Snapshot 123403
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DATA PROCESSING ADDENDUM (v2.71)
This Data Processing Addendum (“DPA”) is incorporated into the Master Customer Agreement, or other similar master agreement relating to
certain Services with Bugcrowd Inc. (the “Agreement” with “Bugcrowd”), to reflect the parties’ agreement about Processing of Personal
Data, when applicable, in accordance with the requirements of Data Protection Laws and Regulations. References to the Agreement will be
construed as including without limitation this DPA.
dedicated Bugcrowd affiliates independently managing the
1. Definitions. “Data Protection Laws and Regulations” provision of such Services.
means: (a) the regulations of the European Union, the European
c. Cross-Border Transfers of Personal Data.
Economic Area and their member states, Switzerland and the
Customer authorizes Bugcrowd and its sub-processors to transfer
United Kingdom, applicable to the Processing of Personal Data
Personal Data across international borders, including from the
under the Agreement, including the General Data Protection
European Economic Area, Switzerland, and/or the United
Regulation (Regulation (EU) 2016/679) (“GDPR”) and (b) the
Kingdom to the United States.
California Consumer Privacy Act of 2018 (“CCPA”) and the
California Privacy Rights Act of 2020 (“CPRA” together with the d. EEA, Swiss, and UK Standard Contractual
CCPA, the “California Privacy Laws”); “Personal Data” means any Clauses. If Personal Data originating in the European Economic
information relating to an identified or identifiable natural Area, Switzerland, and/or the United Kingdom is transferred by
person that is governed by the Data Protection Laws; “Data Customer to Bugcrowd in a country that has not been found to
Subject” means an identified or identifiable natural person to provide an adequate level of protection under applicable Data
whom the Personal Data relates; “Controller” means the entity Protection Laws and Regulations, the parties agree that the
that determines the purpose and means of the Processing of transfer shall be governed by Module Two of the European
Personal Data; “Processor” means the entity that processes Union’s Standard Contractual Clauses (the “Standard Contractual
Personal Data on behalf of the Controller and “Process” or Clauses”) as supplemented by Exhibit A attached hereto, the
“Processing” means any operation or set of operations which is terms of which are incorporated herein by reference. Each
performed on Personal Data or sets of Personal Data, whether or party’s signature to this DPA shall be considered a signature to
not by automatic means, such as collection, recording, the Standard Contractual Clauses to the extent that the Standard
organization, structuring, storage, adaptation or alteration, Contractual Clauses apply hereunder.
retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or e. Customer’s Right to Issue Instructions.
combination, restriction, erasure or destruction. Any capitalized Bugcrowd shall only Process Personal Data in accordance with
terms not defined herein shall have the respective meanings Customer’s instructions. Subject to the terms of this DPA and
given to them in the Agreement. with mutual agreement of the parties, Customer may issue
written instructions concerning the type, extent and procedure
of Processing. Customer is responsible for ensuring that all
2. Processing of Personal Data.
individuals who provide written instructions to Bugcrowd are
a. Roles of the Parties. Bugcrowd provides authorized by Customer to issue instructions to Bugcrowd.
Customer with access to Bugcrowd’s proprietary, web-based, Customer’s initial instructions for the Processing of Personal Data
vulnerability reporting and disclosure software-as-a-service are defined by the Agreement, Exhibit B to this DPA, and any
platform (the “Platform”) under the Agreement. In connection applicable order form or Statement of Work regarding the
with the Platform, the parties anticipate that Bugcrowd may software and Services. Any changes of the subject matter of
process Personal Data relating to Data Subjects in the European Processing and of procedures shall be agreed upon by the parties
Economic Area, Switzerland and elsewhere. The parties agree in writing prior to becoming effective.
that Customer is the Controller solely responsible for
f. Details of Processing. The initial nature and
determining the purposes and means of the processing of
purpose of the Processing, duration of the Processing, categories
Personal Data, and Bugcrowd is Customer’s processor
of Data Subjects, and types of Personal Data are set forth on
responsible for Processing certain Personal Data on behalf of the
Exhibit B.
Controller. Bugcrowd shall only Process Personal Data only to the
extent necessary pursuant to Customer’s instructions and as set g. No Sale Of Personal Data. Bugcrowd shall not
forth in the Agreement. Bugcrowd may engage sub-processors sell any Customer Personal Data as the term “sell” is defined by
to Process Personal Data pursuant to the requirements set forth the applicable California Privacy Laws. Bugcrowd shall not
in Section 2e “Sub-Processors” below. Customer expressly disclose or transfer any Customer Personal Data to a third party
acknowledges and agrees that the Security Researchers, as or other parties that would constitute “selling” as the term is
defined in the Agreement, are not sub-processors of Bugcrowd defined by the applicable California Privacy Laws.
and are not bound by the terms of this DPA.
h. Bugcrowd Sub-Processors. Customer agrees
b. Customer’s Processing of Personal Data. that Bugcrowd may engage sub-processors to Process Personal
Customer is solely responsible for its compliance with the Data Data in accordance with the DPA. The list of Bugcrowd’s
Protection Laws and Regulations, including without limitation the sub-processors is available at Exhibit A. When engaging
lawfulness of any transfer of Personal Data to Bugcrowd and sub-processors, Bugcrowd shall enter into agreements with the
Bugcrowd’s Processing of Personal Data. For the avoidance of sub-processors to bind them to obligations which are
doubt, but not by way of limitation, Customer’s instructions for substantially similar or more stringent than those set out in this
the Processing of Personal Data must comply with Data DPA. Customer will not directly communicate with Bugcrowd’s
Protection Laws and Regulations. Customer shall have sole sub-processors about the software or Services, unless agreed to
responsibility for the accuracy, quality, and legality of Personal by Bugcrowd in Bugcrowd’s sole discretion. Bugcrowd will notify
Data and the means by which Customer acquired Personal Data, Customer in advance of any changes to sub-processors using
including providing any required notices to, and obtaining any regular communication means such as email, websites, and
necessary consent from Data Subjects. Customer takes full portals. If Customer reasonably objects to the addition of a new
responsibility to keep the amount of Personal Data provided to sub-processors (e.g., such change causes Customer to be
Bugcrowd to the minimum necessary for the performance of the non-compliant with applicable with Data Protection Laws and
Services. Customer shall be solely responsible for establishing Regulations), Customer shall notify Bugcrowd in writing of its
and maintaining any data processing registers or overview as specific objections within thirty (30) days of receiving such
required by any applicable law, including without limitation the notification. If Customer does not object within such period, the
Data Protection Laws and Regulations. Customer acknowledges addition of the new sub-processor and, if applicable, the
and consents that certain business operations necessary for the accession to this DPA shall be considered accepted. If Customer
fulfilment of Bugcrowd’s services hereunder may have been does object to the addition of a new sub-processor and
transferred or will be transferred in the future to one or more Bugcrowd cannot accommodate Customer’s objection, Customer
may terminate the Services and software in writing within sixty disclosure of, or access to personal data transmitted, stored or
(60) days of receiving Bugcrowd’s notification. otherwise processed. In furtherance of the obligations described
under this Section 6, Bugcrowd will take the security measures
i. Return or Deletion of Customer Personal
set forth in Exhibit C of this DPA.
Data. Unless otherwise required by applicable Data Protection
Laws and Regulations, Bugcrowd will destroy or return to
7. Audit.
Customer the Customer Personal Data upon termination or
expiration of the Agreement within a reasonable period. a. Audit Requests. Subject to Section 7(c), upon
Bugcrowd shall have no obligation to return Customer Personal Customer’s written request, Bugcrowd will provide Customer
Data to Customer if the Customer Personal Data is available to with the most recent summary audit report(s) concerning the
Customer. compliance and undertakings in this Agreement. Bugcrowd's
policy is to share methodology, and executive summary
3. Representations and Warranties. Customer information, not raw data or private information. Bugcrowd will
represents, warrants, and covenants that (a) the Personal Data reasonably cooperate with Customer by providing available
has been collected and transferred to Bugcrowd in accordance additional information to help Customer better understand such
with the Data Protection Laws and Regulations; (b) prior to its compliance and undertakings. To the extent it is not possible to
transfer to Bugcrowd, the Personal Data has been maintained, otherwise satisfy an audit obligation mandated by applicable
retained, secured and protected in accordance with the Data Data Protection Laws and Regulations and subject to Section 7(c),
Protection Laws and Regulations; (c) Customer will respond to only the legally mandated entity (such as a governmental
inquiries from Data Subjects and from applicable regulatory regulatory agency having oversight of Customer’s operations)
authorities concerning the Processing of the Personal Data, and may conduct an onsite visit of the facilities used to provide the
will alert Bugcrowd of any inquiries from Data Subjects or from Services. Unless mandated by Data Protection Laws and
applicable regulatory authorities that relate to Bugcrowd’s Regulations, no audits are allowed within a data center for
Processing of the Personal Data; (d) prior to the collection of security and compliance reasons. After conducting an audit
Personal Data, the Customer has obtained all necessary consents under this Section 7 or after receiving an Bugcrowd report under
from a Data Subject for Bugcrowd’s Processing of Personal Data this Section 7, Customer must notify Bugcrowd of the specific
in accordance with this DPA, including Processing of Personal manner, if any, in which Bugcrowd does not comply with any of
Data; (e) Customer will make available a copy of this Agreement the security, confidentiality, or data protection obligations in this
to any Data Subject or regulatory authorities as required by the DPA, if applicable. Any such information will be deemed
Data Protection Laws and Regulations or upon the reasonable Confidential Information of Bugcrowd.
request of a Data Subject or a regulatory authority; (f) Customer
shall be solely responsible and liable for its compliance with the b. Sub-Processors. Customer may not audit
Data Protection Laws and Regulations; and (g) Customer will only Bugcrowd’s sub-processors without Bugcrowd’s and Bugcrowd’s
transfer and provide Bugcrowd with such Personal Data required sub-processor’s prior agreement. Customer agrees its requests
and requested by Bugcrowd in writing to perform the Services. to audit sub-processors may be satisfied by Bugcrowd or
Bugcrowd’s sub-processors presenting up-to-date attestations,
reports or extracts from independent bodies, including without
4. Rights of Data Subjects. Bugcrowd shall, to the extent
limitation external or internal auditors, Bugcrowd’s data
legally permitted, promptly notify Customer if it receives a
protection officer, the IT security department, data protection or
request from a Data Subject for access to, correction,
quality auditors or other mutually agreed to third parties or
amendment or deletion of such Data Subject’s Personal Data
certification by way of an IT security or data protection audit.
and, to the extent applicable, Bugcrowd shall provide Customer
Onsite audits at sub-processors premises may be performed by
with commercially reasonable cooperation and assistance in
Bugcrowd acting on behalf of Controller.
relation to any such complaint, notice, or communication.
Bugcrowd shall correct erroneous Personal Data as directed by c. Audit Process. Unless required by Data
Customer in writing or pursuant to a process mutually agreed to Protection Laws and Regulations, Customer may request a
in writing by the parties. Customer shall use its best efforts to summary audit report(s) or audit Bugcrowd no more than once
respond to and resolve promptly all requests from Data Subjects annually. Customer must provide at least four (4) weeks’ prior
which Bugcrowd provides to Customer. If Data Protection Laws written notice to Bugcrowd of a request for summary audit
and Regulations require Bugcrowd to take any corrective actions report(s) or request to audit. The scope of any audit will be
without the involvement of Customer, Bugcrowd shall take such limited to Bugcrowd’s policies, procedures and controls relevant
corrective actions and inform Customer. Customer shall be to the protection of Customer’s Personal Data. Subject to
responsible for any reasonable costs arising from Bugcrowd’s Section 7(b), all audits will be conducted during normal business
provision of such assistance under this Section. To the extent hours, at Bugcrowd's principal place of business or other
legally permitted, Customer shall be responsible for any costs Bugcrowd location(s) where Personal Data is accessed, processed
arising from Bugcrowd’s provision of such assistance. or administered, and will not unreasonably interfere with
Bugcrowd's day-to-day operations. An audit will be conducted at
5. Bugcrowd Personnel. Bugcrowd shall train personnel Customer‘s sole cost and by a mutually agreed upon third party
engaged in the Processing of Personal Data of the confidential who is engaged and paid by Customer, and is under a
nature of the Personal Data and provide appropriate training non-disclosure agreement containing confidentiality provisions
based on their responsibilities. Bugcrowd shall execute written substantially similar to those set forth in the Agreement,
agreements with its personnel to maintain the confidentiality of obligating it to maintain the confidentiality of all Bugcrowd
Personal Data, including post the termination of the personnel Confidential Information and all audit findings. Further, Customer
engagement. Bugcrowd shall use commercially reasonable agrees to pay the costs of any support provided by Bugcrowd
efforts to limit access to Personal Data to personnel who require (including internal resources) based on Bugcrowd’s then-current
such access to perform the Agreement. If required by Data rates. Before the commencement of any such on-site audit,
Protection Laws and Regulations, Bugcrowd shall appoint a data Bugcrowd and Customer shall mutually agree upon the timing,
protection officer. Upon request, Bugcrowd will provide the and duration of the audit. Bugcrowd will reasonably cooperate
contact details of the appointed person. with the audit, including providing auditor the right to review but
not to copy Bugcrowd security information or materials during
6. Security. Bugcrowd will implement appropriate normal business hours. Customer shall, at no charge, provide to
technical and organizational measures designed to ensure a level Bugcrowd a full copy of all findings of the audit. The results of
of security appropriate to the risk posed by the Processing of the audit will be considered “Confidential Information” of
Personal Data, taking into account the costs of implementation; Bugcrowd.
the nature, scope, context, and purposes of the Processing; and
the risk of varying likelihood and severity of harm to the data 8. Limitation of Liability. To the extent permitted under
subjects. In assessing the appropriate level of security, Bugcrowd law, each party’s and all of its affiliates’ liability, taken together in
shall weigh the risks presented by processing, in particular from the aggregate, arising out of or related to this DPA whether in
accidental or unlawful destruction, loss, alteration, unauthorized contract, tort or under any other theory of liability, is subject to
the “Limitation of Liability” section of the Agreement, and any 9. Governing Law. The parties agree that (1) governing
reference in such section to the liability of a party means the law of this DPA, and (2) the forum for all disputes in respect of
aggregate liability of that party and all of its affiliates under the this DPA, shall be the same as set out in the Agreement, unless
Agreement and this DPA. For the avoidance of doubt, Bugcrowd’s otherwise required by applicable Data Protection Laws and
and its affiliates’ total liability for all claims from the Customer Regulations.
arising out of or related to the Agreement and each DPA shall
apply in the aggregate for all claims under both the Agreement
and this DPA.
Accepted and agreed:
CUSTOMER: BUGCROWD INC.
Signature: Signature:
Print Name: Print Name:
Print Title: Print Title:
Exhibit A
Supplemental Terms for the Standard Contractual Clauses
This Exhibit A forms part of the DPA and supplements the Standard Contractual Clauses. Capitalized terms not defined in this Exhibit A have
the meaning set forth in the DPA.
The parties agree that the following terms shall supplement the Standard Contractual Clauses:
1. Supplemental Terms. The parties agree that: (i) a new Clause 1(e) is added the Standard Contractual Clauses which shall read: “To the
extent applicable hereunder, these Clauses also apply mutatis mutandis to the Parties’ processing of personal data that is subject to the
Swiss Federal Act on Data Protection. Where applicable, references to EU Member State law or EU supervisory authorities shall be
modified to include the appropriate reference under Swiss law as it relates to transfers of personal data that are subject to the Swiss
Federal Act on Data Protection.”; (ii) a new Clause 1(f) is added to the Standard Contractual Clauses which shall read: “To the extent
applicable hereunder, these Clauses, as supplemented by Annex III, also apply mutatis mutandis to the Parties’ processing of personal
data that is subject to UK Data Protection Laws (as defined in Annex III).”; (iii) the optional text in Clause 7 is deleted; (iv) Option 1 in
Clause 9 is struck and Option 2 is kept, and data importer must notify data exporter of any new subprocessors in accordance with
Section 2.h of the DPA; (v) the optional text in Clause 11 is deleted; and (vi) in Clauses 17 and 18, the governing law and the competent
courts are those of Ireland (for EEA transfers), Switzerland (for Swiss transfers), or England and Wales (for UK transfers).
2. Annex I. Annex I to the Standard Contractual Clauses shall read as follows:
A. List of Parties
Data Exporter: Customer.
Address: As set forth in the Notices section of the Agreement.
Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.
Activities relevant to the data transferred under these Clauses: The Services.
Role: Controller.
Data Importer: Bugcrowd Inc.
Address: As set forth in the Notices section of the Agreement.
Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.
Activities relevant to the data transferred under these Clauses: The Services.
Role: Processor.
B. Description of the Transfer:
Categories of data subjects whose personal data is transferred: As set forth in Exhibit B.
Categories of personal data transferred: As set forth in Exhibit B.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data
and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed
specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: To the
parties knowledge, no sensitive data is transferred.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Personal data is transferred in
accordance with the standard functionality of the Services, or as otherwise agreed upon by the parties.
Nature of the processing: The Services.
Purpose(s) of the data transfer and further processing: The Services.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: Data
importer will retain personal data in accordance with the DPA.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: Please see sub-processor list
available at Bugcrowd’s Trust Center: https://trust.bugcrowd.com/subprocessors/
C. Competent Supervisory Authority: The supervisory authority mandated by Clause 13. If no supervisory authority is mandated by
Clause 13, then the Irish Data Protection Commission (DPC), and if this is not possible, then as otherwise agreed by the parties
consistent with the conditions set forth in Clause 13.
D. Clarifying Terms: The parties agree that: (i) the certification of deletion required by Clause 8.5 and Clause 16(d) of the Clauses will be
provided upon data exporter’s written request; (ii) the measures data importer is required to take under Clause 8.6(c) of the Clauses
will only cover data importer’s impacted systems; (iii) the audit described in Clause 8.9 of the Clauses shall be carried out in accordance
with Section 7 of the DPA; (iv) the termination right contemplated by Clause 14(f) and Clause 16(c) of the Clauses will be limited to the
termination of the Clauses; (v) unless otherwise stated by data importer, data exporter will be responsible for communicating with data
subjects pursuant to Clause 15.1(a) of the Clauses; (vi) the information required under Clause 15.1(c) of the Clauses will be provided
upon data exporter’s written request; and (vii) notwithstanding anything to the contrary, data exporter will reimburse data importer for
all costs and expenses incurred by data importer in connection with the performance of data importer’s obligations under Clause
15.1(b) and Clause 15.2 of the Clauses without regard for any limitation of liability set forth in the Agreement.
3. Annex II. Annex II of the Standard Contractual Clauses shall read as follows:
4
Data importer shall implement and maintain technical and organisational measures designed to protect personal data in accordance
with the DPA.
Pursuant to Clause 10(b), data importer will provide data exporter assistance with data subject requests in accordance with the DPA.
4. Annex III. A new Annex III shall be added to the Standard Contractual Clauses and shall read as follows:
The UK Information Commissioner’s Office International Data Transfer Addendum to the EU Commission Standard Contractual Clauses
(“UK Addendum”) is incorporated herein by reference.
Table 1: The start date in Table 1 is the effective date of the DPA. All other information required by Table 1 is set forth in Annex I,
Section A of the Clauses.
Table 2: The UK Addendum forms part of the version of the Approved EU SCCs which this UK Addendum is appended to including the
Appendix Information, effective as of the effective date of the DPA.
Table 3: The information required by Table 3 is set forth in Annex I and II to the Clauses.
Table 4: The parties agree that Importer may end the UK Addendum as set out in Section 19.
5
Exhibit B
Processing Details and Instructions
This Exhibit B forms part of the DPA. Capitalized terms not defined in this Exhibit B have the meaning set forth in the DPA.
Data Exporter: is the applicable “Customer” described in the DPA
Data Importer: is Bugcrowd Inc., 300 California Street, Suite 220, San Francisco, CA 94104. Email for notices is privacy@bugcrowd.com
Data Subjects
Customer may submit Personal Data to the Services, the extent of which is determined and controlled by Customer in its sole discretion, and
which may include, but is not limited to Personal Data relating to the following categories of Data Subjects:
1. Customers, prospects and business partners
2. Employees and their respective dependents, beneficiaries, and emergency contacts
3. Contractors (including contingent workers)
4. Volunteers, interns, temporary, and casual workers
5. Suppliers and vendors
6. Commercial representatives
7. Freelancers, agents, consultants, and other professional respondents, and their respective dependents, beneficiaries, and
emergency contacts
8. Prospective employees and temporary staff
9. Advisors, consultants, and other professionals
Categories of Personal Data
Customer may submit Personal Data to the Services, the extent of which is determined and controlled by Customer in its sole discretion, and
may include, but is not limited to, the following categories of Personal Data:
1. First and last name
2. Business contact information
3. Personal contact information
4. Title, position, employer
5. ID data
6. Bank details
7. Transaction data
8. Connection data
9. Location data
Processing Operations
Bugcrowd is a provider of security testing and vulnerability reporting services, including through its Platform, which may process personal
data upon the instruction of Customer in accordance with the terms of the DPA and the Agreement. Customer instructs Bugcrowd to
Process Personal Data: (i) necessary for the provision of the Services; and (ii) as part of any Processing initiated by Customer.
Duration of Processing and Retention of Data
Bugcrowd will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing. Bugcrowd will retain
Personal Data in accordance with the DPA or as long as required under law, unless otherwise agreed to in writing.
6
Exhibit C
Security Measures
This Exhibit C forms part of the DPA. Capitalized terms not defined in this Exhibit C have the meaning set forth in the DPA.
Bugcrowd will take, at a minimum, the security measures described in this Exhibit C (or, as these measures are updated by Bugcrowd from
time to time, measures that are of substantially similar stringency) in order to ensure compliance with such security provisions with regard
to the Processing of Personal Data on behalf of Customer.
Access Control to Processing Areas
Bugcrowd implements suitable measures in order to prevent unauthorized persons from gaining access to the data processing equipment
where the personal data are processed or used. This is accomplished by:
● establishing security areas; 24 hours security service provided by property owner;
● protection and restriction of access paths;
● securing the data processing equipment;
● establishing access authorizations for staff and third parties, including the respective documentation;
● regulations on card-keys;
● restriction on card-keys;
● all access to the data center where personal data are hosted is logged, monitored, and tracked; and
● the data center where personal data are hosted is secured by a security alarm system, and other appropriate security measures.
Access Control to Data Processing Systems
Bugcrowd implements suitable measures to prevent its data processing systems from being used by unauthorized persons. This is
accomplished by:
● identification of the terminal and/or the terminal user to the Bugcrowd systems;
● automatic time-out of user terminal if left idle, identification and password required to reopen;
● automatic turn-off of the user ID when several erroneous passwords are entered, log file of events (monitoring of
break-in-attempts);
● issuing and safeguarding of identification codes;
● dedication of individual terminals and/or terminal users, identification characteristics exclusive to specific functions;
● staff policies in respect of each staff access rights to personal data (if any), informing staff about their obligations and the
consequences of any violations of such obligations, to ensure that staff will only access personal data and resources required to
perform their job duties and training of staff on applicable privacy duties and liabilities;
● all access to data content is logged, monitored, and tracked; and
● use of state of the art encryption technologies.
Access Control to Use Specific Areas of Data Processing Systems
Bugcrowd commits that the persons entitled to use its data processing system are only able to access the data within the scope and to the
extent covered by its access permission (authorization) and that personal data cannot be read, copied or modified or removed without
authorization. This shall be accomplished by:
● staff policies in respect of each staff member's access rights to the personal data;
● allocation of individual terminals and/or terminal user, and identification characteristics exclusive to specific functions;
● monitoring capability in respect of individuals who delete, add or modify the personal data and at least yearly monitoring and
update of authorization profiles;
● release of data to only authorized persons;
● policies controlling the retention of backup copies; and
● use of state of the art encryption technologies.
Transmission Control
Bugcrowd implements suitable measures to prevent the personal data from being read, copied, altered or deleted by unauthorized parties
during the transmission thereof or during the transport of the data media. This is accomplished by:
● use of state-of-the-art firewall and encryption technologies to protect the gateways and pipelines through which the data travels;
● as far as possible, all data transmissions are logged, monitored and tracked; and
● monitoring of the completeness and correctness of the transfer of data (end-to-end check).
Input Control
Bugcrowd implements suitable measures to ensure that it is possible to check and establish whether and by whom personal data have been
input into data processing systems or removed. This is accomplished by:
● an authorization policy for the input of data into memory, as well as for the reading, alteration and deletion of stored data;
● authentication of the authorized personnel; individual authentication credentials such as user IDs that, once assigned, cannot be
re-assigned to another person (including subsequently);
● protective measures for the data input into memory, as well as for the reading, alteration and deletion of stored data;
● utilization of user codes (passwords) of at least eight characters or the system maximum permitted number and modification at
first use and thereafter at least every 90 days in case of processing of sensitive data;
● following a policy according to which all staff of Bugcrowd who have access to personal data processed for Customers shall reset
their passwords at a minimum once in a 180 day period;
● providing that entries to data processing facilities (the rooms housing the computer hardware and related equipment) are capable
of being locked;
● automatic log-off of user ID's (requirement to re-enter password to use the relevant work station) that have not been used for a
substantial period of time;
● automatic deactivation of user authentication credentials (such as user IDs) in case the person is disqualified from accessing
7
personal data or in case of non use for a substantial period of time (at least six months), except for those authorized solely for
technical management;
● proof established within Bugcrowd's organization of the input authorization; and
● electronic recording of entries.
Job Control
Bugcrowd ensures that personal data may only be processed in accordance with written instructions issued by Customer. This is
accomplished by:
● binding policies and procedures for Bugcrowd's employees, subject to Customer's review and approval.
Bugcrowd ensures that if security measures are adopted through external entities it obtains written description of the activities performed
that guarantees compliance of the measures adopted with this document. Bugcrowd further implements suitable measures to monitor its
system administrators and to ensure that they act in accordance with instructions received. This is accomplished by:
● individual appointment of system administrators;
● adoption of suitable measures to register system administrators' access logs and keep them secure, accurate and unmodified for at
least six months;
● yearly audits of system administrators' activity to assess compliance with assigned tasks, the instructions received by Bugcrowd
and applicable laws; and
● keeping an updated list with system administrators' identification details (e.g. name, surname, function or organizational area) and
tasks assigned and providing it promptly to Customers upon request.
Availability Control
Bugcrowd implements suitable measures to ensure that Personal Data are protected from accidental destruction or loss. This is
accomplished by:
● infrastructure redundancy to ensure data access is restored within seven days and backup performed at least weekly;
● tape backup is stored off-site and available for restore in case of failure of SAN infrastructure for Database server;
● only the Customer(s) may authorize the recovery of backups (if any) or the movement of data outside of the location where the
physical database is held, and security measures will be adopted to avoid loss or unauthorized access to data, when moved;
● regular check of all the implemented and herein described security measures at least every six months;
● backup tapes are only re-used if information previously contained is not intelligible and cannot be re-constructed by any technical
means; other removable media is destroyed or made unusable if not used; and
● any detected security incident is recorded, alongside the followed data recovery procedures, and the identification of the person
who carried them out.
Separation of processing for different purposes
Bugcrowd implements suitable measures to ensure that data collected for different purposes can be processed separately. This is
accomplished by:
● access to data is separated through application security for the appropriate users;
● modules within the Bugcrowd's data base separate which data is used for which purpose, i.e. by functionality and function; and
● at the database level, data is stored in different areas, separated per module or function they support; and
● interfaces, batch processes and reports are designed for only specific purposes and functions, so data collected for specific
purposes is processed separately.
Bugcrowd system administrators
Bugcrowd implements suitable measures to monitor its system administrators and to ensure that they act in accordance with instructions
received. This is accomplished by:
● individual appointment of system administrators;
● adoption of suitable measures to register system administrators' access logs and keep them secure, accurate and unmodified for at
least six months;
● continuous audits of system administrators' activity to assess compliance with assigned tasks, the instructions received by
Bugcrowd and applicable laws; and
● keeping an updated list with system administrators' identification details (e.g. name, surname, function or organizational area) and
tasks assigned and providing it promptly to Customer upon request.
8