Where ElasticD3M, LLC ("Provider") processes personal data on your behalf, that processing is governed by the Bonterms Data Protection Addendum (Version 2.0), Attachment Version, published by Bonterms and incorporated here by reference, together with the DPA Details below. The Main Agreement is our Terms of Use.
The Bonterms DPA carries its own Exhibit A (cross-border transfer mechanisms) and Exhibit B (region-specific terms), so the GDPR, UK and CCPA machinery is in the standard form rather than reconstructed by us. That matters more here than convenience: a bespoke DPA written by a vendor is exactly the document a privacy reviewer has to read line by line.
Published by Bonterms under the Creative Commons Attribution 4.0 International licence. ElasticD3M is not affiliated with or endorsed by Bonterms.
You are the Controller (or, under the CCPA, the Business). ElasticD3M is the Processor (Service Provider) and processes personal data only on your documented instructions, which are the Main Agreement and your use of the service.
To produce the decision-support analysis you purchased and the records that evidence it. Categories of data subjects: your personnel and any individuals named in the incident facts you choose to supply. Categories of personal data: business contact details, and whatever appears in facts you submit. We do not require special-category data and ask you not to send it.
In the United States only. We do not process or store customer data outside the US, and we do not add a service that lacks a US-only data plane. Because processing is US-only, the transfer mechanisms in Exhibit A of the Bonterms DPA are not engaged for data you submit from the US.
Where RiskD3M measures your environment, measurement runs inside your own network. Only control-efficacy scores, counts and cryptographic digests leave it. Evidence content, including log lines, file contents, mailbox contents and system identifiers, is not transmitted to us and is not held by us. This is enforced in the software, not by policy: the result type has no field capable of carrying content and the ingest path refuses a payload that bears one.
Currently:
We notify you before adding a subprocessor and you may object as provided in the Bonterms DPA. Error-monitoring is currently disabled and no third party receives our application error data.
TLS 1.2 or better in transit and encryption at rest. Access to production is limited to authorized US persons. Every state-changing operation writes an append-only audit entry. Deliverables are held for a named human release before they are sent. Posture attestations are released to a third party only under a consent you recorded naming that party, which you may withdraw at any time and which takes effect on the next request.
By email to the address on your account, and by updating this page.
On request during the term, and on termination, we return or delete customer data within thirty days, except where retention is required by law. Records we must retain for audit are retained in a form that carries the analysis and its provenance, not the underlying evidence you supplied.
As provided in the Bonterms DPA. We will respond to a reasonable security questionnaire and provide the evidence we hold.
RiskD3M, powered by ElasticD3M. Patent Pending. © 2026 ElasticD3M, LLC · All Rights Reserved.