Data Processing Addendum

Version 2026-10-31. Last updated: October 31, 2026.

This Data Processing Addendum ("DPA") is part of the Terms of Service between BEPA Ventures LLC, doing business as Lantern ("Lantern", "we"), and the customer ("you"). It applies automatically when you use the cloud plan, and to any personal data you send us for support on either plan. If you need a signed copy, email support@lanternnms.com.

1. Roles

  1. For personal data in customer data, you are the controller (or "business"), or you act as a processor for your own clients who are the controllers. We are your processor (or "service provider"), or your subprocessor where you act for a client.
  2. For our own account, billing and website data, we are the controller, and our Privacy Policy applies instead of this DPA.
  3. "Data protection law" means the laws that apply to the processing, including US state privacy laws such as the California Consumer Privacy Act as amended (CCPA), and where they apply the EU and UK General Data Protection Regulations.

2. What we process

Annex 1 describes the subject matter, duration, nature and purpose of the processing, and the kinds of personal data and people concerned.

3. Your instructions

  1. We process personal data only on your documented instructions, which are: the agreement, your configuration and use of Lantern, and other written instructions you give us that are consistent with the agreement. We may also process it where the law requires; we will tell you first unless the law forbids it.
  2. We will tell you if we believe an instruction breaks data protection law.
  3. You are responsible for having a lawful basis, and the notices and consents the law requires, for the personal data you or your clients put into Lantern.

4. Service provider terms (CCPA)

We will not: sell or share personal data (as the CCPA defines those words); keep, use or disclose it for any purpose other than providing the service to you, including any commercial purpose other than that; keep, use or disclose it outside our direct business relationship with you; or combine it with personal data we receive from anyone else, except as the CCPA allows a service provider to. We will comply with the CCPA, give personal data the level of protection it requires, and tell you if we can no longer meet our obligations under it. You may take reasonable steps to stop and remedy unauthorized use of personal data, including by asking us to show how we meet this DPA.

5. Confidentiality and our people

Only the people who run Lantern can access personal data, only as far as they need to provide the service or support, and they are bound to keep it confidential.

6. Security

We maintain the technical and organizational measures in Annex 2. We may change them, but not in a way that lowers the overall protection of personal data.

7. Subprocessors

  1. You authorize us to use the subprocessors listed on our subprocessors page.
  2. We will give you at least 30 days' notice before adding or replacing a subprocessor that processes customer data, by updating that page and emailing account owners. If you object on reasonable data protection grounds, tell us within that period. We will work with you on an alternative; if there is none, you may end the affected cloud subscription and we will refund the unused part of its prepaid period.
  3. We impose data protection terms on each subprocessor that protect personal data at least as well as this DPA, and we remain responsible for their processing.

8. Requests from individuals

Your portal lets you manage the personal data in it, for example by editing or removing users. If an individual asks us directly about customer data, we will not answer the request ourselves (except to tell them to contact you, where we can tell who you are), and we will pass it to you without undue delay. We will help you answer requests you cannot handle with the portal, taking into account the nature of the processing.

9. Personal data breaches

  1. We will notify you without undue delay after becoming aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, customer data.
  2. The notice describes, as far as we know at the time: what happened, the kinds and approximate amount of data and people concerned, the likely consequences, what we have done and propose to do, and a contact for more information. We add details as we learn them.
  3. We notify the email addresses of your account owners. Notifying us of a breach is not an admission of fault.
  4. You decide whether to notify your clients, individuals or authorities about personal data you control, and we will give you the information we have to help you do so.

10. Assistance and audits

  1. We will give you reasonable help with data protection impact assessments and consultations with authorities about Lantern, taking into account the information available to us.
  2. On written request, no more than once a year (or after a breach, or if an authority requires it), we will answer a reasonable security questionnaire and give you the information needed to show we meet this DPA. We do not currently hold third-party security certifications or audit reports. If that information is not enough, you may audit our compliance with this DPA at your expense, with 30 days' notice, during business hours, in a way that does not reveal other customers' data or compromise security, and under a confidentiality agreement.

11. Where data is processed

Customer data is hosted in the United States (New York). If the EU GDPR, UK GDPR or Swiss data protection law applies to personal data you want to put into Lantern, contact us before you do so, so that we can agree the transfer terms those laws require.

12. Deletion and return

  1. While your subscription is active you can view, change and remove data in your portal, and on request we send you a copy of your portal's data.
  2. When a cloud subscription ends, your portal stays available read-only for 30 days, and on request during that time we send you a copy of its data. After that we delete the portal and its database, and backup copies expire within 30 days after that. We then hold no customer data, except where the law requires us to keep it, in which case this DPA continues to protect it.
  3. Personal data you send us for support is kept with the support conversation and deleted 24 months after the conversation ends.

13. Order of precedence and liability

If this DPA conflicts with the rest of the agreement about personal data, this DPA applies. The limits of liability in the Terms of Service apply to this DPA, except where data protection law does not allow them to.

Annex 1: Details of the processing
Subject matter Hosting and operating your cloud portal, and support.
Duration The term of your subscription, plus the 30-day read-only period and backup expiry described in section 12.
Nature and purpose Storing, organizing, displaying, transmitting and deleting data so you can map and monitor your networks, receive alerts, and manage users; troubleshooting when you ask for support.
People concerned Your users (staff, contractors, client users you invite); people whose names, usernames or addresses appear in device data, such as the staff and users of your clients' networks.
Personal data Portal users: name, email address, role, sign-in settings and sign-in records, audit log entries. Collectors: the public IP address each connects from. Device and network data that may relate to people: device host names and descriptions, IP and MAC addresses and, as features are released, LAN endpoint names and addresses, usernames that appear in log findings, alert and incident notes, records of who made configuration changes, and SSH session details such as the device login used.
Not stored in the cloud Raw log lines, raw flow records, configuration backups and their history, and device credentials are kept on your collectors and never stored by the portal. When one of your users searches logs or opens a configuration in the portal, the collector sends the result through the portal to their browser and the portal does not keep it.
Sensitive data None intended. See section 13 of the Terms of Service.

Annex 2: Security measures

  • Isolation: each cloud customer has its own database and database login on our managed database service, and its own application environment (a Kubernetes namespace with network policies that block traffic from other customers' portals, and resource limits), on infrastructure shared with other customers. Each portal has its own encryption keys.
  • Encryption: TLS for all traffic to the portal and the account service; collectors connect with mutual TLS using their own certificates; database storage is encrypted at rest by our hosting provider. The few secrets we must keep to run a portal, such as its database password and master key, are stored encrypted (AES-256-GCM) in our account database, with the encryption key kept outside it.
  • Access control: access to production systems is limited to the people who run Lantern. Portals run without access to the Kubernetes API and with only the network access they need.
  • Least data: data that is bulky or sensitive stays on collectors at your sites (see Annex 1).
  • Accounts: sign-in to Lantern accounts is by single-use links that expire after 15 minutes; sessions are short and protected against forgery.
  • Logging: billing, provisioning and account actions are recorded in an audit log.
  • Backups: daily database backups at our hosting provider, kept for 7 days.
  • Vulnerability management: updates to the portal and its dependencies, a public vulnerability disclosure policy, and security reviews of new features before release.
  • Incidents: a written incident response procedure, including notifying you as section 9 describes.
  • Payment data: card details are handled only by Stripe and never reach our systems.

Annex 3: Subprocessors

See lanternnms.com/legal/subprocessors.