Data Processing Agreement

Why this exists

A FiveM resource often contains personal data belonging to people who are not you: player identifiers, Steam IDs, licence identifiers, sometimes credentials or webhook URLs. When you upload an archive containing such data, you decide why it is being processed and are the controller; Titan Software z.s. processes it on your behalf and is the processor.

These terms satisfy Article 28(3) GDPR for that relationship. They form part of the Terms of Use and apply automatically — there is nothing separate to sign. They do not cover your own account data, for which Titan Software is the controller and the Privacy Policy applies.

Subject matter and duration

Subject matter: static security analysis of archives you upload. Duration: for as long as you have an account, and for each archive no longer than the retention periods below. Nature and purpose: reading, hashing, parsing and pattern-matching the files in order to produce a security report for you.

Types of personal data: whatever the archive happens to contain. In practice this is most often game-platform identifiers (Steam IDs, FiveM licence identifiers), account names, URLs and webhook addresses, and occasionally credentials embedded in source. Categories of data subject: players, staff and customers of the server the resource is written for, and the resource's authors.

FXScan is not intended for special categories of personal data under Article 9, and you should not upload archives containing them.

Our obligations

• Documented instructions only. We process the content of your archives solely to produce your report and to operate the service. Uploading an archive is your instruction to do so. We do not use it for anything else, and we do not train anything on it. If we ever believe an instruction breaches data protection law we will say so rather than carry it out.
• Confidentiality. Everyone with access is bound to confidentiality, and access is limited to those who need it to run the service.
• Security. The measures in the next section are applied and maintained.
• Sub-processors. Only those listed below, each under equivalent obligations. We will announce any change before it takes effect so that you can object by closing your account.
• Assistance. We help you respond to data subject requests and, taking into account what we know, to your obligations under Articles 32 to 36.
• Breach notification. If personal data you entrusted to us is breached, we will tell you without undue delay and give you what you need to notify your own supervisory authority within the 72 hours Article 33 allows.
• Audit. We will provide the information needed to demonstrate compliance with this agreement and cooperate with an audit you reasonably request.

Security measures

These are the measures actually implemented, not aspirations:

• Analysed code is never executed. Archives are read, hashed and parsed. There is no evaluation, no child process, and no outbound request to anything found inside them.
• Extraction is bounded and contained. Path traversal, symbolic links, decompression bombs and archives that misreport their own size are rejected, and extraction happens in an ephemeral workspace that is destroyed afterwards.
• Isolation by account. Every scan belongs to one account and ownership is part of the database query itself, so a report cannot be reached by guessing an identifier.
• Encryption in transit (TLS, with HSTS), and secrets encrypted at application level.
• Authentication delegated to a central identity provider; sessions are random tokens of which only a hash is stored; API keys are stored hashed and scoped.
• Indicator values are redacted everywhere the application and the API return them.
• An audit trail of access and administrative action, retained 24 months.

Sub-processors

The content of your archives is stored by the hosting and storage provider only. Stripe and the e-mail provider are involved in your account and billing, not in archive content.

• our hosting provider (see the current subprocessor list) — hosting, compute and object storage for uploaded archives and reports.
• Titan Auth (Titan Software z.s.) — authentication.
• Stripe Payments Europe, Ltd. — payments (account data only).
• our e-mail delivery provider (see the current subprocessor list) — service e-mail (account data only).

International transfers

Archive content is stored within the European Economic Area and is not transferred outside it. Where a sub-processor involved in account or billing data transfers outside the EEA, it does so under the safeguards required by Chapter V GDPR.

Deletion and return

Deletion is automatic and does not require a request:

• Uploaded archive: 7 days.
• Report, findings and extracted indicators: 90 days.
• Sanitized archive: 7 days.
• Extraction workspace: destroyed when the scan finishes.

You can delete any scan immediately from the interface or the API, and deleting your account deletes every archive and report attached to it. Because you can export a report at any time while it exists, no separate return step is needed at the end of the agreement — but if you ask for a copy before deletion, we will provide one.

Your obligations

You warrant that you have a lawful basis for the personal data contained in what you upload, and the right to have it analysed. Do not upload archives containing personal data you have no right to process, and do not upload special-category data. You remain responsible for informing your own data subjects as your own privacy notice requires.

Contact

Anything arising under this agreement, including a breach notification or an audit request: [email protected].