DPA Annex B — Security Measures

Parties: SiteAxis and the business identified in the account or Order. This is a proposed security exhibit, not a certification. When executed, only controls verified under the process below may be described as in operation.

1. Agreed security controls

The control schedule remains under review. Authentication/MFA, tenant and project authorization, file protection, encryption, audit logging, backups, recovery, vulnerability management and personnel access must be specified in this Annex B, version 2026-11-08 before this annex is executed. This draft does not certify any control or deployment.

2. Binding control principles (activate after verification)

2.1 SiteAxis will maintain reasonable risk-proportionate technical and organizational controls, including authenticated access, least-privilege tenant/project authorization, security event evaluation, controlled system changes, secure vendor handling and review of backups and access rights. Measures implemented with equivalent or stronger alternatives may evolve so long as protection is not materially degraded and required notice/consent is provided.

2.2 SiteAxis will restrict Customer Personal Data in support workflows to authorized personnel and necessary purposes. Technical troubleshooting is not broad permission to read, copy or send customer incident details through uncontrolled systems. Elevated access shall be logged to the extent of Internal record, available to customers on request.

2.3 SiteAxis will maintain incident reporting and escalation contacts under security@siteaxis.app, with internal severity/notice policy 2026-11-08 and contractual timing only as completed in the DPA.

2.4 SiteAxis shall perform periodic risk reviews and proportionate security controls for Subprocessors. Provider-specific safeguards and storage/processing regions are set out in approved Annex C and underlying provider terms.

2.5 Customer is responsible for correct role assignment, legitimate cross-organization sharing, endpoint security and prompt access revocation for its users. SiteAxis's own backend enforcement and legal duties remain unaffected by this allocation.