. 6(1)(b) — Contract performance | Scan findings, severity scores, remediation guidance, evidence data | Hetzner (hosting) | 90 days | N/A (EU-hosted) |
| Payment Processing | Process subscription payments | Art. 6(1)(b) — Contract performance | Billing name, email, payment method (tokenized by Stripe) | Stripe (PCI DSS Level 1) | 7 years (tax/legal) | EU-US DPF, SCCs |
| Transactional Email | Send account notifications, scan alerts, reports | Art. 6(1)(b) — Contract performance | Email address, notification content | Email provider (SMTP) | 30 days (logs) | SCCs |
| Activity Logging & Audit Trail | Security monitoring, compliance audit trail | Art. 6(1)(f) — Legitimate interest (security) | User ID, action type, IP address, timestamp, request details | Hetzner (hosting) | 1 year | N/A (EU-hosted) |
| CVE & Threat Intelligence Enrichment | Enrich findings with CVE, EPSS, CISA KEV data | Art. 6(1)(b) — Contract performance | CVE identifiers, CVSS scores (no personal data) | NVD (NIST), CISA, FIRST.org | 30 days (cache) | Public data sources |
| AI Security Copilot | AI-assisted vulnerability analysis and remediation guidance | Art. 6(1)(a) — Consent (opt-in feature) | Scan context, vulnerability descriptions (anonymized before processing) | LLM provider (configurable, no PII sent) | Session only (not persisted) | SCCs / DPF per provider |
| Webhook & Integration Delivery | Deliver scan results to user-configured endpoints | Art. 6(1)(b) — Contract performance | Scan results, webhook URLs, delivery status | User-specified endpoints (Slack, etc.) | 30 days (delivery logs) | Per user configuration |
Encryption
Access Control
Monitoring
Infrastructure
Individuals may exercise their rights under GDPR Articles 15-22 by contacting privacy@findthebreach.com. We respond within 30 days.
Where personal data is transferred outside the EEA/UK, we rely on the following mechanisms:
Transfer Impact Assessments. We conduct Transfer Impact Assessments (TIAs) for all international transfers in accordance with EDPB Recommendations 01/2020, evaluating the laws of destination countries and supplementary measures needed. TIA documentation is available to Enterprise customers upon request.