Security Attachment

This Security Attachment supplements and is incorporated into the Product Terms between Customer and Factory (the “Agreement”). Capitalized terms used but not defined in this Security Attachment will have the meanings set forth in the Product Terms.

Factory has implemented and will maintain technical and organizational measures in accordance with industry standard practices, as set out below, designed to protect the security of Customer Data and Factory Technology (including Factory Platform). Additional information about Factory’s security program can be found at https://trust.factory.ai.

Security Program and Policies.

Factory maintains a security program that aligns with industry standard practices that align with industry best practices such as ISO/IEC 27001, SOC 2, ISO 27017 (Cloud Computing), NIST Cybersecurity Framework (CSF), Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM), Cyber Essentials or equivalents.

Factory maintains the following internal security policies covering: Information Security, HR Security, Employee Background Checks, Data Management, Risk Management, Access Control, Secure Development, Physical Security, Incident Response, Business Continuity and Disaster Recovery, and Password Protection.

Factory maintains organizational management and staff responsible for the development, implementation, and maintenance of Factory’s security program that are overseen by senior management.

Factory maintains and documents a risk governance and management program designed to identify, analyze, evaluate, and prioritize, including to the confidentiality, integrity, availability, and resilience of its processing systems and services.

Factory conducts periodic risk assessments designed to analyze existing information security risks, identify new risks, and evaluate the effectiveness of existing security controls.

Factory maintains an up-to-date inventory of hardware, software, data, and network assets used to provide the Factory Technology.

Factory’s operational procedures and controls define safeguards that provide for the configuration, monitoring and maintenance of technology and information systems that process Customer Data according to prescribed internal and adopted industry standards.

Factory’s change management procedures and tracking mechanisms are designed to test, approve, and monitor material changes to Factory’s technology and information assets that process Customer Data.

Factory’s business continuity and disaster recovery plan and procedures are tested annually and designed to maintain service availability and enable recovery from emergency situations or disasters.

Factory’s network security controls provide for network traffic filtering, segmentation of networks, and other event correlation procedures designed to protect systems from intrusion and limit the scope of any potential security compromise.

Access Controls.

Factory restricts access to Customer Data to Factory employees, contractors, and authorized personnel who have a legitimate need to access such data to perform their obligations under this Agreement using role-based access controls.

Factory personnel are assigned unique identifiers for interacting with systems with access to Customer Data.

Default system credentials are changed by Factory prior to a system’s use in a production capacity.

Factory systems processing Customer Data are protected by Multi Factor Authentication (MFA).

Factory maintains strong password requirements including password length minimums and prevention of password re-use.

Factory prohibits the sharing or transmission of passwords through unsecured communication channels.

Factory reviews privileged access to systems with access to Customer Data on a regular basis.

Factory personnel’s access to Customer Data are promptly revoked following termination of employment.

Personnel Management.

All personnel engaged by Factory are obligated to comply with the requirements of Factory's security program, including with respect to the confidentiality and security of the Customer Data.

Factory employees receive annual security awareness training. These trainings provide information regarding relevant threats and business requirements, including social-engineering attacks, sensitive data handling, and security incident response.

Factory personnel undergo background checks and are subject to confidentiality obligations.

Factory removes personnel access authorization without undue delay and in accordance with standard industry practice upon termination of the personnel.

Audits and Certifications.

Factory’s security program is assessed annually by independent third-party auditors against industry standards such as SOC 2 Type II, ISO 27001, and ISO 42001.

Factory’s latest audit reports and certifications are available at https://trust.factory.ai.

Encryption Standards.

Factory utilizes industry standard encryption methods for protection of Customer Data at rest and in transit. Data at rest is encrypted using strong encryption algorithms. Factory also uses secure system configurations and access controls to restrict and monitor access to stored data.

Endpoint Protection.

Factory personnel workstations, and cloud endpoints (where applicable), that have access to Customer Data are protected via endpoint detection and response systems that include anti-virus and anti-malware protections, real-time system monitoring, and alerting and escalation to internal security teams.

Vulnerability Management.

Factory’s vulnerability assessment, patch management, threat protection technologies, and scheduled monitoring procedures are designed to identify, assess, mitigate, and protect against identified security threats, viruses, and other malicious code. Factory utilizes a multi-faceted approach to vulnerability management, including: automated code vulnerability scanning; automated artifact vulnerability scanning; automated code review; manual peer code review; endpoint detection and response; automated log analysis; and manual log analysis.

Factory engages qualified external assessors to conduct annual penetration testing of systems that process Customer Data that are designed to identify vulnerabilities and attack vectors that can be used to exploit those systems. Identified vulnerabilities are addressed in accordance with Factory’s vulnerability management program.

Factory applies updates designed to mitigate vulnerabilities based on risk level and in alignment with industry-accepted timelines.

Data Management.

Customer Data stored by Factory is logically separated from data of other customers. Factory also maintains network-level segmentation to separate environments processing Customer Data from the internet and from development and testing environments.

Logging, Monitoring, and Incident Response.

Factory’s incident management procedures are designed to allow Factory to identify, investigate, respond to, and mitigate security incidents related to Factory’s technology and information assets that process Customer Data. These incident response procedures are tested annually.

Factory logs employee access and actions within Factory’s systems, inclusive of those storing or maintaining Customer Data.

Factory’s system audit or event logging procedures are designed to detect, prioritize, and escalate, as appropriate, suspicious activities for review.

Factory’s security-related logs are retained for appropriate timeframes to aid in the investigation of security incidents.

Third Party Vendors.

Factory maintains a third-party information security risk management program to evaluate the security posture of Factory’s third-party vendors.

Data Breach.

Upon becoming aware of Data Breach (as defined in the Agreement), Factory shall, without undue delay, inform Customer of the Data Breach and take such steps as Factory in its sole discretion deems necessary and reasonable to remediate the Data Breach (to the extent that remediation is within Factory’s reasonable control). Factory’s obligation to remediate or provide notice in connection with a Data Breach will not be construed as an acknowledgement by Factory of any fault or liability with respect to the Data Breach.