Information Protection and Security Standards Addendum

The Provider has implemented and maintains an Information Security Management System (ISMS) and a comprehensive information security program which is documented, available, and communicated to employees and subcontractors.

The effectiveness of the information security program is regularly monitored and reviewed, and, in any event, at least annually. Adjustments and strengthening are applied as appropriate, based on the results of such monitoring, as well as in response to operational changes that may affect the ISMS.

The Provider has implemented and maintains appropriate measures to ensure that personnel (employees and contractors) involved in the processing of Customer Data are authorized with a need to access the data, are bound by appropriate confidentiality obligations and have undergone appropriate training in the protection and handling of Customer Data.

The Provider has implemented and maintains an acceptable use policy for Provider personnel usage of the Provider’s devices, systems, and infrastructure, as well as management of customer information, including Customer Data. The Provider monitors policy compliance and will take appropriate action in response to violations.

All personnel complete annual security awareness training (initial orientation at onboarding plus annual refresh) covering current threats, policy updates, and security best practices. Completion records are retained.

The Provider ensures that access to Customer Data is revoked immediately upon termination or when access is no longer required for personnel involved in the processing of Customer Data.

The Provider performs personnel onboarding controls appropriate to role and access level, in accordance with applicable law. The acceptable-use policy and confidentiality obligations are agreed prior to any access to Customer Data.

Policies and procedures, and supporting business processes, are in place for maintaining a safe and secure working environment in the Provider’s offices and to control physical access.

The Provider relies on DigitalOcean who is responsible, in accordance with their facilities, premises, and physical security policies, for implementing controls for physical security of data center facilities, backup media, and other physical systems.

The Provider has implemented and maintains access control processes and mechanisms to prevent unauthorized access to Customer Data and to limit access only to authorized personnel with a business need to know. Such processes and mechanisms are supported by an enterprise-grade password manager centrally managed for the most relevant Provider systems and internal applications and include password configuration and management procedures for all end user and system accounts related to the processing environment following recognized industry best practices for password length, structure and rotation.

The access to Customer Data is achieved by means of authenticated individual accounts and is limited solely to personnel which need access to perform specific responsibilities or functions in support of the Services.

Administrator accounts are used only for the purpose of performing administrative activities, and each account is traced to a uniquely-identifiable individual and two-factor authentication is required for access to the Provider platforms’ control plane and other critical resources.

Accounts are disabled upon personnel termination or change of roles and responsibilities, and it is an established and maintained process to periodically review access controls.

The Provider provides advanced access mechanisms with appropriate control over application features and data allowing configuring user access restrictions as stated in the specific Provider service documentation.

Users are required to verify their login using unique credentials (username and password) and anonymous logins are not permitted.

The Provider allows the configuration of different levels of password complexity, following National Institute of Standards and Technology (NIST) best practice recommendations.

The Provider has implemented and maintains logical data segregation to ensure Customer Data is not viewable by unauthorized users and that the Client can access its data set only.

The Provider relies on DigitalOcean for data destruction and can only perform logical deletion.

Deleted Customer Data is rendered unreadable or disabled by DigitalOcean and the underlying storage areas on the network that were used to store the content are wiped, prior to being reclaimed and overwritten, in accordance with DigitalOcean standard policies and deletion timelines.

DigitalOcean procedures also include a secure decommissioning process conducted prior to disposal of storage media used to provide the services. As part of that process, storage media is degaussed or erased and physically destroyed or disabled in accordance with industry standard practices.

The Provider has implemented and maintains malicious-code protection appropriate to its environment, including continuous file-integrity monitoring and intrusion detection on production systems.

The Provider maintains a backup policy for Customer Data appropriate to the service tier.

Database backups are taken at least daily by the underlying managed-database service, with point-in-time recovery available within the supported retention window. Application configuration and supporting filesystem state are captured by snapshot or scheduled archive on a documented cadence. Backups are encrypted at rest and replicated to a secondary cloud account for disaster-recovery purposes.

Retention periods vary by data class and are documented in the Provider’s internal Data Retention Policy.

The Provider has implemented and maintains workstation administration procedures appropriate to its environment, including operating-system update practices and access controls on systems used to access Customer Data or production infrastructure.

The Provider has implemented and maintains system administration procedures that meet or exceed industry standards. Production application servers are patched via snapshot-based rollout during scheduled maintenance windows, with health-check verification post-deployment. Support infrastructure runs unattended-upgrades on an automatic schedule. All hosts are built from a CIS-hardened pre-configured virtual machine image baseline.

The Provider relies on DigitalOcean who is responsible for implementing data center network security.

The Provider has implemented and maintains technical measures designed to meet or exceed industry standards aimed to monitor, detect, and prevent malicious network activity on the network infrastructures under its control and management responsibility.

The Provider ensures that firewalls, network routers, switches, load balancers, domain name servers, mail servers, and other network components of the network infrastructures under its control and management responsibility are configured and secured in accordance with commercially reasonable industry standards.

The Provider has implemented and maintains systems event logging procedures designed to meet or exceed industry standards in the detection, investigation and response to suspicious activity in a timely manner. The Provider leverages DigitalOcean’s security monitoring capabilities.

The Provider has implemented and maintains a threat and vulnerability management program to continuously monitor for vulnerabilities in the Provider’s platform that are acknowledged by vendors, reported by researchers, or discovered through the scheduling and execution of internal and external vulnerability scans and automated penetration tests.

Identified vulnerabilities are assessed to evaluate the associated risks, and the appropriate remediation actions are carried out according to the established change management policy with the assigned priority.

The Provider has implemented and maintains patch management procedures that meet or exceed industry standards and that require patches to be prioritized, tested and installed based upon criticality for all systems which are part of the Provider’s platform.

Patches will be installed according to the Provider’s change management policy with the assigned priority and scheduling based on assessed risk and operational criteria defined by the Provider, after being tested and evaluated where feasible, with post-deployment verification on production rollouts.

The Provider has implemented and maintains a secure development lifecycle (SDLC) methodology to govern the acquisition, development, implementation, configuration, maintenance, modification, and management of infrastructure and software components of the Provider’s platform.

The SDLC includes procedures for user involvement, testing, conversion, and management approvals of system features that are designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web applications and other recognized secure-development guidance) and at minimum address OWASP top 10 vulnerabilities.

The developed code is reviewed and validated against the security requirements and coding guidelines and static and dynamic code/program analysis tools are utilized as appropriate prior to release on production.

The Provider has implemented and maintains a change management program that meets or exceeds industry standards including, without limitation, maintenance, patches, data formatting changes, new deployments of code or systems, or for any work to restore services as the result of an Incident, where as “incidents” are intended events that are not part of the standard operation of the Services and cause an interruption to, or a reduction in, the quality of the Services, or events causing integrity or confidentiality issues on Customer Data or security incidents.

A systematic approach with a division of roles and responsibilities is applied to managing change and ensuring that changes of any Provider functionality are reviewed, tested and approved. Development, testing and implementation are segmented functions within the process and changes are tested prior to deployment to production. Change management standards are based on established guidelines and tailored to the specifics of each change request.

The Provider has implemented and maintains policies and procedures for identifying, acting upon, remediating and reporting incidents, where as “incidents” are intended events that are not part of the standard operation of the Services and cause an interruption to, or a reduction in, the quality of the Services, or events causing integrity or confidentiality issues on Customer Data or security breaches.

All incidents that are required by law to be reported by the Provider to the Client will be so reported within the timeframes that are required by applicable law, and, in any event, promptly and without undue delay.

The Provider has implemented and maintains a Business Continuity and Disaster Recovery Program that meets or exceeds industry standards and that provides a formal framework and methodology, including without limitation, a business impact analysis, risk assessment process to identify and prioritize critical business functions and define appropriate contingency plans.

The Provider will update the operability of any applicable contingency plan and test its Disaster Recovery Plan at least annually.