Vendor Security Terms

2.1“Aggregate”

means to combine or store Socure Information with any data or information of Vendor or any third party.

2.2“Socure Information”

means: (a) all Socure Confidential Information (as defined in the Agreement or in the non-disclosure agreement between the parties); (b) all other data, records, files, content or information received from Socure or its affiliates and Processed by Vendor in connection with the Agreement including, but not limited to, personal information; and (c) data derived from (a) or (b), even if Anonymized.

2.3“Confidentiality, Integrity, and Availability”

refers to the three properties of the information-security model known as the “CIA Triad.” Confidentiality is the property that data or information is not made available or disclosed to unauthorized persons or processes. Integrity is the property that data or information have not been altered or destroyed in an unauthorized manner. Availability is the property that data or information is accessible and useable upon demand by an authorized person.

2.4“Personnel”

means Vendor’s, its Subcontractor’s, and its and their employees, agents, subcontractors, and other authorized users of its or their systems and network resources.

2.5“Physical, Organisational, Personnel , and Technical Safeguards”

refers to the controls an organization implements to maintain information security. Physical safeguards address physical measures, policies, and procedures to protect electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion. Organisational and Personnel safeguards address administrative actions, policies, and procedures to manage the selection, development, implementation, and maintenance of security measures to protect electronic data or information and to manage the conduct of Personnel in relation to the protection of that data or information. Technical safeguards address the technology, and the policies and procedures for its use, that protect electronic data or information and control access to it.

2.6“Process”

means to perform any operation or set of operations on data, such as access, use, collection, receipt, storage, alteration, transmission, dissemination or otherwise making available, erasure, or destruction. The term “Process” also includes “Processing,” “Processor,” and “Processed”.

2.7“Biometric Identifier”

means i) a scan of facial geometry that records or extracts facial measurements or facial landmarks; ii) a retina or iris scan; iii) a fingerprint; or iv) a voiceprint.

3.1Authorized data

Vendor may Process only the Socure Information expressly authorized under the Agreement. If there is no express authorization, the Vendor may process only the Socure Information necessary to perform the services under the Agreement.

3.2Only for purposes expressly authorized

Vendor may Process Socure Information only for purposes expressly authorized under the Agreement.

3.3Sale or other transfer prohibited

Vendor will not transfer, rent, barter, trade, sell, rent, loan, lease, or otherwise distribute or make any Socure Information available to any third party.

3.4Data aggregation prohibited

Vendor will not Aggregate Socure Information, even if anonymized or pseudonymized, except as expressly authorized under the Agreement

4.1General security requirement

Vendor will maintain Physical, Administrative, and Technical safeguards consistent with industry-accepted best practices (including the International Organization for Standardization’s standards ISO 27001 and 27002, the National Institute of Standards and Technology (NIST) Cybersecurity Framework, or other similar industry standards for information security) to protect the Confidentiality, Integrity, and Availability of Socure Information.

4.2Specific safeguard requirements

In addition to following the above standards, Vendor’s information security program will include, at a minimum, the following safeguards and controls:

4.2.1Written information security program

Vendor shall maintain and implement a written information security program, including appropriate policies, procedures, and risk assessments that are reviewed at least annually. The program will apply to Vendor’s employees, agents, subcontractors, and Vendors. Vendor will maintain a process to monitor and enforce program compliance and log program violations.

4.2.2Security awareness training

Vendor will provide periodic and no less than annually, security training to its Personnel on relevant threats and business requirements [such as social-engineering attacks, sensitive data handling, causes of unintentional data exposure, and security incident identification and reporting].

4.2.3Data inventory

Vendor will document and maintain information regarding how and where Socure Information is Processed while in Vendor’s possession or control.

4.2.4Secure configurations

Vendor shall manage security configurations of its systems using industry best practices to protect Socure Information from exploitation through vulnerable services and settings.

4.2.5Controlled use of administrative privileges

Vendor shall limit and control the use of administrative privileges on computers, networks, and applications consistent with industry best practices.

4.2.6Vulnerability and patch management

Vendor will maintain a process to timely identify and remediate system, device, and application vulnerabilities through patches, updates, bug fixes, or other modifications to maintain the security of Socure Information. Vendor must mitigate all discovered actively exploited and public facing Critical vulnerabilities within 48 hours, Critical (CVSS 9.0 – 10.0) vulnerabilities with immediate urgency and no later than 7 days, mitigate High (CVSS 7.0 – 8.9) risk vulnerabilities within 14 days, mitigate Moderate (CVSS 4.0 – 6.9) vulnerability risks in 90 days, and mitigate Low (CVSS 0.1 – 3.9) vulnerability risks in 180 days. CVSS ratings are defined here https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

4.2.7Maintenance, monitoring, and analysis of audit logs

Vendor will collect, manage, retain, and analyze audit logs of events to help detect, investigate, and recover from unauthorized activity that may affect Socure Information. Logs will be kept and maintained for at least 18 months. If Vendor is providing Infrastructure as a Service (IaaS), Platform as a Service (Paas), or Software as a Service (SaaS), Vendor must audit all user management activities in section and provide a tamper-protected audit trail of such activities as an encrypted continuous export stream or file that will be available to Socure information security in a SIEM-compatible format, and can clearly demonstrate the user performing the action, the action taken, success or failure, date and time. Further, in a multi-tenant environment with a shared responsibility model (e.g. a SaaS), Vendor shall associate all logs with a unique Socure implementation id, and provide this information to Socure upon request. Vendor will implement reasonable controls to control access to and prevent modification of security audit logs.

4.2.8Availability Monitoring

If Vendor is providing Infrastructure as a Service (IaaS), Platform as a Service (Paas), or Software as a Service (SaaS), Vendor will implement the following availability monitoring Only applicable to IaaS, PaaS, SaaS vendors:

4.2.9Malware defenses

Vendor will deploy endpoint detection and response and anti-malware software to control, detect and remediate the installation, spread, and execution of malicious code on all assets.

4.2.10Firewalls

Vendor will maintain and configure firewalls to protect systems containing Socure Information from unauthorized access. Vendor will review firewall rule sets at least annually to ensure valid, documented business cases exist for all rules.

4.2.11Dedicated IP Addresses

Vendor will provide and document dedicated IP addresses for services that interact with Socure Information or Socure’s network. These dedicated IP addresses will be used exclusively for Socure’s traffic and will be documented and shared with Socure. This documentation must include the purpose of each IP address, the services associated with it, and any relevant network configuration details.

4.2.12Suitable Environment

Data will be used in an environment suitable to its purpose. Production data will not be used on test equipment and test data will not be used on production equipment.

4.2.13Change Management

Changes to production systems are tracked, recorded, appropriately authorised and reviewed per vendor’s change management policy.

4.2.14Authorised Services

Authorized services must be documented with a business justification and be appropriately approved. All unnecessary services, protocols, and ports are disabled or deleted.

4.2.15Encryption

Vendor will encrypt all Socure Information at rest and when in transit in accordance with industry best practices. Vendor will prohibit the use of known weak ciphers (reference https://www.cisa.gov/news-events/alerts/2021/01/05/nsa-releases-guidance-eliminating-obsolete-tls-protocol). For encryption at rest, AES128, or greater, shall be used. For encryption at transit, TLS 1.2 or higher shall be used. Vendor must transition to TLS 1.3 or its successor, as soon as possible and no later than December 2, 2029 to support the shift to Post-Quantum Cryptography (PQC). By December 2, 2034, all systems must transition to PQC as legacy algorithms will be disallowed. Upon Socure’s written request, the Vendor will confirm that all copies of encryption keys have been securely deleted.

4.2.16Access controls

Vendor will implement the following access controls with respect to Socure Information:

4.2.17“In bulk” access

Except where expressly authorized by Socure in writing, Vendor will not access, and will not permit access to, Socure Information “in bulk” whether the Socure Information is in a Socure or Vendor-controlled database or stored in any other method, including storage in file-based archives (e.g., flat files).

4.2.18Account and password management

Vendor will implement account and password management policies to protect Socure Information, including, but not limited to:

4.2.18.1Single sign-on (SSO) and user management

If Vendor provides software for Socure’s use, either as a service or as a packaged software, the software must at a minimum provide the following controls:

4.2.19Multi-factor authentication (MFA)

Vendor will implement phishing-resistant multi-factor authentication (i.e., requiring at least two factors to authenticate a user and ideally use FIDO2.X as one of the factors) for access to (i) any network, system, application, or other asset containing Socure Information; or (ii) Vendor’s corporate or development networks.

4.2.20Data segregation

Except where expressly authorized by Socure in writing, Vendor will logically or physically isolate Socure Information at all times from Vendor’s and any third-party information.

4.2.21Security testing

Vendor will conduct internal and external penetration testing of systems that process Socure Information at least annually to identify vulnerabilities and attack vectors that can be used to exploit those systems. Identified vulnerabilities shall be addressed as part of Vendor’s vulnerability management program. Vendor will make available to Socure, upon request the results of such penetration tests and vulnerability remediation actions. Upon Socure request, Vendor will make available any internet-facing systems that store or process Socure information to a penetration test by Socure or its representative.

4.2.22Personnel security and nondisclosure

All Vendor Personnel with access to Socure information must sign an individual NDA with Vendor and successfully complete a background check by Vendor. In addition, Socure may require its own Non-Disclosure Agreement (NDA) to be signed by Vendor and/or individual Vendor Personnel. At a minimum:

4.2.23Restricted Individuals and Entities (“Covered Persons”)

Vendor will prohibit access to Socure information and systems by Vendor Personnel, Subcontractors, or any other third party that are: (I) listed on the Specially Designated Nationals and Blocked Persons List of the U.S. Department of Treasury (SDN List) or any other U.S. government restricted party list; (II) currently residing in a country subject to sanctions by the Office of Foreign Assets Control (OFAC); or (III) an entity 50% or more owned, directly or indirectly, by a person, entity, or government from a “Country of Concern” as defined in Section 4.2.24; or (IV) an employee or contractor of an entity or government of a “Country of Concern as defined in Section 4.2.24, regardless of where the individual resides, without Socure’s explicit prior written consent.

4.2.24Section 889 Compliance (“Covered Telecommunications Equipment or Services”)

Vendor will not provide to Socure, and will ensure no Subcontractor provides, any equipment, system, or service that constitutes or uses “covered telecommunications equipment or services” as defined under Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) and its implementing regulations (FAR 52.204-25), whether as a substantial/essential component or as critical technology of any system. Vendor represents that neither it nor any Subcontractor uses such prohibited equipment or services in connection with this Agreement, and will notify Socure promptly in writing if it discovers otherwise.

4.2.25Restricted Countries of Concern

Vendor will prohibit access to Socure information and systems by Vendor Personnel that currently resides in or accesses such information or systems from: (a) the People’s Republic of China (including provinces of Hong Kong and the special administrative region of Macau), (b) Russia, (c) Ukraine, (d) North Korea, (e) Iran, (f) Cuba, and (g) Venezuela unless otherwise specifically approved in writing by Socure. This restriction applies regardless of the Personnel’s nationality. Vendor must ensure that no vendor, subcontractor, or investor involved in performing services under the Agreement is located in, or majority-owned by an entity from, these locations without Socure’s explicit prior written consent.

4.3PCI DSS requirements

If, in the course of its engagement by Socure, Vendor has access to or will Process credit, debit, or other payment cardholder information, Vendor shall at all times remain in compliance with the Payment Card Industry Data Security Standard (PCI DSS) requirements (in addition to the minimum requirements in Section 4.2), and shall remain aware at all times of changes to the PCI DSS and promptly implement all procedures and practices necessary to remain in compliance with the PCI DSS.

4.4Subcontracts

Except as expressly set forth in the Agreement, Vendor will not subcontract or delegate any of its obligations under this Security Policy to any subcontractors, affiliates, or delegates (“Subcontractors”) without Socure’s prior written consent. Vendor will ensure that all requirements in this agreement are followed by any subcontractor, subprocessor or affiliate.

4.5Access to Socure Extranet and Vendor portals

Socure may grant Vendor Personnel access to Socure Information via web portals or other non-public websites or extranet services on Socure’s or a third party’s website or system (each, an “Extranet”) for the Permitted Purposes. If Socure permits Vendor to access any Socure Information using an Extranet, Vendor must comply with the following requirements:

4.5.1Permitted Purpose

Vendor and its Personnel will access Socure information or systems and access, collect, use, view, retrieve, download or store Socure Information solely for the Permitted Purpose.

4.5.2Accounts

Vendor will ensure that Vendor Personnel use only the Extranet account(s) designated for each individual by Socure and will require Vendor Personnel to keep their access credentials confidential. Accounts are not to be shared and must use secure multi-factor authentication (MFA).

4.5.3Systems

Vendor will access Socure information or systems only through either systems provided by Socure or in cases explicitly approved by Socure, computing or processing systems or applications running operating systems managed by Vendor and that include: (i) system network firewalls in accordance with Section 4.10.9 (firewalls); (ii) centralized patch management in compliance with Section 4.2.6 (vulnerability and patch management); (iii) operating system appropriate endpoint detection and response and anti-malware software in accordance with Section 4.2.9 (malware defenses); and (iv) for mobile and portable devices, full disk encryption and mobile device management (MDM) that ensures the device is running a version of the mobile operating system with no known vulnerabilities.

4.5.4Restrictions

Except if approved in advance in writing by Socure, Vendor will not download, mirror or permanently store any Socure Information from any Extranet on any medium, including any machines, devices or servers.

4.5.5Account Termination

Vendor will terminate the account of each Vendor Personnel and notify Socure no later than 24 hours after any specific Vendor Personnel who has been authorized to access any Extranet (a) no longer needs access to Socure Information or (b) no longer qualifies as Vendor Personnel (e.g., the personnel leaves Vendor’s employment).

4.6Socure Sub-Domains or URL’s

Any sub-domain or URL that the Vendor provisions for Socure’s sole use during the contracted period must not be issued or re-used by a non-Socure customer for 5 years after Socure terminates use of the service.

5.1Retention

Vendor will retain Socure Information for a duration of time that is only as necessary for the Permitted Purposes.

5.2Return and secure deletion of Socure Information

At any time during the term of the Agreement at Socure’s request, or upon the termination or expiration of the Agreement for any reason, Vendor shall, within 5 business days (or 30 calendar days for data in backup or online storage), return to Socure and securely delete all copies of Socure Information in its possession or control. Vendor shall confirm in writing that all copies of Socure Information have been returned and securely deleted.

5.3Archival copies

If Vendor is required by law to retain archival copies of Socure Information for tax or similar regulatory purposes, Vendor shall (i) not use the archived information for any other purpose; and (ii) remain bound by its obligations under this agreement, including, but not limited to, its obligations to protect the information using appropriate safeguards and to notify Socure of any Security Incident involving the information.

5.4Deletion standard

All Socure Information deleted by Vendor will be securely deleted using an industry-accepted practice designed to prevent data from being recovered using standard disk and file recovery utilities (e.g., secure overwriting, degaussing of magnetic media in an electromagnetic flux field of 5000+ GER, shredding, or mechanical disintegration). With respect to Socure Information encrypted in compliance with this Security Policy, Vendor may delete data by permanently and securely deleting all copies of the encryption keys. For physical documents containing Socure Information, disposal must be conducted using industry-accepted practice (e.g., cross-cut shredding, pulping, or incineration by certified secure destruction vendors).

5.5Media destruction

Before permanently discarding or disposing of storage media that (1) Vendor has physical access to or control of (e.g., laptop hard drives, desktop hard drives, USB or “thumb” drives, backup media, hard drives used in the Vendor’s own data center, or other portable storage media) and (2) contains, or has at any time contained, Socure Confidential Information, Vendor will destroy the storage media using a technique designed to render the media unusable and the data unrecoverable (e.g., disintegration, incineration, pulverizing, shredding, and melting). This section shall not apply to storage media that Vendor does not have physical access to or control of, such as storage media used in a public cloud or other third-party environment. In such cases, Vendor shall ensure that all Socure Confidential Information stored in the third-party environment is securely deleted when no longer needed using an industry-accepted practice (see Section 5.4, Deletion standard).

6.1Vendor assessment questionnaires

Upon Socure’s request, Vendor will complete a new Socure risk assessment questionnaire.

6.2Compliance with agreement

Upon Socure’s request, Vendor will confirm in writing to Socure Vendor’s compliance with this Agreement.

6.3Other reviews; audits

Upon Socure’s written request, to confirm Vendor’s compliance with this Agreement, Vendor grants Socure or, at Socure’s election, a third party on Socure’s behalf, permission to perform an assessment, audit, examination, or review of the Physical, Organisational, Personnel, and TechnologicalSafeguards in place to protect Socure Information Processed by Vendor under the Agreement. Vendor shall fully cooperate with the assessment. Such requests by Socure are limited to no more than once annually.

6.4Remediation

Vendor will promptly address any exceptions or deficiencies identified during Socure’s security review or in any audit report, by developing and implementing a corrective action plan agreed to by Vendor and Socure, at Vendor’s sole expense.

6.5Cloud and Web application

If Vendor services under the agreement include a web application, cloud service or API, Vendor will (I) maintain an annual SSAE 18 SOC 2 type 2 report and will make such report available to Socure upon request; (II) enter into a mutually agreed upon data processing agreement and maintain a privacy policy that complies with applicable law; (III) maintain a denial of service recovery plan to ensure continuous availability of the service and (IV) enable Socure or third party on Socure behalf to perform penetration testing of vendor internet facing services upon written notification from Socure and no more than once annually; and (V) maintain a disaster recovery and resiliency plan that ensures recovery of Socure data as soon as possible and no later than 72 hours.

7.1Security Incident defined

A “Security Incident” is (i) any actual or suspected compromise of the Confidentiality, Integrity, or Availability of Socure Information; (ii) any actual or suspected compromise of, or unauthorized access to, any system that Processes Socure Information that presents a risk to the Confidentiality, Availability, or Integrity of Socure Information; or (iii) receipt of a complaint, report, or other information regarding the potential compromise or exposure of Socure Information Processed by Vendor.

7.2Incident response plan

Vendor shall maintain a written incident response plan and provide a copy of the plan to Socure upon request. Vendor will remedy each Security Incident in a timely manner following its response plan and industry best practices.

7.3Notice required

Vendor will notify Socure of any Security Incident within 48 hours of becoming aware of the Security Incident by emailing security@socure.com and providing incident detail, impact and a dedicated point of contact within Vendor that will engage with the Socure security team until the incident is remediated and information requested by Socure security is made available.

7.4Cooperation with Socure’s investigation

Vendor will reasonably cooperate with Socure in Socure’s handling of a Security Incident, including, without limitation: (i) coordinating with Socure on Vendor’s response plan; (ii) assisting with Socure’s investigation of the Security Incident; (iii) facilitating interviews with Vendor Personnel and others involved in the Security Incident or response; and (iv) making available all relevant records, logs, files, data reporting, forensic reports, investigation reports, and other materials required for Socure to comply with applicable laws, regulations, or industry standards, or as otherwise required by Socure.

7.5Third-party notifications

Vendor agrees that it shall not notify any third party (including any regulatory authority or customer) of any Security Incident that explicitly mentions Socure or its customers without first obtaining Socure’s prior written consent. Further, Vendor agrees that Socure shall have the sole right to determine: (i) whether notice of the Security Incident is to be provided to any individuals, regulators, law enforcement agencies, or others; and (ii) the form and contents of such notice.

10.1AI Training

Vendor shall not use Socure Information to train any artificial intelligence or machine learning engine or system, neural network, or similar system except as expressly permitted by Socure in writing. Such written consent may be withheld by Socure in its sole discretion.

10.2AI Feature Opt-In

If Vendor’s Services contain any artificial intelligence features or functionality (“AI Feature”), the Services must permit Socure admin users to disable such AI Feature for all Socure users of the Vendor’s Services. Any new AI Feature made available to Socure must require specific opt-in by an admin user (designated by Socure) before use.

10.3AI Feature Change Logging

Vendor agrees that any AI Feature changes (including enabling or disabling of an AI Feature) must be included as an “event” in Vendor’s audit logs as required by Section 4.2.7 of this Security Policy.

10.4AI Policy

Vendor must maintain an AI policy compliant with applicable legislation within the jurisdictions in which it operates. A copy of Vendor AI policy will be made available for review by Socure on request.

10.5AI Training and Awareness

Vendor must train their employees on their AI and Machine Learning policy.

10.6AI Indemnification Vendor shall indemnify, defend and hold Socure harmless from and against all intellectual property or loyalties lawsuits, claims, liabilities, damages, settlements, or judgments, including Socure’s costs and attorney fees, which arise as a result of any output generated by vendor AI or machine learning functionality.

10.7Chinese-Developed AI

Vendor shall not use or include Chinese-developed AI systems in the software or services provided to Socure without Socure’s prior written approval.