Data Processing and Safeguards Addendum
For customers whose data is governed by the GLBA / FTC Safeguards Rule, professional-conduct rules, securities recordkeeping rules or state privacy law, rather than HIPAA. Signed electronically at signup. Draft for attorney review
This Addendum is part of the Terms of Service between PacinfraX Corporation (“Provider”) and Customer and governs Provider’s processing of Customer Data that includes nonpublic personal information, client confidential information, or records subject to recordkeeping rules (“Protected Data”). Where the Business Associate Agreement applies to particular data, it governs that data instead.
1. Roles and instructions
Customer determines the purposes and means of processing; Provider processes Protected Data only to provide the Service and on Customer’s documented instructions, which include the Terms, the console configuration, and this Addendum. Provider will inform Customer if it believes an instruction violates law.
2. Safeguards (FTC Safeguards Rule, 16 CFR 314.4(f))
Provider maintains a written information security program with the following safeguards, which Customer may rely on for its own program:
- A designated individual responsible for the program (Provider’s Security Officer).
- A written risk assessment reviewed at least annually and on material change.
- Access controls: named accounts, least privilege, multi-factor authentication for all users and personnel, time-limited privileged access, logging of access to Protected Data.
- Encryption of Protected Data in transit (TLS 1.2 or higher, enforced; encrypted delivery where the recipient cannot negotiate TLS) and at rest (AES-256; dedicated keys per customer on Hosted and Pro).
- Data inventory and classification; secure development practices; change management.
- Secure disposal: deletion within 30 days of termination and destruction of customer keys, with a certificate of destruction on request.
- Continuous monitoring, vulnerability scanning at least every six months, and independent penetration testing at least annually.
- Workforce training on information security at hire and annually; background checks for personnel with access to Protected Data.
- Oversight of service providers (Section 5).
- A written incident response plan tested at least annually.
3. Confidentiality and professional rules
Provider will treat Protected Data as Customer’s confidential information, will not use or disclose it except to provide the Service or as required by law, and acknowledges that for law-firm customers Protected Data may be subject to attorney-client privilege and work-product protection, which Provider will not waive and will help Customer preserve. For investment-adviser customers, Provider will maintain records in a manner that supports Customer’s obligations under Advisers Act Rule 204-2, including retention, indexing, prompt production and a separate copy.
4. Security incidents
Provider will notify Customer without undue delay and no later than 72 hours after determining that a security incident has resulted in unauthorized access to Protected Data, will provide the information reasonably available (nature of the incident, data and individuals affected, measures taken), will cooperate with Customer’s notifications to regulators and individuals (including the FTC notification requirement for events affecting 500 or more consumers, where applicable), and will not notify Customer’s clients directly unless required by law or requested by Customer.
5. Subprocessors
Provider uses the subprocessors listed at pxcmail.com/trust/subprocessors under written agreements imposing obligations no less protective than this Addendum, and remains responsible for their performance. Provider will give at least 30 days’ notice before adding a subprocessor that processes Protected Data; Customer may object on reasonable grounds, and if the objection cannot be resolved Customer may terminate the affected subscription with a prorated refund.
6. Personnel and location
Protected Data is stored and processed in the United States. Message content is accessible only to Provider personnel located in the United States; personnel elsewhere may access configuration and metadata only. All personnel with access are bound by confidentiality obligations.
7. Assistance and audits
Provider will assist Customer, at no additional charge for reasonable requests, with responses to individuals exercising privacy rights, with regulatory inquiries and examinations (including producing records in the formats commonly requested by the SEC, state securities regulators, the FTC, state bars and insurers), and with Customer’s own risk assessments. Provider will make available its most recent penetration-test summary, SOC 2 report when issued, and completed security questionnaires, and will permit an audit by Customer or an independent auditor once per year on 30 days’ notice, during business hours, subject to confidentiality.
8. Retention, return and destruction
Provider retains Protected Data as configured by Customer and for the period required by Customer’s recordkeeping rules where Customer has enabled the corresponding archive plan. On termination, Protected Data is available for export for 30 days, then deleted and keys destroyed, except data under a legal hold, which is retained until Customer releases it. Provider provides a certificate of destruction on request.
9. State privacy laws
To the extent state consumer privacy laws apply, Provider acts as a service provider or processor; will not sell or share Protected Data, retain, use or disclose it outside the direct business relationship or for any purpose other than the Service, or combine it with data from other sources; will comply with applicable obligations and provide the same level of privacy protection the law requires; will notify Customer if it can no longer meet its obligations; and grants Customer the right to take reasonable steps to stop and remediate unauthorized use.
10. Annual confirmation
Provider will deliver to Customer, at least annually, a written confirmation of the safeguards in place and any material changes, suitable for inclusion in Customer’s written information security program.
11. Term and precedence
This Addendum lasts as long as Provider processes Protected Data and prevails over the Terms with respect to that data.