For the personal data in a security platform, such as user accounts and commit authors, you are usually the controller and the vendor is a processor acting on your instructions. The vendor may be a controller for its own purposes, such as billing. Ask the vendor to state the roles per data class. This is general information, not legal advice.
The definitions
The GDPR defines a controller as the body that, alone or jointly with others, determines the purposes and means of processing personal data. A processor is a body that processes personal data on behalf of the controller. Roles follow from who decides why and how data is used, not from what the contract calls anyone.
Why roles matter to a buyer
A processor can use personal data only on the controller's documented instructions. It must keep to confidentiality, assist with data subject requests, help with security and breach obligations, delete or return data at the end of services, and allow audits. Those duties come from Article 28. If the vendor is instead deciding for itself how to use your data, such as for product analytics on your users, that part looks more like controller activity and needs its own basis and disclosure.
Roles determine who answers when a person asks about their data, and who is accountable if something goes wrong.
Roles by data class in a security platform
| Data class | Usual role of the vendor | Check |
|---|---|---|
| Customer user accounts and commit authors in findings | Processor | Is it used only to deliver the service? |
| Scan results about your software | Processor if they include personal data, otherwise confidentiality terms apply | Are results used to build shared datasets? |
| Vendor billing and contract contacts | Controller | Privacy notice covers it |
| Product usage analytics | Depends on who decides purpose | Can you opt out? Is it pseudonymised? |
| Website and marketing data | Controller | Separate from your tenant |
The middle rows are where disputes arise. If a vendor says it will use anonymised customer data to improve its models or benchmarks, ask exactly what is anonymised, how, and whether you can opt out. See data use clauses: telemetry, benchmarking and model training.
What to ask the vendor
- For each data class, are you a processor, a controller or both?
- Where you act as a processor, do you have a data processing addendum, and may we review it before signing?
- Is any customer data used for purposes beyond delivering our service?
- How do you assist when one of our people asks for access or deletion?
- Who is your contact for privacy questions?
Keep it practical
You do not need to settle every legal subtlety in a procurement meeting. You do need one document that says who is responsible for what, in terms your privacy team can check. If the answers are unclear, escalate to counsel before you connect real repositories.
For the general concept, see controller vs processor vs joint controller under GDPR.
How Safeguard fits
Self-hosted deployment, available as private VPC, on-prem or air-gapped with Safeguard, can reduce the number of parties handling your data. You can also look at the free scan before sharing real data.
Quick check
Can a vendor be both controller and processor?
Yes, for different data. It might be a processor for your users' data and a controller for its own billing records.
Does the contract label decide the role?
No. The facts decide: who determines the purposes and means. A label that contradicts the facts will not hold.
Sources
Last reviewed: 19 October 2026.
