DPA Annex B — Security Measures

Parties: To be confirmed: legal entity name and To be confirmed: customer legal name. This is a proposed security exhibit, not a certification. When executed, only controls verified under the process below may be described as in operation.

1. Agreed security controls

The control schedule remains under review. Authentication/MFA, tenant and project authorization, file protection, encryption, audit logging, backups, recovery, vulnerability management and personnel access must be specified in To be confirmed: approved security control schedule before this annex is executed. This draft does not certify any control or deployment.

2. Binding control principles (activate after verification)

2.1 SiteAxis will maintain reasonable risk-proportionate technical and organizational controls, including authenticated access, least-privilege tenant/project authorization, security event evaluation, controlled system changes, secure vendor handling and review of backups and access rights. Measures implemented with equivalent or stronger alternatives may evolve so long as protection is not materially degraded and required notice/consent is provided.

2.2 SiteAxis will restrict Customer Personal Data in support workflows to authorized personnel and necessary purposes. Technical troubleshooting is not broad permission to read, copy or send customer incident details through uncontrolled systems. Elevated access shall be logged to the extent of To be confirmed: support access evidence.

2.3 SiteAxis will maintain incident reporting and escalation contacts under To be confirmed: security email, with internal severity/notice policy To be confirmed: incident response runbook version and contractual timing only as completed in the DPA.

2.4 SiteAxis shall perform periodic risk reviews and proportionate security controls for Subprocessors. Provider-specific safeguards and storage/processing regions are set out in approved Annex C and underlying provider terms.

2.5 Customer is responsible for correct role assignment, legitimate cross-organization sharing, endpoint security and prompt access revocation for its users. SiteAxis's own backend enforcement and legal duties remain unaffected by this allocation.