This Data Processing Addendum, including its Schedules and Annexes (this “DPA”), forms part of the agreement between OpsCompanion, Inc. (“OpsCompanion”) and Customer that the Standpipe Terms of Service (the “Terms”) define as the “Agreement,” or of another written agreement between OpsCompanion and Customer for the Services that incorporates this DPA (in either case, the “Agreement”). Capitalized terms used but not defined in this DPA have the meanings that the Terms give them. References to a Section of the Terms include the corresponding provision of a written agreement that OpsCompanion and Customer execute in place of the Terms.
1. Definitions
In this DPA:
“Applicable Data Protection Laws” means all laws concerning privacy, data protection, or data security that apply to the processing of Customer Personal Data under the Agreement, including US State Privacy Laws, the GDPR, the UK GDPR, and the Swiss FADP, in each case to the extent that law applies.
“Business Purposes” means the purposes set forth under “Business Purposes” in Annex I.
“Customer Personal Data” means personal data contained in Customer Data that OpsCompanion processes on behalf of Customer under the Agreement.
“Data Subject” means the identified or identifiable natural person to whom Customer Personal Data relates.
“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation).
“Restricted Transfer” means a transfer of Customer Personal Data that is subject to the GDPR, the UK GDPR, or the Swiss FADP to a country that the European Commission, the United Kingdom, or Switzerland, as applicable, has not determined to provide an adequate level of protection for personal data, where Applicable Data Protection Laws require a transfer mechanism for that transfer.
“Security Incident” means a breach of security of the systems that OpsCompanion or its Subprocessors use to process Customer Personal Data that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data, excluding unsuccessful attempts and activities that do not compromise the security of Customer Personal Data, such as pings, port scans, and failed log-in attempts.
“Standard Contractual Clauses” and “UK Addendum” have the meanings given in Schedule 2.
“Subprocessor” means a person, other than an employee of OpsCompanion, that OpsCompanion engages to process Customer Personal Data.
“Swiss FADP” means the Swiss Federal Act on Data Protection of September 25, 2020.
“UK GDPR” means the GDPR as it forms part of the law of the United Kingdom under the European Union (Withdrawal) Act 2018, as amended.
“US State Privacy Laws” means the California Consumer Privacy Act of 2018, Cal. Civ. Code Section 1798.100 et seq., and its implementing regulations, and each other comprehensive consumer privacy law of a state of the United States, in each case as amended.
The terms “business,” “contractor,” “controller,” “personal data,” “process,” “processor,” “sell,” “service provider,” and “share” have the meanings that Applicable Data Protection Laws give them, and “personal data” includes “personal information” as US State Privacy Laws define that term.
2. Scope and Roles
2.1 Roles. As to Customer Personal Data, Customer is a controller or business, and OpsCompanion is a processor, service provider, or contractor. If Customer processes Customer Personal Data as a processor on behalf of a third-party controller, Customer represents and warrants that Customer’s instructions under this DPA, including the appointment of OpsCompanion as a further processor, are authorized by that controller.
2.2 Processing on Endpoints. The Software inspects Endpoint Content on Endpoints under Customer’s control, and that inspection is processing that Customer performs using the Software. Endpoint Content is Customer Personal Data under this DPA only to the extent OpsCompanion receives it as a Feedback Submission under Section 9.4(b) of the Terms, or receives or views it as Section 9.1 of the Terms describes. This DPA ceases to apply to Service Data upon its delivery to a Customer-Designated Destination.
2.3 OpsCompanion as Controller. OpsCompanion processes personal data concerning Customer’s representatives, including Authorized Users, for account administration, billing (including counting Endpoints for billing), payment, and business communications, and to comply with law, as an independent controller under OpsCompanion’s Privacy Policy at [https://opscompanion.ai/privacy-policy]. This DPA does not apply to processing for those purposes.
2.4 Details of Processing. Annex I describes the subject matter, duration, nature, and purposes of the processing, the categories of Customer Personal Data, and the categories of Data Subjects.
3. Processing Instructions
3.1 Instructions. OpsCompanion shall process Customer Personal Data only on Customer’s documented instructions, including with respect to Restricted Transfers, unless law to which OpsCompanion is subject requires other processing, in which case OpsCompanion shall inform Customer of that legal requirement before the processing unless that law prohibits OpsCompanion from doing so. The Agreement, this DPA, Customer’s configuration of the Services (including its Policies, settings, and Customer-Designated Destinations), and any other written instructions that OpsCompanion accepts constitute Customer’s complete instructions. Customer instructs OpsCompanion to process Customer Personal Data for the Business Purposes set forth in Annex I, including to de-identify Service Data to create Usage Data under Section 9.3 of the Terms.
3.2 Unlawful Instructions. OpsCompanion shall inform Customer promptly if, in OpsCompanion’s opinion, an instruction infringes Applicable Data Protection Laws, and OpsCompanion may suspend the processing that the instruction requires until Customer confirms or modifies the instruction.
3.3 Customer Responsibilities. Customer shall ensure that Customer’s instructions comply with Applicable Data Protection Laws and that Customer has the lawful basis, and has given the notices and obtained the consents, that Applicable Data Protection Laws require for the processing of Customer Personal Data under the Agreement. Section 5.2 of the Terms governs Customer’s obligations under Monitoring Laws.
4. Confidentiality of Personnel
OpsCompanion shall limit access to Customer Personal Data to personnel who require access to perform the Agreement, and shall ensure that each person whom OpsCompanion authorizes to process Customer Personal Data is subject to a contractual or statutory duty of confidentiality and has received training appropriate to that person’s access.
5. Security
5.1 Security Measures. OpsCompanion shall implement and maintain the technical and organizational measures set forth in Annex II. OpsCompanion may update those measures, provided that no update materially decreases the overall security of Customer Personal Data.
5.2 Customer Security. Customer is responsible for the security of Endpoints, of the credentials and single sign-on configurations through which Customer accesses the Cloud Console, and of the Policies Customer configures. Section 9.6 of the Terms governs Customer-Designated Destinations.
6. Subprocessors
6.1 Authorization. Customer hereby grants OpsCompanion general written authorization to engage Subprocessors, including the Subprocessors set forth in Annex III, subject to this Section 6.
6.2 Subprocessor Obligations. OpsCompanion shall engage each Subprocessor under a written agreement that imposes on the Subprocessor data protection obligations no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the services the Subprocessor provides, and OpsCompanion is liable to Customer for the performance of each Subprocessor’s obligations as for its own.
6.3 Notice of New Subprocessors. OpsCompanion shall maintain a current list of Subprocessors at [https://trust.opscompanion.ai/subprocessors], with a means for Customer to subscribe to notice of changes, and shall notify Customer at least thirty (30) days before authorizing a new Subprocessor to process Customer Personal Data. If OpsCompanion must replace a Subprocessor urgently to maintain the security or availability of the Services, OpsCompanion shall give the notice as soon as practicable, and the objection period in Section 6.4 runs from that notice.
6.4 Objection. Customer may object to a new Subprocessor on reasonable grounds relating to the protection of Customer Personal Data by notice to OpsCompanion within fifteen (15) days after OpsCompanion’s notice under Section 6.3. The parties shall discuss Customer’s objection in good faith, and OpsCompanion may propose a change to the Services or to Customer’s configuration that avoids processing of Customer Personal Data by that Subprocessor. If the parties do not resolve the objection within thirty (30) days after Customer’s notice, Customer may terminate the affected Subscription by notice, and OpsCompanion shall refund the prepaid Fees for the remainder of the terminated Subscription Term. This Section 6.4 states Customer’s sole remedy for its objection to a new Subprocessor.
7. Security Incidents
7.1 Notice. OpsCompanion shall notify Customer of a Security Incident without undue delay, and in any event within seventy-two (72) hours, after OpsCompanion confirms the Security Incident. To the extent then known, OpsCompanion shall describe in the notice the nature of the Security Incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures OpsCompanion has taken or proposes to take, and a contact point for further information. OpsCompanion shall supplement the notice as further information becomes available.
7.2 Response. OpsCompanion shall take reasonable steps to contain, investigate, and mitigate each Security Incident and shall cooperate with Customer’s reasonable requests for information concerning it. Customer shall notify Data Subjects, regulators, and other third parties as Applicable Data Protection Laws require, and OpsCompanion shall not notify any third party of a Security Incident in a manner that identifies Customer without Customer’s consent, except as law requires.
7.3 No Admission. OpsCompanion’s notice of, or response to, a Security Incident is not an acknowledgment of fault or liability.
8. Assistance
8.1 Data Subject Requests. If OpsCompanion receives a request from a Data Subject to exercise a right under Applicable Data Protection Laws with respect to Customer Personal Data, and the request identifies Customer, OpsCompanion shall forward the request to Customer promptly and shall not respond to it, except to direct the Data Subject to Customer, unless law requires otherwise. Taking into account the nature of the processing, OpsCompanion shall assist Customer by appropriate technical and organizational measures in responding to Data Subject requests, including by deleting Customer Personal Data that Customer specifies within [ninety (90)] days after Customer’s request.
8.2 Assessments and Consultations. To the extent Customer does not otherwise have access to the relevant information and the information is available to OpsCompanion, OpsCompanion shall provide information and assistance reasonably necessary for Customer to conduct data protection impact assessments, risk assessments, and cybersecurity audits, and to consult with supervisory authorities, in each case as Applicable Data Protection Laws require of Customer with respect to the processing of Customer Personal Data under the Agreement.
8.3 Costs. Except to the extent law prohibits OpsCompanion from charging for it, Customer shall reimburse OpsCompanion’s reasonable costs of assistance under Sections 8.1 and 8.2, to the extent that assistance exceeds the functionality of the Services, at rates that OpsCompanion
9. Audits
9.1 Reports. Upon Customer’s request, no more than once in any period of twelve (12) consecutive months and additionally after a Security Incident, OpsCompanion shall make available to Customer (a) OpsCompanion’s most recent System and Organization Controls (SOC) 2 report, or another report of an independent auditor that assesses OpsCompanion’s security controls against an accepted control framework; (b) a summary of the results of OpsCompanion’s most recent third-party penetration test; and (c) written responses to a reasonable information security questionnaire. Each of those materials is OpsCompanion’s Confidential Information.
9.2 Audits. If (a) the materials that OpsCompanion makes available under Section 9.1 do not reasonably demonstrate OpsCompanion’s compliance with this DPA, (b) a supervisory authority requires an audit, or (c) a Security Incident has occurred, Customer, or an independent auditor that Customer appoints and that is not a competitor of OpsCompanion and is bound by written confidentiality obligations, may audit OpsCompanion’s compliance with this DPA. To conduct an audit, Customer must give OpsCompanion at least thirty (30) days’ notice, agree with OpsCompanion in advance on the scope, timing, and duration of the audit, and conduct the audit during business hours, remotely where practicable, without access to the data of OpsCompanion’s other customers or to information that is subject to legal privilege. Customer may conduct no more than one (1) audit in any period of twelve (12) consecutive months, except for an audit under clause (b) or clause (c). Customer shall bear Customer’s own costs of each audit and shall reimburse OpsCompanion’s reasonable costs for personnel time in excess of one (1) Business Day per audit, unless the audit reveals OpsCompanion’s material noncompliance with this DPA. Customer shall furnish OpsCompanion a copy of each audit report without charge.
10. Return and Deletion
Upon the expiration or termination of a Subscription, OpsCompanion shall deliver the export of Service Data that Section 12.4(c) of the Terms requires, and shall delete the Customer Data for that Subscription, including Customer Personal Data, from OpsCompanion’s production systems within [sixty (60)] days after the expiration or termination and from OpsCompanion’s backup systems within [ninety (90)] days thereafter, except to the extent law requires OpsCompanion to retain Customer Personal Data, in which case OpsCompanion shall continue to protect the retained Customer Data under this DPA and shall process the retained Customer Data only for the purposes that law requires. Upon Customer’s request, OpsCompanion shall certify the deletion in writing.
11. Location of Processing; Restricted Transfers
11.1 Location. OpsCompanion shall host Customer Personal Data in the United States. Customer authorizes OpsCompanion and its Subprocessors to process Customer Personal Data in the United States and in the other locations set forth in Annex III.
11.2 Restricted Transfers. Schedule 2 governs each Restricted Transfer.
12. US State Privacy Laws
12.1 Service Provider Obligations. As to Customer Personal Data that is subject to US State Privacy Laws, OpsCompanion shall:
(b) not retain, use, or disclose the Customer Personal Data for any purpose, including any commercial purpose, other than the Business Purposes set forth in Annex I or as US State Privacy Laws otherwise permit a service provider, contractor, or processor to retain, use, or disclose it;
(c) not retain, use, or disclose the Customer Personal Data outside the direct business relationship between OpsCompanion and Customer;
(d) not combine the Customer Personal Data with personal data that OpsCompanion receives from or on behalf of any other person, or collects from its own interactions with individuals, except as US State Privacy Laws permit;
(e) comply with the obligations that US State Privacy Laws impose on OpsCompanion as a service provider, contractor, or processor, and provide the same level of privacy protection that US State Privacy Laws require of Customer; and
(f) notify Customer within ten (10) Business Days after OpsCompanion determines that OpsCompanion can no longer meet its obligations under US State Privacy Laws.
12.2 De-Identified Data. As to Usage Data and other de-identified data that OpsCompanion derives from Customer Personal Data, OpsCompanion shall (a) take reasonable measures to ensure that the data cannot be associated with an individual or household; (b) publicly commit to maintain and use the data only in de-identified form and not to attempt to re-identify it, except to test its de-identification processes as law permits; and (c) contractually require each person to whom OpsCompanion discloses the data, other than in the form of aggregated statistics that do not relate to any individual or household, to comply with clauses (a) and (b).
12.3 Customer Rights. Customer may take reasonable and appropriate steps, including those Section 9 describes, to ensure that OpsCompanion uses Customer Personal Data consistent with Customer’s obligations under US State Privacy Laws, and, upon notice to OpsCompanion, may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data, including by requiring OpsCompanion to furnish documentation that verifies the deletion of Customer Personal Data.
12.4 Certification. OpsCompanion certifies that it understands and will comply with the restrictions in this Section 12.
13. AI Schedule
Schedule 1 (AI Schedule) governs the AI Features of the Services and forms part of this DPA.
14. Liability
Each party’s liability arising out of or relating to this DPA, including under the Standard Contractual Clauses as between the parties, is subject to Section 16 of the Terms, except to the extent the Standard Contractual Clauses or Applicable Data Protection Laws prohibit that limitation, including as to the rights of Data Subjects under the Standard Contractual Clauses.
15. General
15.1 Term. This DPA remains in effect for so long as OpsCompanion processes Customer Personal Data, notwithstanding the expiration or termination of the Agreement.
15.2 Order of Precedence. If this DPA conflicts with the Terms as to the processing of Customer Personal Data, this DPA governs. If this DPA conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses govern.
15.3 Changes. OpsCompanion may modify this DPA in accordance with Section 20.1 of the Terms, but shall not modify this DPA in a manner that materially reduces the protection of Customer Personal Data under this DPA, except to the extent necessary to comply with law.
15.4 Governing Law. Section 19 of the Terms governs this DPA, except that the Standard Contractual Clauses are governed by the law that Schedule 2 specifies.
SCHEDULE 1
AI SCHEDULE
1. AI Features. Part B of Annex I describes each AI Feature, where the AI Feature runs, and the data that the AI Feature transmits off the Endpoint.
2. New AI Processing. OpsCompanion shall notify Customer at least thirty (30) days before deploying a new AI Feature that transmits Customer Personal Data or Endpoint Content off an Endpoint for processing by OpsCompanion or a third-party model provider. Nothing in this paragraph 2 authorizes the Software to transmit Endpoint Content except as permitted by Section 9.1 of the Terms. Any additional transmission requires an express amendment to the Agreement. Each third-party model provider that processes Customer Personal Data is a Subprocessor subject to Section 6 of this DPA, and OpsCompanion shall contractually prohibit each such provider from using Customer Personal Data to train, fine-tune, or otherwise modify models and from retaining Customer Personal Data longer than necessary to provide the AI Feature. Customer may disable such an AI Feature unless doing so would prevent the Services from performing materially in accordance with the Documentation, in which case Section 6.4 of this DPA applies as if its provider were a new Subprocessor.
3. Training. Section 9.4 of the Terms governs the use of Customer Data, including Feedback Submissions, to train, fine-tune, or otherwise modify any artificial intelligence or machine-learning model.
4. Use of Outputs; Human Review. Schedule 1 to the Terms restricts the use of output of the Services in decisions concerning individuals. The Services permit Customer’s administrators to review the Service Data that records each enforcement action and to override enforcement decisions as the Documentation describes. Customer is responsible for each decision that Customer makes using output of an AI Feature.
5. Documentation and Cooperation. Upon Customer’s written request, and to the extent the information is available to OpsCompanion and its disclosure does not require OpsCompanion to disclose its trade secrets, OpsCompanion shall furnish information reasonably necessary for Customer to comply with laws regulating artificial intelligence or automated decision-making that apply to Customer’s deployment of the Services, including (a) a description of the intended purpose and known limitations of each AI Feature; (b) the categories of data that each AI Feature processes; (c) a summary of OpsCompanion’s evaluation of the performance of each AI Feature; and (d) a description of the means by which Customer can review and override the outputs of each AI Feature. That information is OpsCompanion’s Confidential Information.
6. Changes to AI Features. OpsCompanion shall describe each material change to an AI Feature in the Documentation or release notes for the Update that implements the change.
SCHEDULE 2
RESTRICTED TRANSFERS
1. Definitions. In this DPA, “Standard Contractual Clauses” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of June 4, 2021, and “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the United Kingdom Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, as revised from time to time.
2. Transfers Subject to the GDPR. Each Restricted Transfer subject to the GDPR is made under Module Two of the Standard Contractual Clauses, where Customer is a controller, and Module Three, where Customer is a processor, each of which is incorporated in this DPA and completed as follows:
(a) Clause 7 (docking clause) applies;
(b) in Clause 9(a), Option 2 (general written authorization) applies, and the time period for prior notice of a change in Subprocessors is the period that Section 6.3 of this DPA states;
(c) the optional language in Clause 11(a) does not apply;
(d) in Clause 17, Option 1 applies, and the governing law is the law of Ireland;
(e) in Clause 18(b), the courts of Ireland are selected;
(f) in Annex I.A, Customer is the data exporter and OpsCompanion is the data importer, each with the contact details in the Agreement, and each party’s acceptance of the Agreement constitutes its signature of the Standard Contractual Clauses;
(g) Annex I of this DPA completes Annex I.B, and the competent supervisory authority under Annex I.C is the authority that Clause 13 determines; and
(h) Annex II of this DPA completes Annex II, and Annex III of this DPA completes Annex III, of the Standard Contractual Clauses.
Sections 6, 9, and 10 of this DPA describe how OpsCompanion performs its obligations under Clauses 8.5, 8.9, and 9 of the Standard Contractual Clauses, respectively, and do not modify those Clauses.
3. Transfers Subject to the UK GDPR. Each Restricted Transfer subject to the UK GDPR is made under the Standard Contractual Clauses, completed as paragraph 2 provides, as amended by the UK Addendum, which is incorporated in this DPA and completed as follows: (a) Table 1 is completed with the information in paragraph 2(f); (b) Table 2 is completed by reference to the modules and clauses selected in paragraph 2; (c) Table 3 is completed by Annexes I through III of this DPA; and (d) in Table 4, neither party may end the UK Addendum under its Section 19.
4. Transfers Subject to the Swiss FADP. Each Restricted Transfer subject to the Swiss FADP is made under the Standard Contractual Clauses, completed as paragraph 2 provides, with the following modifications to the extent the Swiss FADP governs the transfer: (a) the Swiss Federal references to the GDPR include the corresponding provisions of the Swiss FADP; (c) the term “Member State” in Clause 18(c) does not exclude Data Subjects habitually resident in Switzerland from bringing claims in Switzerland; and (d) for a transfer that only the Swiss FADP governs, the Standard Contractual Clauses are governed by Swiss law, and disputes are resolved by the courts of Zurich, Switzerland.
ANNEX I
DESCRIPTION OF PROCESSING
Part A. Processing of Customer Personal Data
| Subject matter | OpsCompanion’s provision of the Services to Customer under the Agreement. |
|---|---|
| Categories of Data Subjects | (a) Authorized Users; (b) Endpoint Users, including Customer’s employees and contractors; and (c) individuals whose personal data may appear in Feedback Submissions, diagnostics, support interactions, or session recordings. |
| Categories of Customer Personal Data | (a) Identity and account data: names, email addresses, user IDs, organization identifiers, authentication and directory attributes; (b) Device and network data: IP and MAC addresses, serial numbers, hardware and device IDs, hostnames, operating system versions, CPU architecture, device models, and client versions; (c) AI activity data: providers, models, timestamps, session and request identifiers, request sizes, latency, Policy matches, detection categories, and enforcement actions; (d) Technical data: agent health, certificate status, network interception services, system configuration, performance, and diagnostics; (e) Cloud Console activity: authentication events, navigation, URLs, usage analytics, errors, and session recordings where enabled; and (f) Support data: support communications, Feedback Submissions, and incidentally captured content. |
| Sensitive data | Under Section 9.1 of the Terms, Routine Service Data excludes prompt and response bodies, file contents, matched sensitive values, and request or Policy paths. Sensitive personal data may be incidentally included in support submissions, diagnostics, Cloud Console analytics, or session recordings, subject to the safeguards in the Agreement and Annex II. |
| Frequency of transfer | Continuously or periodically while the Software operates, upon Cloud Console interactions, and when Customer submits support or feedback information. |
| Nature of processing | Collection, recording, organization, storage, display, analysis, transmission to Customer-Designated Destinations when that feature is available, de-identification, and deletion. |
| Business Purposes | (a) Providing the Cloud Console, including Policy synchronization, licensing and activation of Endpoints, and display of Service Data to Authorized Users; (b) delivering Updates; (c) providing Support, including diagnosing crashes; (d) securing the Services and detecting and preventing security incidents and fraud; (e) de-identifying Service Data to create Usage Data; (f) evaluating and improving detection rules and models using Feedback Submissions that Customer authorizes under Section 9.4(b) of the Terms; and (g) complying with law. |
| Duration and retention | The term of the Agreement and the deletion periods in Section 10 of this DPA. During the term, OpsCompanion retains Service Data in the Cloud Console for twelve (12) months, deletes Endpoint Content within the period that Section 9.1 of the Terms states, and retains Feedback Submissions until Customer revokes its authorization under Section 9.4(b) of the Terms or the Agreement ends. |
| Subprocessors | The Subprocessors set forth in Annex III, for the services and in the locations stated there. |
Part B. AI Features
| AI Feature | Function | Where it runs | Data sent off the Endpoint |
|---|---|---|---|
| AI traffic discovery | Identifies Third-Party AI Services and the account types used to access them, using traffic analysis and classification. | Endpoint | The classification result, as Service Data. |
| Sensitive-data detection and redaction | Detects sensitive information using rules and local classifiers and enforces configured Policies. | Endpoint | Provider, client, model, classification results, and usage metadata as Service Data. |
| Prompt-injection detection | Identifies potentially malicious instructions or attempts to manipulate AI systems. | Endpoint | Detection categories, matched rule identifiers, and enforcement actions. No underlying sensitive values. |
| Natural-language Policy authoring | A third-party language model generates proposed Policies from an administrator’s instructions, for the administrator’s review. | Cloud Console | None. Administrator-provided instructions may be transmitted to a third-party model provider for processing. |
| Per-user AI use flags | Identifies unauthorized use of Third-Party AI Services based on collected Service Data. | Cloud Console | None directly; derived from previously transmitted Service Data. |
Other Service Data. In addition to the results above, the Software transmits, as Service Data, operational metadata, including event and session identifiers, timestamps, IP and MAC addresses, device identifiers, serial numbers, hostnames, operating system information, CPU architecture, client versions, request sizes, latency metrics, Policy metadata, and service health status.
Models in use: Third-party AI models, currently provided by OpenAI. Model providers and versions may change in accordance with this DPA.
ANNEX II
TECHNICAL AND ORGANIZATIONAL MEASURES
OpsCompanion maintains the following measures, as Section 5.1 of this DPA provides.
1. Governance. A written information security program, including policies on information security, privacy, access control, incident response, business continuity and disaster recovery, vendor risk, secure development, vulnerability management, data retention and deletion, acceptable use, and the use of artificial intelligence by personnel, each approved and reviewed at least annually; a designated security lead; and examination of OpsCompanion’s controls by an independent auditor under the SOC 2 framework.
2. Personnel. Background checks before engagement; written confidentiality and invention assignment agreements; security and privacy training at onboarding and annually, including training on the use of artificial intelligence tools; and documented offboarding with prompt revocation of access.
3. Access control. Centralized identity management with multi-factor authentication for all personnel accounts and privileged accounts; a credential manager; role-based access on a least-privilege basis; separate administrator accounts for privileged access; quarterly access reviews; a documented emergency-access procedure; and access to production systems, update infrastructure, and code-signing keys limited to authorized engineering personnel.
4. Encryption. Transport Layer Security for data in transit between Endpoints, the Cloud Console, and Subprocessors; encryption at rest for production data and backups; storage of secrets separately from source code; and documented key rotation and revocation, with restricted access to keys.
5. Endpoint software. A certificate authority key pair unique to each Endpoint, with the private key stored in the operating system’s protected key store and marked as non-exportable where the operating system supports that attribute; removal of that certificate and those keys through the uninstallation process that the Documentation describes; decryption limited to traffic that the Software classifies as directed to a Third-Party AI Service; digitally signed Software releases using the code-signing mechanism that the operating system vendor provides for that operating system, including notarization where the operating system vendor offers it; and controls designed to prevent modification of Policies on the Endpoint other than through the CloudConsole.
6. Secure development. Source control with protected branches and required peer review; continuous integration and delivery with automated testing, static analysis, dependency scanning, and secret scanning; restricted code-signing keys; and documented rollback procedures.
7. Vulnerability management. An independent penetration test at least annually, covering the Cloud Console and its application programming interfaces, the policy and licensing services, and the update pipeline; and remediation of identified vulnerabilities within documented timelines based on severity.
8. Monitoring and incident response. Infrastructure monitoring and alerting; a written incident response plan that addresses severity classification, containment, evidence preservation, regulatory notification, and post-incident review; and an annual tabletop exercise.
9. Business continuity. Automated daily encrypted backups of production data, regular testing of restoration, and a business continuity and disaster recovery plan exercised at least annually.
10. Physical and device security. Company-owned devices for all personnel, with full-disk encryption and automatic screen locking; a device inventory; restricted physical access to OpsCompanion’s office; and hosting of the Cloud Console with Subprocessors that maintain physical security controls for their facilities.
11. Vendor management. An inventory of vendors and documented review of each vendor that processes Customer Personal Data.
12. Data minimization. Inspection of Endpoint Content on the Endpoint, and the restrictions on transmission, use, and deletion of Endpoint Content in Section 9.1 of the Terms.
ANNEX III
SUBPROCESSORS
Subprocessors can be found at https://trust.opscompanion.ai/subprocessors