Technical and Organizational Security Measures

1. Governance and Risk Management

1. Maintain a documented internal security and privacy program with accountable personnel, current guidelines, risk assessments and appropriate management oversight.

2. Assess risks before material changes and at least every calendar year, and track remediation of identified material risks.

3. Maintain an inventory of systems and assets used to Process Customer Data and classify Customer Data according to sensitivity.

2. Personnel and Access Control

1. Authorize access only on a documented need-to-know, least-privilege basis; review access upon material role changes and  at least annually; and revoke access promptly when no longer required.

2. Use unique user identities. Prohibit shared credentials except for technically necessary service accounts subject to compensating controls and accountable ownership.

3. Require multi-factor authentication for privileged access, remote administrative access and access to production systems containing Customer Data.

4. For Company personnel, require passwords or other authenticators consistent with current recognized standards. Do not rely on arbitrary periodic password changes absent compromise or risk; block commonly used or compromised passwords where natively supported by the underlying identity provider, and protect stored authentication secrets using strong salted cryptographic hashing.

5. Conduct identity verification before employment, and provide recurring privacy, confidentiality, phishing and secure-handling training.

3. Encryption and key management

1. Encrypt Customer Data in transit using current industry-standard protocols and encrypt Customer Data at rest where technically feasible and appropriate to risk; encryption at rest is mandatory for sensitive data, credentials, portable media and backups.

2. Manage cryptographic keys separately from encrypted data, restrict key access, rotate and revoke keys according to documented procedures, and protect secrets from source-code repositories and logs.

4. System, network and cloud security

1. Harden systems and cloud resources using documented internal security guidelines; segment production from development and testing; and prevent use of production Customer Data in non-production environments unless expressly approved.

2. Use standard network and system-level security controls (such as firewalls and access management). Apply security updates and patches according to risk-based timelines, with critical actively exploited vulnerabilities addressed without undue delay.

3. Maintain secure configuration and secrets-management controls for cloud services, APIs, service accounts and infrastructure-as-code.

4. Log  administrative activity, authentication,  material changes and security events, and protect logs from unauthorized modification.

5. Secure development and vulnerability management

1. Where Company develops software used for the Services, maintain standard internal development practices, including security requirements, code review, dependency management,  testing and  release processes.

2. Perform vulnerability scanning periodically. Conduct independent penetration testing periodically (typically on an annual basis) for internet-facing production services, unless a different frequency is approved in Annex I.

3. Remediate vulnerabilities according to documented severity-based service levels. Company must notify Customer of vulnerabilities only if they result in a confirmed Personal Data Breach requiring notification under Section 9.

6. Segregation, Data Minimization and DLP

1. Logically segregate Customer Data from data of other customers and prevent unauthorized cross-tenant access.

2. Collect and retain only Customer Personal Data necessary for the approved purposes.  Notwithstanding the foregoing, Company may retain Customer Personal Data captured in automated logs or routine backups in accordance with its standard data retention schedules, provided that data remains protected by the security controls herein.

3. Securely erase or render unrecoverable Customer Data on media before disposal, reuse or return (which may be achieved via cryptographic erasure of encrypted media, such as resetting a FileVault-encrypted device, or standard cloud-provider data sanitization).

7. Resilience, Backup and Recovery

1. Use commercially reasonable efforts to maintain business continuity and disaster recovery practices appropriate to the Services; and maintain and verify data recovery capabilities.

2. Protect backups through encryption, access control and separation appropriate to risk. 

8. Incident Response

1. Maintain incident-response practices, defined escalation paths and appropriate contact channels during Company’s standard business hours appropriate to the Services.

2. Use commercially reasonable efforts to preserve logs and evidence relevant to an incident, coordinate with Customer, and implement appropriate corrective actions.

3. In exceptional circumstances, such as critical incident response or Tier 3 support escalations, Company personnel may temporarily export the minimum-necessary log data or identifiers to encrypted, Company-managed workstations or secure internal collaboration tools (such as Google Workspace) where doing so is required to diagnose or resolve the incident. Any data exported under this measure is treated as highly confidential, used solely for the purpose of resolving the incident, and permanently purged from all endpoints and temporary storage immediately upon resolution.

9. Physical Security

Use facilities and hosting providers with physical access controls, visitor management, environmental protections, power resilience and secure media disposal appropriate to the service and risk.

10. Assurance and Sub-processors

1. Assess relevant Sub-processors before appointment and periodically thereafter,  evaluating their security and ability to meet applicable obligations appropriate to the risk and the Services.

2. Maintain independent assurance appropriate to the service and make relevant current evidence available under Section 8 of this DPA.