Pipl Data Protection Addendum Annexes

Annex 1: Description of Processing of Client Personal Data

Subject matter and duration of the Processing of the Personal Data

The subject matter and duration of the Processing of the Client Personal Data are set out in Section 2 of the Terms.

The nature and purpose of the Processing of the Personal Data

The nature and purpose of the Processing of the Client Personal Data are set out in Section 2 of the Terms.

The categories of Data Subject to whom the Client Personal Data relates

    - Client current and prospective customers, vendors and business partners
    - Client employees who use the Services

The types of Client Personal Data to be Processed

Name, Address, Date of Birth, Age, Education, Email, Gender, Image, Job, Language, Phone, Related person, Related URL, User ID, Username, IP address

Special categories of data

None

The obligations and rights of Client

The obligations and rights of Client are set out in the Terms and this Addendum.

Data exporter (as applicable)

The data exporter is: Client of Pipl that uses the Services:

Data importer (as applicable)

The data importer is: Pipl, a company that provides services to the Client, which requires receiving the Client’s query data:
Pipl, Inc.
510 S. Clearwater Loop, Ste, 100
Post Falls, ID 83854 USA

Processing operations (as applicable)

The personal data transferred will be subject to the following basic processing activities: The provision of Pipl Services to Client. In order to provide people data, Pipl receives identifying Personal Data to permit Pipl to query, cleanse, standardize, enrich, (when required) send to additional data to feed providers, and to store the query information.

 

Data Centers
Pipl production services are hosted in SOC2 compliant data centers. Pipl receives and reviews its providers’ SOC1 and SOC2 reports every 6 months.

Production Environment
Separate and distinct production, staging, and development environments are maintained, and production data is not replicated outside of the production restricted environments.

Access to the production environment is restricted to authorized and trained members of Pipl's teams who have undergone background checks and special security training. Access is done via VPN, using unique strong passwords and TOTP based 2FA, Access to the production environment is only via ssh terminal connections, using passphrase protected personal RSA certificates. An IDS system is in place on all production servers, which includes real-time monitoring and alerting of any changes to the production system files or configuration, and anomalous security events. For those authorized and trained members of the team with access to the production environment, any workstations running Windows or OS X used for ssh terminal access to the production environment must be running current and active anti-virus software. Production data is not replicated onto employee workstations or mobile devices.

Network Security
Pipl uses a SOC2 compliant 3rd party for DDoS and Bot protection and Web Application Firewall service. A host based IDS is in place on production servers, with real time monitoring and alerting on abnormal behavior or system configuration changes.

Login Security
Google OAuth is supported for Pipl customers. All customers can enable 2FA on their accounts via the use of Google OAuth. If OAuth is used to access Pipl, Pipl will inherit the login security settings in the user's Google account.

If logging in directly to Pipl using a username or email and password, Pipl requires a minimum of 8 characters. Repeated failed login attempts trigger a 30 second lock before a user can retry. Passwords are stored in a hashed form and will never be sent via email. Upon account creation and password reset, Pipl will send a link to the email associated with the account that will enable the user to create a new password.

Vulnerability Detection and Penetration Tests
Automated scans of Pipl's production site are conducted once a month. All changes are peer reviewed and vulnerability and security lists are actively monitored for CVE and other vulnerability disclosures, with appropriate actions taken. A penetration test is commissioned annually, with all findings mitigated as appropriate. As a general matter, issues that come to our attention through penetration tests, or other means, are fixed as quickly as reasonably possible.

Access Control
All customer data is considered highly sensitive and protected, and access is least privilege. Only authorized and trained members of the Pipl team have direct access to production systems and user data. Those who do have direct access to data are only permitted to view it in aggregate, or for troubleshooting purposes. User data is only viewed by Pipl employees for troubleshooting purposes when consent has expressly been provided ahead of time by the account owner, or team administrator.

We maintain a list of members of the Pipl team with access to the production environment. These members undergo background checks and are approved by the VP of Infrastructure. Another list allows all relevant roles to access code, as well as the development and staging environments. These lists are reviewed quarterly and upon role change.

Trained members of the Pipl technical support team have case-specific, limited, access to user data through restricted access customer support tools.

Third Party Access
Select customer data in very limited cases is shared only with third party service providers acting as our agent, and in strict compliance with our privacy policy, and under non- disclosure agreements.

Physical Security
Customer data is never to be replicated outside of the production environment and is never to be replicated onto employee workstations. Thus, when it comes to physical security compliance, we rely on our data centers’ security. The physical servers are located in secure data centers. Production critical data is never to be stored on physical media outside of the production environments. Pipl's production environment is hosted in SOC2 compliant data centers.

Geographical Location of Data
Customers data is stored in different data-centers around the US. Customers data can also be found in Pipl backups, stored in data-centers around the US.

Corporate Environment and Removable Media
Strict firewall rules prohibit access to necessary ports for the usage of the service (e.g., 443), to ensure limited access to the production environment, to our VPN network, and authorized systems. The corporate network has no privileged access to the production environment, with authorized employees still required to connect to the VPN in order to access any special systems or environments.

Production customer data is never to be stored on employee workstations or removable media. Employee devices are required to time out and lock after a maximum of ten minutes of inactivity. Pipl also maintains a clean desk policy.

Encryption In-Transit and At-Rest
Pipl uses industry standard Transport Layer Security (“TLS”) to create a secure connection using 128bit Advanced Encryption Standard (“AES”) encryption. This includes all data sent between the web and the Pipl servers, as well as internal traffic within production. Sensitive customer data is encrypted immediately when entering our system, and kept encrypted at rest.

Development, Patch and Configuration Management
All changes to the production system, be they code or system configuration changes, require review prior to deployment to the production environment. Thousands of automated unit tests are run against all production code prior to deployment, as well as regularly conducted automated vulnerability scans and commissioned penetration tests. All changes are tested in a staging environment prior to deployment to production. Production servers are managed via a centralized configuration system. All system changes are peer reviewed. Patches are deployed as relevant to their level of security and stability impact, with critical patches able to be deployed well within 24 hours of availability as appropriate.

Pipl restricts access and maintains separate lists of relevant roles with access to source code, development, staging, and production environments. These lists are reviewed quarterly and upon role change.

Pipl uses source code management tools and repositories.

All production servers are running a LTS (Long Term Support) distribution of their operating system to ensure timely updates are available. CVE lists and notifications are actively monitored, and any systems can be patched in a timeline relevant to the severity of the issue. A centralized configuration system is used for the management of production servers, and when needed, a patch can be deployed within hours of its availability.

Asset Management
While some assets are not owned by a specific individual, ownership and maintenance of the confidentiality, integrity, and availability of our systems is distributed amongst the DevOps and Apps Engineering teams. Assets are transferred upon role change or leaving the company.

Anti-virus and anti-malware
Pipl have a centrally managed anti-virus / anti-malware solution deployed on all of its laptops. All laptop hard drives are encrypted.

Remote access
Some of Pipl’s employees work remotely. Customer data is never to be replicated outside of the production environment, which is stored within our hosting provider’s secure servers. Strict firewall rules are in place thus limiting access to the production environment to our VPN network and authorized systems.
Authorized and trained members of Pipl's teams, who have undergone background checks and special security training, access is provided via VPN, using unique strong passwords and TOTP based 2FA. Access the production environment is only via ssh terminal connections using passphrase protected personal RSA certificates.

The corporate network has no privileged access to the production environment, with authorized employees still required to connect to the VPN in order to access any special systems or environments.

Security Awareness and Confidentiality
Security awareness and customer data access policies are covered during employee onboarding as appropriate to the role, and employees are updated as relevant policies or practices change. Employees also sign a Confidential Information and Inventions Agreement.
In the event that a security policy is breached by an employee, Pipl reserves the right to determine the appropriate response, which may include termination.

Vetting
All employees undergo an extensive interview process before hiring. Employees with direct access to the production environment undergo drug testing and a criminal background check where such screening is available and allowed by law. Other employees may undergo a check depending on their role (academic for legal roles, credit for finance, etc). NDAs are in place for any third parties with access to customers’ data.

Password Requirements
Employees are required to enforce 2FA when available and use a password manager with random, secure passwords. Authorized employees access the production environment by authenticating to the VPN using unique strong passwords and TOTP based 2FA and even then, only via ssh terminal connections, using passphrase protected personal RSA certificates.

Backup , Business Continuity, and Disaster Recovery

Backup Policy
Data entered into Pipl is backed up regularly. All backups are encrypted and stored at multiple offsite locations to ensure that they are available in the unlikely event that a restore is necessary.
Encrypted backups can only be decrypted by members of the Pipl operations team who have received training and have been authorized to decrypt the backups.

Backup Interval
A live replica of Pipl’s primary database is constantly being taken. Additionally, a full backup snapshot of the primary database is taken once every 24 hours.

Backup Storage
All Pipl backups are retained on the following schedule and at the following locations:

• Dedicated file servers in our data centers
• Distributed Storage Service #1
• Distributed Storage Service #2

Only authorized members of the Pipl operations team have access to the backup locations, so that they are able to monitor the performance of the backup processes, and in the very unlikely event that a restore becomes necessary.

Business Continuity
The Pipl operations team has designed systems to keep the service running even if the underlying infrastructure experiences an outage or other significant issue. Every critical Pipl service has a secondary, replicated service running simultaneously, with mirrored data in a different data center than the primary server. Additionally, each database server has a replicated service running in a third data center with data that is mirrored immediately.

Disaster Recovery
Using our backup policy, as well as maintaining a detailed blueprints and architecture information, Pipl is able to recover even if the two main facilities hosting Pipl production infrastructure become unavailable.

Annex 3: Authorized Other Processors

Name of Other Processor	Description of Processing	Location of Other Processor
Amazon Web Services	Computing Infrastructure, Storage	USA
hCaptcha	Usage Analytics	USA
Maxmind	Device and Transactions	USA
Google	Computing Infrastructure, Search, Storage, Mapping, Usage Analytics	USA
IBM	Computing Infrastructure, Storage	USA
Microsoft	Computing Infrastructure, Search, Storage	USA
Imperva	Network monitoring, protection, availability solutions	USA
HubSpot	Marketing platform	USA
MixPanel	Product Analytics	USA
Salesforce	Customer relationship management	USA
Stripe	Online payment	USA
Twilio SendGrid	Customer communication platform	USA
Chili Piper	Marketing platform	USA

Annex 4: SCC