Data Security Policy

1. Purpose

This Security Policy / Overview describes Scalefaster's security program and technical and organizational security controls to protect (a) Customer Data from unauthorized use, access, disclosure, or theft and (b) the Services. As security threats shift and evolve, Scalefaster continues to update its security program and strategy to help protect Customer Data and the Services. As such, Scalefaster reserves the right to update this Security Overview from time to time.

2. Security Organization and Program

Scalefaster maintains a risk-based assessment security program. The framework for Scalefaster's security program includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the Services and the confidentiality, integrity, and availability of Customer Data. Scalefaster's security program is intended to be appropriate to the nature of the Services and the size and complexity of Scalefaster's business operations.

3. Confidentiality

Scalefaster has controls in place to maintain the confidentiality of Customer Data. All Scalefaster's employees and contract personnel are bound by Scalefaster's internal policies regarding maintaining the confidentiality of Customer Data and are contractually obligated to comply with these obligations.

4. Encryption

Scalefaster encrypts Customer Data both in transit and at rest. Customer Data and Personal Data transmitted between the Customer, the Services, and Scalefaster's production systems is encrypted in transit using industry-standard Transport Layer Security (TLS). Customer Data is encrypted at rest using Advanced Encryption Standard (AES-256). Encryption keys are managed in accordance with industry best practices, and access to key management systems is restricted to authorized personnel on a least-privilege basis.

5. People Security

5.1 Employee Training

Scalefaster's employees/contractors must complete a security and privacy training which covers Scalefaster's security policies, security best practices, and privacy principles. Employees on a leave of absence may have additional time to complete this training.

The core principles of our training are:

• Employees/contractors shall not share any information with any third party, verbally or electronically, relating to Scalefaster work
• Employees/contractors shall not use any third-party application such as email, file sharing, or servers hosted outside of AWS, Google Workspace, Google Firebase, or Webflow to store any data, without explicit consent from their direct line manager
• Employees/contractors shall not store any information which is not wholly necessary in the duties of their job description, and within 7 days shall destroy any information which is no longer necessary to store
• Employees shall not make handwritten notes of sensitive information
• Employees shall password protect the computer systems on which they conduct any Scalefaster-related work, in relation to Scalefaster's password policy

6. Architecture and Data Segregation

6.1 Hosting

The platform for Scalefaster's Services is hosted by Amazon Web Services ("AWS") and Google Firebase.

The AWS data center infrastructure used in providing Scalefaster's services is located in the United States and United Kingdom. Additional information about security provided by AWS is available at aws.amazon.com/security and aws.amazon.com/whitepapers/overview-of-security-processes.

The Google Firebase infrastructure used in providing Scalefaster services is located in the United Kingdom and United States. Additional information about security provided by Google Firebase is available at firebase.google.com/support/privacy.

6.2 Services

For the delivery of Services, all network access between production hosts is restricted, using firewalls to allow only authorized services to interact in the production network. Firewalls are in use to manage network segregation between different security zones in the production and corporate environments. Firewall rules are reviewed regularly. Scalefaster's server architecture is designed and built to identify and allow access only to and from authorized customers. These controls prevent other customers from having access to Customer Data.

7. Physical Security

AWS data centers that host Scalefaster's Services are strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication (2FA) a minimum of two (2) times to access data center floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff.

These facilities are designed to withstand adverse weather and other reasonably predictable natural conditions. Each data center has redundant electrical power systems that are available twenty-four (24) hours a day, seven (7) days a week. Uninterruptible power supplies and on-site generators are available to provide back-up power in the event of an electrical failure.

In addition, Scalefaster's headquarters and office spaces have a physical security program that manages visitors, building entrances, and CCTVs (closed circuit televisions), and overall office security. All employees, contractors, and visitors are required to wear identification badges.

8. Vulnerability Detection & Management

Scalefaster follows security by design principles and maintains an ongoing vulnerability detection and management program to identify, assess, and remediate security vulnerabilities across the Services. These activities include, but are not limited to, the performance of (a) internal security reviews before new Services are deployed; (b) regular penetration tests performed on the Services by independent third parties, as well as penetration testing of new Services prior to deployment; (c) routine vulnerability scanning of production systems and supporting infrastructure; and (d) monitoring of relevant threat intelligence and security advisories to identify newly disclosed vulnerabilities affecting the technologies used in the Services.

Identified vulnerabilities are triaged and prioritized based on severity and potential impact, and are remediated within timeframes appropriate to the assessed risk. Scalefaster tracks remediation to closure and applies security patches and updates to its systems on a regular basis. Where a vulnerability is assessed as presenting a material risk to Customer Data or the Services, Scalefaster aims to act promptly to mitigate or remediate the issue.

9. Access Controls

9.1 Provisioning Access

To minimize the risk of data exposure, Scalefaster follows the principles of least privilege through a team-based-access-control model when provisioning system access. Scalefaster personnel are authorized to access Customer Data based on their job function, role, and responsibilities, and such access requires approval of the employee's manager. Access rights to production environments are reviewed at least semi-annually. An employee's access to Customer Data is promptly removed upon termination of their employment. Before an engineer is granted access to the production environment, access must be approved by management and the engineer is required to complete internal trainings for such access, including trainings on the relevant team's systems.

9.2 Password Controls

Scalefaster's current policy for employee password management follows the NIST 800-63B guidance, and as such, our policy is to use longer passwords, with multi-factor authentication, but not require special characters or frequent changes.

9.3 Multi-Factor Authentication

Access to Scalefaster's production environment and to systems containing Customer Data requires multi-factor authentication (MFA). MFA is enforced for all personnel accessing production systems, in addition to the access provisioning and password controls described above.

10. Logging and Monitoring

Scalefaster maintains logging and monitoring controls across its production environment to support the detection of, and response to, security events. Security-relevant events, including access to production systems and Customer Data, are logged. Logs are retained for a defined period and are protected against unauthorized access and tampering. Scalefaster monitors these logs and employs automated alerting to help identify anomalous or suspicious activity, enabling timely investigation and response to potential Security Incidents.

11. Discovery, Investigation, and Notification of a Security Incident

Scalefaster will promptly investigate a Security Incident upon discovery. To the extent permitted by applicable law, Scalefaster will notify Customer of a Security Incident in accordance with the Data Protection Act. Security Incident notifications will be provided to the Customer via email to the email address designated by Customer in its account.

12. Resilience and Service Continuity

The Services use a variety of tools and mechanisms to achieve high availability and resiliency. Scalefaster also leverages specialized tools that monitor server performance, data, and traffic load capacity within each availability zone and colocation data center. If suboptimal server performance or overloaded capacity is detected on a server within an availability zone or colocation data center, Scalefaster aims to act promptly on these issues.

13. Backups and Recovery

Scalefaster performs regular backups of Customer Data, which is hosted on AWS's data center infrastructure and Google Firebase. Customer Data that is backed up is retained redundantly across multiple availability zones and encrypted in transit and at rest using Advanced Encryption Standard (AES-256). Backups are retained for a period of 60 days, after which they are securely and permanently deleted in the ordinary course.