Data Processing
Agreement

Exhibit B – Technical and Organizational Measures

The Company deploys and maintains technical and organizational security measures to protect Personal Data. Below is an overview of the measures the Company employs to keep our platform and Personal Data secure.

Please note: the most up to date technical and organizational measures can be found here.

General

• The Company maintains a documented information security policy, consistent with industry standards, reviewed and updated annually. Security policy development and maintenance, is managed by personnel with expertise in the field of information security.
• The Company holds SOC 2 Type II and ISO 27001 certifications, demonstrating its adherence to internationally recognized standards for security and information management. SOC 2 Type II reports are available to customers upon reasonable written request.
• All personnel computers shall be updated with antivirus software, or similar protective mechanisms.

Training and Personnel

• All Company’s personnel undergo a security training program at least once every calendar year.
• Upon termination, no personnel may retain any access keys, codes, or similar access to any Personal Data or the Company’s facilities.

Access Control

• The Company’s information security policies shall establish reasonable steps to prevent unauthorized access to, or loss of, Personal Data.
• Company shall designate a system administrator, which restricts access of other personnel to Personal Data in accordance with these Technical and Organizational Measures, which access permissions which shall be reviewed on an annual basis.
• Company shall require authentication process for all access and remote access by its personnel, which can consist of strong passwords, two-factor authentication, or other mechanisms which prevents unauthorized access.
• Access, data insertion, deletion, and modification logged, including time stamps.
• The Company allows you to implement Row-Level Security (RLS) at the database layer, to mitigate the risk of unauthorized access, view, create, update, or delete, to data stored on your applications.
• For eligible customers, the Company supports IP allowlisting, enabling organizations to restrict access to workspaces and applications based on network address and reduce the risk of unauthorized access from untrusted networks.

Physical Security

• Company ensures the physical security of its premises, and monitors any access, or entrance to its premises.
• Company requires all of its personnel to refrain from retaining physical copies of sensitive data for any longer than necessary, according to Company’s policies.
• Visitors access to Company’s facilities is monitored and restricted, managed by dedicated personnel.
• All Personal Data is hosted and stored with leading cloud infrastructure providers (for example Amazon Web Services or Google Cloud Platform) that maintain enterprise-grade physical security, environmental controls (including temperature regulation, fire suppression, and smoke detection), and relevant industry certifications. Physical security of data hosting infrastructure is ensured through contractual commitments and the compliance certifications of those cloud providers.

Integrity

• Company regularly back-up its systems, and undertakes to review software to find and remediate security vulnerabilities during initial implementation and upon any significant modifications and updates.
• The Company follows a Secure Software Development Lifecycle (SSDLC) that integrates security at every stage of product development, including threat modeling, secure design reviews, code reviews, and pre-deployment security testing, enabling the early identification and remediation of potential risks before they reach production.
• Company conducts penetration testing at least once every calendar year, using both internal security resources and independent third-party providers. Tests are conducted in accordance with OWASP methodologies to simulate real-world attack scenarios and evaluate the effectiveness of existing controls. All findings are reviewed, prioritized by severity, tracked, and remediated in accordance with the Company’s internal policies and risk management framework.
• Company undertakes to change all default account access configurations and authentication keys prior to the implementation of all new systems following the effective date of this Agreement.
• All personnel laptops are managed by Company, and monitored regularly.
• Personal Data is encrypted in transit using industry standard protocols (including TLS) and encrypted at rest using strong encryption mechanisms. The Company shall not store Personal Data outside of its monitored environments unless it is protected by strong encryption.
• The Company operates a bug bounty program through which independent security researchers may responsibly disclose vulnerabilities. All submissions are reviewed and validated by the Company’s security team, and confirmed vulnerabilities are prioritized for remediation based on their severity and potential impact.

Deletion

• Company undertakes to delete all Personal Data in accordance with the DPA.
• Company maintains automatic back-up practices of Personal Data, which are deleted on set intervals.

Third-Party Risk Management

The Company maintains a formal Third-Party Risk Management (TPRM) program. Prior to engaging any new third-party service provider who will have access to Personal Data, Company conducts a security risk assessment of the provider’s information security practices against defined requirements. Vendor compliance with those requirements is periodically validated on an ongoing basis to confirm continued alignment with the Company’s security standard.

Law Enforcement Request Policy

• One of the most prominent Company’s core values is respecting human rights. As such, the Company ensures that all data requests received from law enforcement agencies, governmental, regulatory, and judicial bodies are valid and made in accordance with the applicable legal procedures.
• All disclosure of Personal Data to authorities shall be in accordance with this DPA.