These Annexes form part of, and are incorporated into, the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021. Module 2 (Transfer from Controller to Processor) applies where:
These Annexes must be read together with the full text of the SCCs as published by the European Commission. In the event of any conflict between these Annexes and the SCC clauses, the SCC clauses prevail.
These Annexes are also incorporated by reference into the Shieldome Data Processing Agreement.
Identifies the data exporter and data importer
| Field | Details |
|---|---|
| Name | [Full legal name of the Customer / Controller — to be completed by Customer] |
| Address | [Registered address of the Customer — to be completed by Customer] |
| Contact person | [Name, email, and role of the Customer's data protection contact] |
| Role in these clauses | Controller (data exporter) |
| Activities relevant to the transfer | The Customer uses the Shieldome platform to perform web vulnerability assessments and security scans of systems it is authorised to test, and for associated account management and reporting functions. |
| Signature and date | [To be completed by Customer at execution] |
| Field | Details |
|---|---|
| Name | NEMANJA MILJKOVIĆ PR RAČUNARSKO PROGRAMIRANJE SHIELDOME KRAGUJEVAC |
| Address | Republic of Serbia |
| Contact person | Data Protection Contact, NEMANJA MILJKOVIĆ PR RAČUNARSKO PROGRAMIRANJE SHIELDOME KRAGUJEVAC — [email protected] |
| Role in these clauses | Processor (data importer) |
| Activities relevant to the transfer | Shieldome operates the web security scanning platform at app.shieldome.com and shieldomescout.com (vulnerability assessment as a service). It processes scan targets, scan results, account data, and related configuration data on behalf of the Customer. |
| Signature and date | Accepted on behalf of NEMANJA MILJKOVIĆ PR RAČUNARSKO PROGRAMIRANJE SHIELDOME KRAGUJEVAC upon the Customer's acceptance of the Terms of Service, which incorporates this DPA and these Annexes. |
Categories of data subjects, personal data, and purposes
| Category | Examples | Notes |
|---|---|---|
| Account identifiers | Email address, full name, account ID | Used to authenticate and identify platform users |
| Scan targets | URLs, domain names, IP addresses, IP override values | Submitted by the Customer for scanning; may coincidentally identify internal infrastructure |
| Scan results and findings | HTTP responses, vulnerability descriptions, severity ratings, SSL certificate data | Generated by Shieldome's scanning engine on Customer instruction |
| Integration configuration | Webhook URLs (encrypted at rest), SSO secrets (encrypted at rest), scan tags and notes | Customer-supplied integration settings |
| Usage and security metadata | Login timestamps, IP addresses of platform users, user-agent strings | Retained for 90 days for security monitoring purposes |
The parties do not intend to transfer special categories of Personal Data as defined in GDPR Art. 9. The Customer confirms that scan targets and results submitted to the platform do not intentionally include health data, biometric data, data revealing racial or ethnic origin, political opinions, religious beliefs, genetic data, or data concerning a natural person's sex life or sexual orientation.
Shieldome's scanning engine performs passive vulnerability assessment only. It does not harvest, extract, or retain Personal Data of end-users of the websites being scanned. Scan results reflect structural and configuration properties of the target, not user records.
The competent supervisory authority for these SCCs is determined as follows:
| Scenario | Supervisory Authority |
|---|---|
| Customer (data exporter) is established in an EU Member State | The data protection authority of the EU Member State in which the Customer is established. A list of EU DPAs is available at edpb.europa.eu. |
| Customer is not established in an EU Member State but processes data on behalf of EU residents (Art. 3(2) GDPR) | The supervisory authority of the EU Member State in which the Customer's EU representative is established, or (if none) the supervisory authority of the EU Member State where the majority of affected Data Subjects are located. |
| For Shieldome's own processing as Controller (account and billing data) | Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), Republic of Serbia — poverenik.rs |
Security measures implemented by Shieldome as data importer / Processor
These measures were current as of August 7, 2026 and are subject to periodic review and improvement. Shieldome will not implement changes that materially reduce the level of protection afforded by these measures without prior notice to affected Customers.
All data exchanged between users and the Shieldome platform is encrypted using HTTPS with TLS 1.2 or higher. TLS certificates are issued by a public CA and renewed automatically. Insecure HTTP connections are redirected to HTTPS with HSTS headers enforced.
Sensitive configuration data (webhook URLs for Slack, Teams, Discord, PagerDuty, OpsGenie; SSO client secrets for SAML/OIDC integrations) is encrypted at rest using AES-256 in Fernet symmetric authenticated encryption mode. The encryption key is stored separately from the encrypted data. Database volumes are additionally encrypted by AWS at the infrastructure level.
User passwords are hashed using bcrypt with a minimum cost factor of 12. Plaintext passwords are never stored or logged. Password reset tokens are single-use, time-limited, and cryptographically random.
Time-based One-Time Password (TOTP) two-factor authentication is available to all users and encouraged for all accounts. TOTP secrets are stored encrypted at rest. Administrator accounts are required to use 2FA.
Databases (RDS PostgreSQL) and caching services (ElastiCache Redis) operate within AWS VPC private subnets in the eu-central-1 (Frankfurt) region. These resources have no direct public internet access. All external traffic flows through Application Load Balancers with appropriate security group rules. NAT Gateways control outbound connectivity for scanning workloads.
Access to Customer data within Shieldome's systems is restricted by role-based access controls. Internal personnel access is granted on the principle of least privilege and reviewed periodically. API keys are stored in hashed form; plaintext keys are shown once at creation and not retained.
Session cookies are issued with HttpOnly, Secure, and SameSite=Lax flags. Sessions expire after 7 days of inactivity. CSRF protection is enforced on all state-changing API endpoints.
A daily automated job enforces the retention limits described in the DPA: activity logs purged after 90 days, email logs after 180 days, scan results after 24 months. Automated deletion reduces the risk of data being retained longer than necessary and limits the scope of any potential breach.
Login events, authentication failures, permission changes, and significant administrative actions are logged and retained for 90 days. Logs are stored in a segregated system with restricted write access. Anomalous access patterns trigger alerts for review.
Shieldome maintains a documented incident response procedure. Confirmed or reasonably suspected Personal Data Breaches are escalated immediately to designated response personnel. Affected Customers are notified within 48 hours of Shieldome becoming aware of the breach. Shieldome cooperates with Customers to support 72-hour supervisory authority notifications where required.
Shieldome conducts an annual review of its security controls, including review of access rights, review of sub-processor DPAs and certifications, and assessment of technical measures against current threats. Material gaps identified during reviews are remediated within a documented timeframe. Results of assessments are available to Customers upon request under NDA.
Each Sub-processor is required to sign a data processing agreement with security obligations no less protective than those in this Annex. Sub-processor compliance is reviewed at least annually. Material changes to Sub-processors are communicated to Customers with at least 14 days' notice.
Third parties engaged by Shieldome to process Personal Data on the Customer's behalf
The Customer grants general written authorisation for Shieldome to use the following Sub-processors. Shieldome will notify the Customer of any additions or replacements with at least 14 days' prior notice.
| Sub-processor | Purpose | Location | Transfer Mechanism | Data Processed |
|---|---|---|---|---|
| Amazon Web Services, Inc. Services: ECS Fargate, RDS PostgreSQL, ElastiCache Redis, S3, ALB, CloudWatch |
Cloud infrastructure: compute, database, caching, storage, load balancing, monitoring | eu-central-1 (Frankfurt, Germany) — within the EEA | No transfer mechanism required; data remains within the EEA. AWS DPA applies (aws.amazon.com/agreement). | All categories of Personal Data described in Annex I.B |
| Resend Inc. resend.com |
Transactional email delivery: scan completion notifications, SSL certificate expiry alerts, password reset emails, billing receipts, security alerts | United States | EU Commission Standard Contractual Clauses (Decision 2021/914, Module 2). Transfer Impact Assessment available at /legal/transfer_impact_assessment.html. | Email address, name, and content of transactional notifications only. No scan results or vulnerability data. |
| Google LLC Google Identity / OAuth 2.0 |
Optional OAuth 2.0 authentication ("Sign in with Google") — used only when the Customer's users choose this login method | United States | EU Commission Standard Contractual Clauses (Google Workspace and Cloud Identity DPA, incorporating SCCs). | OAuth token exchange only: email address and name returned by Google OAuth for account identification. No scan data, billing data, or vulnerability findings are transmitted to Google. |
As noted above, Serbia holds an EU adequacy decision and SCCs are not legally required for EU→Serbia transfers. However, if your organisation's legal or compliance programme requires a countersigned SCC agreement: