Data Processing Addendum

Template updated: August 23, 2026

This page summarizes intended business data-processing terms. It is a template pending review and signature by legal counsel.

Roles and instructions

The customer is controller of managed-device data and FortiSPY is processor. FortiSPY processes data only to deliver, secure and support the service on documented instructions.

Confidentiality and security

Personnel with access are bound by confidentiality. Measures include encrypted transport, encryption of sensitive stored fields and screenshots, tenant authorization, access logging, credential hashing and recovery procedures.

Subprocessors

Infrastructure, email, object-storage and payment providers may be used. A production DPA must list their legal names, locations, functions and notice process.

Assistance and incidents

FortiSPY will reasonably assist with data-subject requests and assessments. Confirmed personal-data breaches will be reported without undue delay, with available details and remediation.

Deletion and audit

At termination, customer data will be returned or deleted according to retention and legal obligations. Reasonable compliance information will be available subject to confidentiality and security limits.

Request a signed production DPA at privacy@fortispy.com.