Version 1.0 · 7 November 2026

Data processing agreement (DPA)

This agreement supplements the terms of sale in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR). It applies whenever the Customer submits personal data to CTI Forecast as part of the service. A signed copy is available on request at [email protected]. The French version prevails in case of discrepancy.

1. Parties and roles

Processor: Karim EL BOUNI, sole proprietor trading as CTI Forecast, SIRET 79918632500020, 28 rue Sœur Janin, 69005 Lyon, France ("CTI Forecast").
Controller: the Customer holding a CTI Forecast account.

For account data (email, company, billing, usage statistics), CTI Forecast acts as controller; this processing is described in the legal notice and is outside the scope of this agreement.

2. Subject matter of the processing

• Nature: matching values submitted by the Customer (IP addresses, domain names, URLs, file hashes) against the CTI Forecast threat intelligence feed, through the API, TAXII 2.1 or blocklists.
• Data: the values submitted by the Customer, which may be personal data when they are, for example, IP addresses taken from its logs.
• Data subjects: users, visitors or correspondents of the Customer's information systems.
• Purpose: detecting and preventing cyber threats on behalf of the Customer.
• Duration: the time needed to process each request. CTI Forecast does not store looked-up values: they are neither saved in a database nor written to server logs. Only the number of requests per day and per account is kept, to enforce quotas.

3. Obligations of CTI Forecast

1. Process the data only on the Customer's documented instructions, consisting of its requests and this agreement, and never use it for any other purpose, in particular to enrich the feed, train a model or disclose it to a third party.
2. Ensure confidentiality: only the publisher has access to the systems and is bound by secrecy.
3. Implement the security measures described in section 5.
4. Only use the sub-processors listed in section 4, and notify the Customer of any change by email at least 30 days in advance; the Customer may object and terminate without charge.
5. Assist the Customer in responding to data subject requests and in meeting its obligations under Articles 32 to 36 of the GDPR.
6. Notify the Customer of any personal data breach without undue delay and no later than 48 hours after becoming aware of it, with the information available.
7. Make available to the Customer the information necessary to demonstrate compliance with this agreement and allow reasonable audits, with 30 days' notice, at most once a year except after a confirmed breach.
8. Immediately inform the Customer if an instruction appears to infringe data protection law.

4. Sub-processors

Looked-up values pass through the Cloudflare network (TLS encryption up to the server) but are not transmitted to any other provider. Transfers outside the European Union rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.

5. Security measures

• Encryption in transit (TLS 1.2 minimum, HSTS); no inbound port of the server exposed to the Internet.
• API keys and passwords stored only as irreversible hashes.
• Two-factor authentication available for accounts, mandatory for administration.
• Server logs without URL parameters, kept for 90 days at most.
• Encrypted backups stored in France, immutable for 30 days (ransomware protection), restore tested.
• Firewall, security updates, continuous availability monitoring.
• Responsible disclosure policy: security.

6. End of contract

As CTI Forecast does not store looked-up values, no entrusted data needs to be returned at the end of the contract. Account data is deleted as soon as the Customer deletes the account from "My account", then disappears from encrypted backups by rotation within 13 months at most.

7. Governing law

This agreement is governed by French law. Any dispute falls under the courts designated in the terms of sale.