Sequin Labs has implemented and will maintain appropriate technical and organizational security measures to protect customer personal data from security incidents and to preserve the security and confidentiality of the customer personal data ("Security Measures"). The Security Measures applicable to the Services are as follows:

1. Security Awareness Training: Sequin Labs will provide annual security training to all personnel. "Security Training" shall address security topics to educate users about the importance of information security and safeguards against data loss, misuse or breach through physical, logical and social engineering mechanisms. Training materials will address industry standard topics which include, but are not limited to:

   • The importance of information security and proper handling of PII

   • Physical controls such as visitor protocols, safeguarding portable devices and proper data destruction.

   • Logical controls related to strong password selection/best practices.

   • How to recognize social engineering attacks such as phishing.

2. Vulnerability Scan: Sequin Labs shall ensure that vulnerability scans are performed on servers continuously and network security scans are completed at a minimum biannually, in each case using an industry standard vulnerability scanning tool.

3. Employee-Related Policies:

   a. Unauthorized persons will be prevented from gaining physical access to our premises and the rooms where data processing systems are located.

   b. Employees will only be allowed access to tasks assigned to them.

   c. We will ensure that all computers processing personal data (including computers with remote access) are password protected, both after booting up and when left, even for a short period.

   d. We will assign individual user passwords for authentication.

   e. We will only grant system access to our authorized personnel and strictly limit their access to applications required for those personnel to fulfil their specific responsibilities.

   f. We will implement a password policy that prohibits the sharing of passwords, outlines procedures to follow after disclosure of a password, and requires that passwords be changed regularly.

   g. We will ensure that passwords are always stored in encrypted form.

   h. We will have adopted procedures to deactivate user accounts when an employee, agent, or administrator leaves our employ or moves to another responsibility within the company.

   i. We will be able to retrospectively examine and establish whether and by whom your customer personal data has been entered into data processing systems, modified or removed.

   j. We will log administrator and user activities.

   k. We will process the customer personal data received from different clients so that in each step of the processing the controller can be identified and so that data is always physically or logically separated.

4. Process-Level Requirements: We will implement the following processes to ensure security and privacy:

   a. Sequin Labs shall implement user termination controls that include access removal/disablement promptly upon termination of staff.

   b. Documented change control process will be used to record and approve all major releases in Sequin Labs's environment.

   c. Sequin Labs shall have and maintain a patch management process to implement patches in a reasonable, risk-based timeframe.

   d. Sequin Labs shall use firewall(s), Security Groups/VPCs, or similar technology to protect servers storing Customer Personal Data.

   e. Where Sequin Labs handles customer personal data, servers shall be protected from unauthorized access with appropriate physical security mechanisms including, but not limited to, badge access control, secure perimeter, and enforced user provisioning controls (i.e. appropriate authorization of new accounts, timely account terminations and frequent user account reviews). These physical security mechanisms are provided by data center partners such as, but not limited to, AWS, Azure, and Google. All cloud-hosted systems shall be scanned, where applicable and where approved by the cloud service provider.

   f. Whenever an employee or contractor leaves or is terminated, that individual's access to customer user accounts shall be immediately terminated or disabled.

5. Application-Level Requirements

   a. Sequin Labs shall maintain documentation on overall application architecture, process flows, and security features for applications handling customer personal data.

   b. Sequin Labs shall employ secure programming techniques and protocols in the development of applications handling customer personal data.

   c. Sequin Labs shall employ industry standard scanning tools and/or code review practices, as applicable, to identify application vulnerabilities prior to release.

6. Data-Level Requirements

   a. Encryption and hashing protocols used for customer personal data in transit and at rest shall support NIST approved encryption standards (e.g. SSH, TLS).

   b. Sequin Labs shall ensure laptop disk encryption.

   c. Sequin Labs shall ensure that access to information and application system functions is restricted to authorized personnel only.

   d. Customer personal data stored on archive or backup systems shall be stored at the same level of security or better than the data stored on operating systems.

7. End User Computing Level Requirements

   a. Sequin Labs shall employ an anti-virus solution with daily signature updates for end-user computing devices which connect to the customer network or handle customer personal data.

   b. Sequin Labs will prohibit the use of removable media for storing or carrying customer personal data. Removable media include flash drives, CDs, and DVDs.

8. Compliance Requirements

   a. Sequin Labs will implement building access control to control and track access to its networks and other equipment.

   b. Sequin Labs will, when and to the extent legally permissible, perform criminal background verification checks on all of its employees that provide services to customers prior to obtaining access to customer personal data. Such background checks shall be carried out in accordance with relevant laws, regulations, and ethics.

   c. Sequin Labs will determine each year which officers and employees within the company will have access to which categories of data and shall review this list annually at the executive level.

9. Personnel. Sequin Labs restricts its personnel from processing Customer Personal Data without authorization by Sequin Labs as set forth in the Security Measures and shall ensure that any person who is authorized by Sequin Labs to process Customer Personal Data is under an appropriate obligation of confidentiality.

10. Security Incident Response. Upon becoming aware of a Security Incident, Sequin Labs will notify Customer without undue delay and, in any case, where feasible, within seventy-two (72) hours after becoming aware. Sequin Labs will provide information relating to the Security Incident as it becomes known or as is reasonably requested by Customer to fulfil its obligations as controller and will also take reasonable steps to contain, investigate, and mitigate any Security Incident.