AIQ Partner Data Processing Agreement

aiq partner data processing agreement effective december 11th, 2023 this partner data processing addendum (the “addendum”) is entered into by the partner (“partner”) and the relevant alpine iq entity engaged in the services (referred to generally as “aiq”) and forms part of and shall be incorporated into the underlying relationship and agreements (including but not limited to the aiq api terms of use and the partner referral and revenue share agreement) between aiq and the partner (collectively the “agreement”) in relation to both aiq and partner’s (each a “party” or together the “parties”) processing of personal information under the agreement 1\ introduction 1 1 both partner and aiq provide services under the agreement that may involve the processing of personal information within and outside the united states if partner and aiq mutually agree under written consent to process personal information outside the united states and canada, then the eu specific provisions set out in this addendum shall comply provided the parties mutually agree on which party shall be the controller and/or processor within the context of this addendum 1 2 both partner and aiq agree to comply in good faith with the terms set out in this addendum 1 3 if any language in this addendum conflicts with the agreement, this addendum shall control 2\ definitions unless otherwise set out below, each capitalized term in this addendum shall have the meaning set out in the agreement 2 1 “alternative transfer mechanism” means a mechanism other than the standard contractual clauses that enables the lawful transfer of personal information from the european economic area (“eea”), the united kingdom (“uk”) or switzerland to a third country in accordance with applicable data protection laws, including, but not limited to, programs both approved and operated by the u s department of commerce and approved by the european commission or other applicable governmental authority or entity 2 2 “applicable data protection laws” means all applicable federal, state, provincial, regional and local laws, directives, regulations, and rules imposed by any government, agency or authority in relation to the processing and security of personal information, including, but not limited, to the european union’s general data protection regulation (regulation 2016/679) pertaining to the protection of individuals within the european economic area (“eu gdpr”), the eu directive on privacy and electronic communications 2002/58/ec (“pecr”), the data protection law of the united kingdom, including but not limited to the eu gdpr as incorporated into the united kingdom, the data protection act 2018 and any additional legislation (“uk gdpr”), switzerland’s federal data protection act of 19 june 1992, canada’s personal information protection and electronic documents act (“pipeda”), as well as any applicable provincial legislation, the ccpa, and other us privacy laws as any of the foregoing may be amended, replaced or superseded 2 3 “ccpa” means, as applicable, the california consumer privacy act of 2018, california civil code 1798 100 et seq (2018), including as amended by the california privacy rights act of 2020; and any subsequent replacements to the foregoing laws all implementing regulations forming part of the laws above shall also be included in this definition 2 4 “controller” means the entity that determines as a legal person alone or jointly with others the purposes and means of the processing of personal information for the purposes of this aiq partner agreement, “controller” includes similarly defined terms under the applicable data protection laws, including, but not limited to, a “business ” 2 5 “gdpr” means, as applicable, the eu gdpr and the uk gdpr 2 6 "individual” has the same meaning as “consumer” or “data subject” under the applicable data protection laws 2 7 “individual rights request” means the exercise of an individual’s right over their personal information (for example deletion, access or rectification) and shall be understood to have the same meaning as a “data subject rights request”, “a consumer right”, “a personal data rights request”, and similar terms as may be defined under applicable data protection laws 2 8 “subscriber” means the contracting entity listed on the applicable aiq service order form 2 9 “personal information” means any information relating to an identified or identifiable individual or household personal information may include, but is not limited to, a name, address, contact details, unique identifiers, payment card information, biometric identifiers and information, preferences, history and profile data, ip addresses, and location based information, but excludes aggregated or anonymized information personal information shall include any information that constitutes “personal information” or “personal data” under the applicable data protection laws 2 10 “process” or “processing” means any operation or set of operations performed on personal information or sets of personal information, whether or not by automated means, including, but not limited to, the collection, access, use, alteration, disclosure, or deletion of personal information 2 11 “processor" means the entity which processes personal information on behalf of a controller 2 12 “sale” or “sell” has the same meaning as such term is defined in the ccpa, any subsequent or similar legislation or other applicable data protection laws as enacted or amended from time to time 2 13 “security incident” means any accidental or unlawful destruction, loss, alteration, theft, unauthorized disclosure of, or access to, personal information 2 14 “services” means services provided as part of the aiq partner agreement between aiq and the partner 2 15 “share” or “sharing” has the same meaning as such term is defined in the ccpa, any subsequent or similar legislation or other applicable data protection laws as enacted or amended from time to time 2 16 “standard contractual clauses” or “sccs” means (i) in respect of eu personal information, the standard contractual clauses implemented by the commission implementing decision (eu) 2021/914 of 4 june 2021 for the transfer of personal data to third countries pursuant to the eu gdpr, as updated or replaced from time to time (“eu standard contractual clauses”) and (ii) in respect of uk personal information, means the international data transfer addendum to the eu standard contractual clauses issued by the uk information commissioner’s office (ico) in accordance with the uk gdpr and the data protection act 2018, as amended or replaced (“uk addendum”) 2 17 “sub processor” means any additional authorized processor engaged by the original processor that agrees to receive any personal information from aiq as part of the services 2 18 “third party” means any controller, processor or sub processor engaged by a party that agrees to receive personal information as part of the services 2 19 “us privacy laws” refers to state specific privacy laws in the united states, including the ccpa, the virginia consumer data protection act, the colorado privacy act, the connecticut data privacy act, the utah consumer privacy and other state specific privacy laws as amended; and any subsequent replacements to the foregoing laws all implementing regulations forming part of the laws above shall also be included in this definition data processing 3\ controller obligations the parties agree that aiq shall act as a controller only where (i) data is disclosed in the context of a referral relationship, and/or (ii) specifically set forth in the agreement if neither party is a controller, the terms provided under this section 3 are not applicable to the agreement to the extent aiq and partner process personal information as controllers as part of the agreement, the parties agree that 3 1 independent controllers each party shall act as independent controller and no “joint controller” relationship shall exist under the applicable data protection laws 3 2 compliance with law both parties agree to comply with applicable data protection laws and shall not by any act or omission, put the other party in breach of those laws 3 3 compliance obligations each party is obligated to manage its respective compliance obligations pursuant to applicable data protection laws and putting in place any applicable controls or governance, which may include (i) the provision and maintenance of a privacy statement or similar notice for each party’s respective processing; (ii) providing written notices to individuals (iii) obtaining any required consents (including initial consents or consents for secondary uses) before any initial or subsequent use or disclosure of personal information; (iv) fulfillment and management of opt outs and individual rights requests; (v) compliance with any applicable direct marketing or spam legislation, and (vi) the oversight of processing operations involving personal information 3 4 individual rights requests each party shall comply with individual rights requests under applicable data protection laws (including the right to withdraw consent, of access, restriction, rectification, and erasure) in relation to personal information the parties shall reasonably cooperate with each other to respond to such requests where required or appropriate 3 5 no sales or sharing each party represents and warrants that, to the best of its knowledge, the transfer of personal information under the agreement between the parties does not constitute a “sale” or “sharing” under the applicable data protection laws the parties agree that any transfers of personal information to third parties, whether made directly by a party or made at the request of the other party will not constitute a “sale” or “sharing” to the extent any transfer to a third party is found to later constitute a “sale” or “sharing” the party responsible for instructing that transfer shall be solely responsible for implementing the appropriate disclosures and managing any subsequent legal obligations (e g , opt outs) under the applicable data protection laws 4\ processor obligations this section is divided into two sections depending on the relationship of the parties the first section (4 1 4 10) applies only to the extent that aiq is a processor acting on behalf of the partner as a controller the second section (4 11 4 15) applies where both aiq and the partner are processors (in most cases with each party acting on behalf of independent third parties) partner as a controller and aiq as a processor to the extent aiq processes personal information as a processor where partner is a controller under the agreement, aiq agrees that 4 1 processing aiq shall only process the personal information on documented instructions of the partner and in order to provide the services or where required by applicable law, in which case aiq will inform partner of the legal requirement unless aiq is prohibited from doing so by law 4 2 audits and assessments to the extent required under the applicable data protection laws, aiq shall make available to partner all information necessary to demonstrate compliance with the obligations under such laws 4 3 ccpa service provider where aiq acts as a “service provider” for the purposes of the ccpa, and with respect to personal information it processes in such capacity, in addition to the obligations set forth in this dpa and to the extent the ccpa applies aiq shall not (a) combine personal information it receives in in connection with the services with personal information it may receive from other sources (b) “sell” or “share” personal information as such terms are defined in the ccpa (c) retain, use, or disclose personal information for any purpose other than to provide the services, and as otherwise permitted by applicable law (including but not limited to applicable data protection laws), (d) retain, use or disclose personal information outside of the direct business relationship between the parties or outside the provision of the services, and (e) disclose personal information to any person without including them on the list of sub processors described below the parties acknowledge that the transfer of personal information is in furtherance of a business purpose, described in the agreement 4 4 sub processors partner grants aiq a general authorization to appoint sub processors to process personal information under the agreement and permits each sub processor to appoint sub processors in accordance with the terms herein aiq will have a written agreement with the sub processor imposing substantially similar obligations as those set out under this addendum aiq is responsible to partner (or as applicable, a third party) for the failure of any sub processors to perform their obligations under this addendum see annex 3 of this addendum for a link to a website detailing aiq’s current sub processors by visiting that site, partner may also register to be notified of any modifications to the sub processor list (a “notification”) 4 5 gdpr sub processors in the case of a sub processor appointed that will process personal information subject to the gdpr, if partner objects on reasonable grounds to the use of a specific sub processor it must inform aiq of such objection in writing (by email to privacy\@alpineiq com) within 15 days of receipt of notification aiq will use reasonable efforts to make available to partner a change in the services or recommend a commercially reasonable change to the configuration or use of the services by partner to avoid processing of personal information by the objected to new sub processor aiq shall at its option (a) within a commercially reasonable timeframe find a replacement sub processor; or (b) provide a termination right pursuant to the agreement before the sub processor first processes personal information, aiq agrees to carry out adequate due diligence to ensure that the sub processor is capable of providing the level of protection for personal information required by the agreement aiq will provide for partner to review the form of agreement for such written contract, as partner may request up to once per year 4 6 retention and deletion upon termination of the agreement, aiq shall return or delete any personal information on partner’s request, except where it is required to retain the personal information to comply with applicable laws, or, where permitted, such retention is in line with aiq’s current data retention schedule 4 7 reasonable support aiq shall provide reasonable assistance and cooperation to partner in relation to any individual rights requests made pursuant to the applicable data protection laws in the event aiq receives a notification or request pursuant to this section, aiq shall notify partner and shall not respond to the individual making the request unless required to do so under applicable law (including the applicable data protection laws) additionally, upon partner’s request, aiq shall provide partner with reasonable assistance and cooperation needed to fulfill partner’s obligation to carry out a data protection impact assessment related to partner’s use of the services, to the extent that partner does not otherwise have access to the relevant information and to the extent that such information is available to aiq 4 8 government access requests if aiq becomes aware that any government authority (including law enforcement) wishes to obtain access to or a copy of some or all of the personal information of partner, whether on a voluntary or a mandatory basis, then unless legally prohibited under applicable law, aiq shall (1) immediately notify partner (2) inform the requestor that aiq is a processor and is not authorized to disclosure the personal information (3) inform the requestor that the request must be sent to the partner (4) not provide access to the personal information unless required by applicable law or authorized by the partner in writing if applicable law prohibits aiq from complying with (1) to (4) above, then aiq shall use any lawful means to challenge (a) disclosure of the personal information and (b) the prohibition to notify partner 4 9 third party transfers partner acknowledges that aiq is not responsible for the processing of personal information by third parties where the personal information is sent by aiq to the third party on the instructions of the partner 4 10 additional gdpr processor obligations in addition to the other requirements set out in this addendum, to the extent aiq processes personal information subject to the gdpr, uk gdpr or laws of switzerland, aiq shall comply with all requirements under article 28 of the gdpr in relation to aiq’s role as a processor (or the relevant equivalent requirements as applicable) this includes the contractual obligations set out in article 28(3) as set out in this addendum aiq and partner as processors to the extent both aiq and partner process personal information as independent processors on behalf of a third party under the agreement, the parties agree that the following terms shall apply to the relationship 4 11 compliance with law each party shall comply with all applicable data protection laws and not by any act or omission put the other party in breach of those laws 4 12 partner authority where partner acting as processor requests that aiq process personal information from a third party (e g , a merchant), partner represents and warrants that it has the requisite authority from the third party controller for such instruction 4 13 merchant processing to the extent that partner is acting as a processor on behalf of a merchant controller and the merchant directs aiq to transfer personal information to partner, partner agrees that it shall (i) adhere to any and all obligations of a processor under the applicable data protection laws; (ii) only process the personal information in line with the instructions of the merchant and to provide the requisite services; (iii) be responsible for evaluating aiq’s information collection practices and disclosures and ensuring that any downstream use by the partner (whether on behalf of a third party or on behalf of the controller) is compliant and permitted under the applicable data protection laws; and (iv) ensure that at the end of the agreement with the merchant that personal information is either returned or destroyed at the election of merchant absent any obligation to retain the information under the applicable law 4 14 sub processor relationship in the event that partner is required to act as a sub processor at any time during the services, the parties shall negotiate a set of mutually agreeable written terms to govern such processing activity 4 15 ccpa service providers for the purposes of the ccpa, as applicable, both parties shall act as a “service provider” and not (a) combine personal information it receives in in connection with the services with personal information it may receive from other sources (b) “sell” or “share” personal information as such terms are defined in the ccpa (c) retain, use, or disclose personal information for any purpose other than to provide the services, and as otherwise permitted by applicable law (including but not limited to applicable data protection laws), and (d) retain, use or disclose personal information outside of the direct business relationship between the parties or outside the provision of the services aiq’s processor obligations above shall be read and interpreted in light of any additional rights aiq may have in relation to the personal information pursuant to an agreement with a merchant or third party 5\ security 5 1 security measures taking into account the state of the art, costs of implementation, the nature, scope, context and purpose of the processing, each party shall implement and maintain a written information security program embodying all appropriate technical, organizational and administrative security measures required to protect the privacy and security of any personal information processed as part of the services in all cases, the parties shall implement any and all security measures imposed under the applicable data protection laws 5 2 confidentiality anyone authorized to process personal information on behalf of the parties shall either have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality 6\ security incidents 6 1 security incident response program each party shall implement and maintain a written incident response program for the management of security incidents 6 2 notification of a security incident if either party discovers, is notified of or reasonably suspects the occurrence of a security incident impacting any personal information processed under the agreement, that party will notify the other party without undue delay the timing of such notification shall not exceed seventy two (72) hours after having become aware of a security incident or such other time limit imposed under the applicable data protection laws such notice shall (where known) contain the following (i) the facts of the security incident, including the date of discovery, a date range of unauthorized activity, and any remediation and mitigation activities that have been taken or put in place; (ii) a description of the categories and approximate number of individuals and records affected by the security incident; (iii) the party’s assessment, developed through reasonable diligence, of the likely consequences of the security incident with respect to the affected personal information and affected individuals; and (iv) the name and the contact details of the data protection officer or other contact point where more information can be obtained the parties will reasonably assist each with any obligation to inform any impact individuals or any regulatory body of the security incident 6 3 costs and remediation obligations to the extent any security incident is attributable to the actions of a specific party or its third parties, that party shall be responsible for all costs associated with the security incident, including, but limited to, the following (i) the cost of providing notice to affected individuals; (ii) the cost of providing notice to government agencies, credit bureaus, and/or other entities required to be notified under applicable law; (iii) the cost of providing affected individuals with credit monitoring services (as appropriate or as required by the applicable data protection laws); (iv) call center support for such affected individuals; (v) the cost of any other measures required under the applicable data protection laws; and (vi) other losses, liabilities or expenses for which that party would be liable in all cases, as to the personal information processed under this agreement impacted by a security incident, the parties shall, where appropriate and reasonable, cooperate and work together as part of the remediation efforts 7\ data transfers 7 1 transfers generally each party is permitted to transfer personal information under the agreement to locations around the world provided that such transfers comply with applicable data protection laws 7 2 eea, switzerland and united kingdom transfers in the event either party processes the personal information of individuals residing in the eea, switzerland or the united kingdom as part of the services, a party shall only be permitted to transfer such personal information outside those jurisdictions if such transfers are compliant with the applicable data protection laws 7 3 restricted transfers and sccs in the event aiq or partner seeks to transfer personal information collected as part of this agreement to a country not deemed adequate by the european commission or other governmental bodies that is not covered by an alternative transfer mechanism, the parties agree that the following shall apply i where aiq and partner are controllers and act as either a data exporter or a data importer, the parties agree that module 1 of the sccs shall apply along with the uk addendum ii where aiq is acting as a processor on behalf of a controller partner and is the data importer, the parties agree that module 2 of the sccs shall apply along with the uk addendum iii where aiq and partner are processors and aiq or the partner acts as a data exporter or a data importer, the parties agree that module 3 of the sccs shall apply along with the uk addendum the sccs and uk addendum shall be populated with the following provisions (as applicable) for the purposes of the eea and switzerland section reference concept selection by the parties module in operation modules one, two and three section i, clause 7 docking the option under clause 7 shall not apply section ii, clause 9 sub processors option 2 (general written authorization) under clause 9 shall apply see clause 4 5 of this addendum section iv, clause 17 governing law transfers under the eu sccs will be governed by the laws of ireland the swiss federal act on data protection (fadp) insofar as the transfers are governed by the fadp section iv, clause 18(b) choice of forum and jurisdiction the courts of ireland shall have exclusive jurisdiction to resolve any dispute or lawsuit arising out of or in connection with the eu sccs annex 1 a list of parties see annex 1 section a annex i b description of transfer see annex 1 section b annex i c competent supervisory authority irish data protection commissioner federal data protection and information commissioner insofar as the transfers are governed by the fadp annex ii technical and organizational measures see annex 2 of this addendum annex iii sub processors see annex 3 of this addendum (only for modules two and three) additional adaptations insofar as the fadp governs the transfers the term ‘member state’ must not be interpreted in such a way as to exclude data subjects in switzerland from the possibility of suing for their rights in their place of residence (switzerland) in accordance with clause 18(c) of the sccs references to “gdpr” are to be understood as references to fadp the sccs shall apply to data pertaining to legal entities until the entry into force of the revised fadp for the purposes of the uk, the parties agree that the eu standard contractual clauses will apply but will be modified and interpreted in accordance with the uk addendum and agree as follows table or section reference concept selection by the parties table 1 parties see annex 1 section a of this addendum table 2 selected sccs, modules and selected clauses modules one, two and three of the eu standard contractual clauses entered into on the date of the agreement table 3 appendix information annex 1a shall be populated with the information in annex 1 section a of this addendum annex 1b shall be populated with the information in annex 1 section b of this addendum annex ii shall be populated with annex 2 of this addendum annex iii shall be populated with annex 3 of this addendum (only for modules two and three) table 4 end of uk addendum when the approved addendum changes neither party may end this uk addendum per section 19 of the uk addendum, except as set forth in this addendum section i, clause 7 docking the option under clause 7 shall not apply section ii, clause 9 sub processors option 2 (general written authorization) under clause 9 shall apply see clause 3 2(iii) of this addendum section ii, clause 11 redress the option under clause 11 shall not apply section iv, clause 17 governing law the laws of england and wales insofar as the transfers are governed by uk data protection law section iv, clause 18(b) choice of forum and jurisdiction the courts of england and wales shall have exclusive jurisdiction to resolve any dispute or lawsuit arising out of or in connection with the uk addendum part 2 mandatory clauses mandatory clauses of the uk addendum as issued by the information commissioner’s office and laid before the united kingdom parliament in accordance with section 119a of the data protection act 2018 on february 2, 2022, as it is revised under section 18 of those mandatory clauses section any conflict between the terms of the standard contractual clauses and the uk addendum will be resolved in accordance with section 10 and section 11 of the uk addendum 7 4 in the event of any changes to the uk addendum after signature of this addendum, the parties agree to cooperate in good faith and repopulate any replacement uk addendum 7 5 if the sccs are implemented, adopted or recognized as a legitimate data transfer mechanism in countries other than the eea countries, then the parties shall apply the scc modules to the transfer of personal information originating from such country( ies) 7 6 to the extent section 7 3 of this addendum is relevant and where partner acts as an importer, as required, partner shall include the relevant sccs annexes (e g technical and organizational measures and sub processors annexes) in the main body of the agreement 7 7 alternative transfer mechanisms if a party is relying on an alternative transfer mechanism as a legal ground for the transfer of personal information under the agreement, that party shall be responsible for ensuring that the alternative transfer mechanism provides the same level of protection for personal information imposed on the party under this addendum 8\ miscellaneous 8 1 assurances notwithstanding any requirements or specific rights granted to the parties under the applicable data protection laws, each party shall, with reasonable notice, have the right to obtain assurances from the other party to verify each party’s compliance with the terms of this addendum if it has a reasonable suspicion of a breach or a potential breach under this addendum 8 2 survival each party’s obligations under this addendum will survive the termination of the aiq partner agreement to the extent either party continues to process personal information covered by the agreement 8 3 severability if any court or competent authority decides that any term of this addendum is held to be invalid, unlawful, or unenforceable to any extent, such term shall, to that extent only, be severed from the remaining terms, which shall continue to be valid to the fullest extent permitted by law 8 4 waiver either party’s failure to enforce any provision of this addendum shall not constitute a waiver of that or any other provision and will not relieve the other party from the obligation to comply with such provision annex 1 a list of parties 1 partner / data exporter or data importer, as applicable name as set forth in the agreement address as set forth in the agreement contact person as set forth in the agreement activities related to data transfer under the clauses services associated with facilitation of pos related, digital ordering and other related services, employees and consumer guests role (controller/processor) if standard contractual clauses module one applies, partner is the data controller (either as exporter or importer) (note module one will be most relevant where partner is sending aiq information (as exporter) or in receipt of information from aiq (as importer) as part of a referral relationship) if standard contractual clauses module two applies, partner is the data controller (as exporter) and aiq is the data processor (note module two will be most relevant where partner is sending aiq information (as exporter) as part of an integration relationship) if standard contractual clauses module three applies, partner is the data processor (note module three will be most relevant where partner is sending aiq information (as exporter) or in receipt of information from aiq (as importer) as part of an integration relationship) 2 aiq / data importer or data exporter, as applicable name aiq address 2205 w 136th avenue ste 106 pmb 3058 broomfield, co 80023 contact person assistant general counsel, privacy; security\@alpineiq com activities related to data transfer under the clauses services associated with facilitation of pos related, digital ordering and other related services, employees and consumer guests role (controller/processor) if standard contractual clauses module one applies, aiq is the data controller (either as exporter or importer) (note module one will be most relevant where aiq is sending partner information (as exporter) or in receipt of information from partner (as importer) as part of a referral relationship) if standard contractual clauses module two applies, aiq is the data processor (as importer) and partner is the data controller (note module two will be most relevant where aiq is in receipt of information from partner (as importer) as part of an integration relationship) standard contractual clauses module three aiq is the data processor (note module three will be most relevant where aiq is sending the partner information (as exporter) or in receipt of information from partner (as importer) as part of an integration relationship) b description of transfer & processing module one partner is controller aiq is controller module two partner is controller aiq is processor module three aiq is processor partner is processor categories of data subjects guests employees guests employees guests employees categories of personal information guests name, email, phone, address, payment card information, government id merchant employees name, email, phone, wages, scheduling and related employment information guests name, email, phone, address, payment card information, government id merchant employees name, email, phone, wages, scheduling and related employment information guests name, email, phone, address, payment card information, government id merchant employees name, email, phone, wages, scheduling and related employment information sensitive data processed not applicable not applicable not applicable transfer frequency ongoing transfers ongoing transfers ongoing transfers nature of processing processing and storage of information required to facilitate the partner services as detailed in the agreement processing and storage of information required to facilitate the partner services as detailed in the agreement processing and storage of information required to facilitate the partner services as detailed in the agreement purpose of processing facilitation of the services provided by the partner as part of the agreement facilitation of the services provided by the partner as part of the agreement facilitation of the services provided by the partner as part of the agreement retention period for the period stated in the agreement or as otherwise provided for under the applicable law for the period stated in the agreement or as otherwise provided for under the applicable law for the period stated in the agreement or as otherwise provided for under the applicable law annex 2 aiq security measures technical and organizational measures including technical and organizational measures to ensure the security of the data explanatory note the technical and organizational measures must be described in specific (and not generic) terms see also the general comment on the first page of the appendix, in particular on the need to clearly indicate which measures apply to each transfer/set of transfers description of the technical and organizational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons organizational security information security program we have an information security program in place that is communicated throughout the organization our information security program follows the criteria set forth by the soc 2 framework soc 2 is a widely known information security auditing procedure created by the american institute of certified public accountants third party audits our organization undergoes independent third party assessments to test our security and compliance controls third party penetration testing we perform an independent third party penetration at least annually to ensure that the security posture of our services is un compromised roles and responsibilities roles and responsibilities related to our information security program and the protection of our customer’s data are well defined and documented our team members are required to review and accept all of the security policies security awareness training our team members are required to go through employee security awareness training covering industry standard practices and information security topics such as phishing and password management confidentiality all team members are required to sign and adhere to an industry standard confidentiality agreement prior to their first day of work background checks we perform background checks on all new team members in accordance with local laws cloud security cloud infrastructure security all of our services are hosted with amazon web services (aws) | google cloud platform (gcp) they both employ a robust security program with multiple certifications for more information on our provider’s security processes, please visit aws security | gcp security data hosting security all of our data is hosted on amazon web services (aws) | google cloud platform (gcp) databases these databases are all located in the united states unless otherwise requested please reference the above vendor specific documentation linked above for more information encryption at rest all databases are encrypted at rest encryption in transit our applications encrypt in transit with tls/ssl only vulnerability scanning we perform vulnerability scanning and actively monitor for threats logging and monitoring we actively monitor and log various cloud services business continuity and disaster recovery we use our data hosting provider’s backup services to reduce any risk of data loss in the event of a hardware failure we utilize monitoring services to alert the team in the event of any failures affecting users incident response we have a process for handling information security events which includes escalation procedures, rapid mitigation and communication access security permissions and authentication access to cloud infrastructure and other sensitive tools are limited to authorized employees who require it for their role where available we have single sign on (sso), 2 factor authentication (2fa) and strong password policies to ensure access to cloud services are protected least privilege access control we follow the principle of least privilege with respect to identity and access management quarterly access reviews we perform quarterly access reviews of all team members with access to sensitive systems password requirements all team members are required to adhere to a minimum set of password requirements and complexity for access password managers all company issued laptops utilize a password manager for team members to manage passwords and maintain password complexity vendor and risk management annual risk assessments we undergo at least annual risk assessments to identify any potential threats, including considerations for fraud vendor risk management vendor risk is determined, and the appropriate vendor reviews are performed prior to authorizing a new vendor for transfers to (sub ) processors, also describe the specific technical and organizational measures to be taken by the (sub ) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub processor, to the data exporter annex 3 approved sub processors a list of aiq’s current sub processors can be found at data sub processors docid\ q6egwbvcryd8izwutcdk0