Appendix 5 – Information security and sub-processors

1. Security principles

• Least privilege and need-based access.
• Separation of customer data through logical multi-tenant controls and a permission model.
• Encrypted transport for web, API and other supported interfaces.
• Encryption of stored data where appropriate given the risk and data type.
• Logging of relevant administrative and security-related events.
• Vulnerability and patch management for components controlled by the Supplier.
• Backup and restore capability for relevant production data.
• An incident handling process and restricted access to the production environment.

2. Identity and access

• Role-based access control (RBAC) for the Customer’s and the Supplier’s permissions.
• Separate administrative and customer-facing permission boundaries where the architecture supports it.
• Strong authentication for privileged access.
• Regular review of privileged permissions.

3. Encryption and keys

• TLS is used for web communication and APIs where the protocol supports it.
• Storage services are configured with encryption at rest where appropriate.
• Keys and secrets are managed in a dedicated service or a secure secrets system.
• Original RUF reports are stored encrypted and released only as an encrypted archive file under Appendix 1, section 5.

4. Logging and monitoring

• Application and infrastructure logs are used for operations, security, troubleshooting and traceability.
• Alerting and monitoring are used for relevant error, security and capacity events.
• Logs are protected against unauthorised access and have a defined retention period under Appendix 1, section 7.

5. Vulnerabilities and secure development

• Code review and automated tests are used in the development process to an appropriate extent.
• Dependencies and known vulnerabilities are tracked with automated or manual tools.
• Development, test and production environments are separated from each other.
• Production data is not used in development or test environments.
• Changes to production go through a controlled release process.
• Critical or time-sensitive security updates may be deployed to production without prior notice when the Supplier considers this reasonably necessary to limit a vulnerability, security risk or ongoing incident.

6. Backup, continuity and recovery

Backup and restore procedures are adapted to the Service’s data types. Recovery time and recovery point objectives (RTO and RPO) are not guaranteed unless expressly stated in the Order or Appendix 3.

7. RUF-specific controls

• Short retention of original reports compared with aggregate report data.
• Restricted access to RUF content.
• Pseudonymisation with keyed HMAC-SHA256 before storage for regular analysis.
• Encryption of stored original reports.
• The Customer can choose not to use, or can disable, RUF functionality.

8. Sub-processors

A company is listed as a sub-processor only if it processes personal data on the Customer’s behalf.

9. Process for new sub-processors

1. The Supplier carries out a data protection and security assessment of the planned sub-processor before processing begins.
2. The Supplier enters into the processing, data protection and other agreements required for the sub-processor to be bound by relevant data protection and security requirements.
3. The Customer is informed at least thirty (30) days before a new or replacement sub-processor begins processing personal data on the Customer’s behalf. The information shall describe the identity of the sub-processor, the nature of the processing, the personal data that may be processed, where the processing takes place and, where applicable, the applicable mechanism for third-country transfers.
4. Within fifteen (15) days of receiving the information, the Customer may make a specific and reasoned objection relating to data protection, information security or applicable law. What constitutes a reasoned objection is set out in more detail in Appendix 4, section 9.
5. In the event of a reasoned objection, the Parties shall promptly try to find a reasonable solution. The Supplier may, for example, where practically and commercially reasonable, refrain from using the sub-processor concerned for the Customer’s processing or offer an alternative technical or organisational solution.
6. While a reasoned objection is being handled, the new or replacement sub-processor shall not begin the processing of the Customer’s personal data covered by the objection, unless the Parties agree otherwise in writing.
7. If the Parties cannot find a reasonable solution and the Supplier cannot reasonably provide the affected part of the Service without the sub-processor concerned, the Customer is entitled to terminate the part of the Service affected by the change. If the affected part cannot reasonably be separated from the rest of the Service, the Customer is entitled to terminate the Agreement in its entirety.
8. Such termination shall not entail any additional termination fee or other special cost for the Customer. If the Customer has paid subscription fees in advance, the Supplier shall refund the proportionate part of the prepaid fee that relates to the period after the termination takes effect. No further compensation or remuneration is payable solely on account of such termination.

10. Contact details