As from the Addendum Effective Date, Service Provider will implement and maintain the Security Measures as set out in this Annex 4.

Technical and Organizational Security Measure	Details
Measures of pseudonymisation and encryption of personal data	Service Provider has deployed security methods and protocols for transmission of confidential or sensitive information over public networks. Databases housing sensitive customer data are encrypted at rest. Service Provider uses only recommended secure cipher suites and protocols to encrypt all traffic in transit and Customer Data is securely encrypted with strong ciphers and configurations when at rest.
Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services	Service Provider's customer agreements contain strict confidentiality obligations. Additionally, Service Provider requires every downstream Subprocessor to sign confidentiality provisions that are substantially similar to those contained in Service Provider's customer agreements. Service Provider has undergone a SOC 2 Type 2 audit that includes the Security Trust Service Criteria.
Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident	Daily backups of production datastores are taken. Backups are periodically tested in accordance with information security and data management policies.
Processes for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures in order to ensure the security of the processing	Service Provider has undergone a SOC 2 Type 2 audit that includes the Security Trust Service Criteria.
Measures for user identification and authorization	Service Provider uses secure access protocols and processes and follows industry best-practices for authentication, including Multifactor Authentication and Single Sign On (SSO). All production access requires the use of two-factor authentication, and network infrastructure is securely configured to vendor and industry best practices to block all unnecessary ports, services, and unauthorized network traffic.
Measures for the protection of data during transmission	Service Provider has deployed secure methods and protocols for transmission of confidential or sensitive information over public networks. Service Provider uses only recommended secure cipher suites and protocols to encrypt all traffic in transit (i.e. TLS 1.2)
Measures for the protection of data during storage	Encryption-at-rest is automated by Google Cloud Platform's Cloud SQL, which uses industry standard AES-256 encryption to secure all volume (disk) data. All keys are fully managed by GCP.
Measures for ensuring events logging	Service Provider monitors access to applications, tools, and resources that process or store Customer Personal Data, including cloud services. Monitoring of security logs is managed by the security and engineering teams. Log activities are investigated when necessary and escalated appropriately.
Measures for ensuring system configuration, including default configuration	Service Provider adheres to a change management process to administer changes to the production environment for the Services, including changes to its underlying software, applications, and systems. All production changes are automated through CI/CD tools to ensure consistent configurations.
Measures for internal IT and IT security governance and management	The framework for Service Provider's security program includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the Services and confidentiality, integrity, and availability of Customer Data.
Measures for certification/assurance of processes and products	Service Provider undergoes annual SOC 2 Type II audits.
Measures for ensuring data minimisation	Service Provider's Customers unilaterally determine what data they route through the Services. As such, Service Provider operates on a shared responsibility model. Service Provider gives Customers control over exactly what data enters the platform. Additionally, Service Provider has functionality in the Services that allows Customers to delete and suppress data at their discretion.
Measures for ensuring data quality	Service Provider has a multi-tiered approach for ensuring data quality. These measures include: (i) testing to ensure quality of logic used to process API calls, (ii) database validation rules which execute against data before it is saved to our database, (iii) strong typing to enforce a strict contract between official clients and API resolvers. Service Provider applies these measures across the board, both to ensure the quality of any Usage Data that Service Provider collects and to ensure that the Service Provider Platform is operating within expected parameters. Service Provider ensures that data quality is maintained from the time a Customer sends Customer Personal Data into the Services and until that Customer Personal Data is presented or exported.
Measures for ensuring limited data retention	Customers unilaterally determine what data they route through the Services. As such, Service Provider operates on a shared responsibility model. The Service Provider can delete Customer Personal Data upon the Customer's written request, within the timeframe specified in this DPA and in accordance with Applicable Privacy Laws. All Customer Personal Data is deleted from the Services following service termination.
Measures for ensuring accountability	Service Provider has adopted measures for ensuring accountability, such as implementing data protection and information security policies across the business, recording and reporting Personal Data Breaches, and formally assigning roles and responsibilities for information security and data privacy functions. Additionally, the Service Provider conducts regular third-party audits to ensure compliance with our privacy and security standards.
Measures for allowing data portability and ensuring erasure	Customer Personal Data submitted to the Services by Customer may be deleted by the Customer or at the Customer's request. Customer Personal Data is incidental to the Service Provider's Services. Based on Privacy by Design and Data Minimization principles, Service Provider severely limits the instances of Customer Personal Data collection and processing within the Services. Most use cases for porting Customer Personal Data from Service Provider are not applicable. However, Service Provider will respond to all requests for data porting in order to address Customer needs.
Technical and organizational measures of sub-processors	The Service Provider enters into Data Processing Agreements with its Authorized Sub-Processors with data protection obligations substantially similar to those contained in this DPA.

Service Provider may update the Security Measures from time to time in accordance with Section 5.2 (in Security) of the DPA.