Trust & Security Annex

Capitalised terms have the meaning given in the Master Subscription Agreement (the "MSA") unless otherwise stated.

This Trust & Security Annex sets out the Supplier's binding commitments to the Customer in respect of (i) service availability, (ii) information-security controls (the "Technical and Organisational Measures" or "TOMs"), (iii) business continuity and disaster recovery, and (iv) the use of artificial intelligence within the Service. It forms an integral part of the Agreement.

The Supplier maintains the following TOMs in connection with the Service. Specific configurations and supporting tooling may evolve in line with the HCF; the Supplier shall not, by way of such evolution, materially diminish the protections set out below without the Customer's prior written consent.

3.1 Governance, risk and policy

• A documented Information Security Management System ("ISMS") aligned with ISO/IEC 27001:2022, reviewed at least annually.
• A Security Steering Committee including senior leadership accountable for the ISMS.
• Continual risk assessments to identify and mitigate threats to the confidentiality, integrity and availability of the Service.

3.2 Personnel security and training

• Mandatory background and identity checks for all personnel prior to joining, to the extent permitted by applicable law.
• Ongoing security-awareness training for all personnel, including specialised modules on AI usage and phishing defence.
• Confidentiality and non-disclosure obligations as a condition of every employment or contractor agreement.

3.3 Identity and access management

• Need-to-know and least-privilege principles applied to all systems containing Customer Data.
• Multi-factor authentication (MFA) mandatory for all production and administrative access.
• Role-based access control aligned with job function; access to internal resources and cloud infrastructure governed by zero-trust principles rather than network location.
• Centralised identity provider and SAML single sign-on for corporate SaaS applications and core services.
• Automated provisioning and revocation, with access terminated within twenty-four (24) business hours of role change or departure.
• User access reviews — quarterly for systems of high criticality; bi-annually to annually for other systems — to verify least-privilege alignment.
• Privileged access requires asset-owner approval and strong authentication, with the four-eyes principle applied to highly sensitive actions.

3.4 Configuration and change management

• All infrastructure and application changes undergo a documented change-management process, peer review and testing before deployment to production.
• Development, testing and production environments are logically and physically isolated.
• Vulnerability management: critical vulnerabilities remediated within seventy-two (72) hours; other vulnerabilities remediated within defined severity-based service levels.

3.5 System and network protection

• Secure VPC architecture and firewalls preventing unauthorised lateral movement.
• Web Application Firewall and Distributed Denial of Service (DDoS) protection at the production edge.
• 24/7 security monitoring and centralised logging, with automated alerting on anomalous behaviour.
• Security, application and infrastructure logs centrally collected, retained securely for at least one (1) year, and protected against tampering.
• Industry-standard hardening baselines applied to all systems.
• Cloud infrastructure capacity continuously monitored and dynamically scaled to ensure availability during demand spikes.

3.6 Asset and data protection

• Customer Data encrypted at rest using AES-256 or equivalent.
• All network traffic over external networks, including web traffic to the Application, encrypted in transit using TLS 1.2 or higher (TLS 1.3 preferred).
• Full disk encryption mandated and enforced via mobile-device management on all Supplier workstations.
• Endpoint detection and response (EDR) or anti-malware software centrally managed across all workstations.
• Centrally managed mobile device management across all workstations, enforcing full disk encryption and configuration baselines.
• Screen lock enforced after no more than 15 minutes of inactivity; clear-desk and clear-screen policy.
• Information classified by sensitivity (Public / Internal / Restricted) and labelled in systems and documents.
• Production customer data is strictly prohibited from being used in development or testing; synthetic, non-identifiable data is used for testing.
• Data leakage prevention measures detect and prevent unauthorised extraction of sensitive data from the cloud environment.
• Secure disposal of equipment and media using NIST-aligned wipe or destruction procedures.
• Customer workspaces and personal data securely deleted from production databases on contract termination or verifiable customer request, in accordance with section 14 of the MSA.

3.7 Physical security

• Production environment physical controls are inherited from AWS and validated annually through the Supplier's review of AWS compliance reports (ISO/IEC 27001 and SOC 2 Type I or II).
• Entry to Supplier offices restricted and monitored via electronic access-control systems.
• Remote workers are required by policy to protect equipment and information from unauthorised viewing or theft.

3.8 System development and operations

• Mandatory secure-engineering principles documented and applied across all development, aligned with the OWASP Top 10.
• Software composition analysis integrated into the CI/CD pipeline to detect known vulnerabilities in third-party dependencies.
• Application security testing — including both manual and automated testing — completed before production deployment.
• Annual third-party penetration testing of the Application and external network.
• Continuous bug-bounty programme.

3.9 Incident response

• Formal Incident Response Plan aligned with NIST SP 800-61 covering identification, containment, eradication and recovery.
• Clear, accessible reporting mechanism for employees to report security weaknesses immediately.
• Root-cause analysis and lessons-learned process for Severity-1 and Severity-2 incidents.
• Personal data breach notification in accordance with section 6 of the DPA.

3.10 Vendor and third-party management

• Security risk assessment of all critical third-party vendors before onboarding.
• Information-security requirements (security obligations, confidentiality, incident notification, audit cooperation) formally addressed in contractual agreements with all suppliers who access, process or manage Customer Data.
• Critical sub-processors subject to periodic security reviews including assessment of certifications, review of security incidents and evaluation of contractual compliance.
• ICT supply-chain security risk management, including communication of security requirements to suppliers of ICT products and services.

This section 5 sets out the Supplier's durable commitments in respect of artificial intelligence within the Application. These commitments are designed to remain stable as the Supplier's AI capabilities evolve. The current list of AI capabilities available within the Application, including the underlying model provider for each capability and the in-product description, is published on the Supplier's Trust Center at https://trust.howspace.com (the "Trust Center AI Page"). The Trust Center AI Page is an exhaustive list of the AI capabilities offered by the Supplier; the AI capabilities actually available to the Customer depend on the Customer's subscription and on the sub-processors that the Customer has not objected to under section 3.3 of the DPA. The Supplier may update the Trust Center AI Page from time to time, subject to the commitments set out in this section 5 and to the sub-processor onboarding process in section 3 of the DPA.

The Supplier may update this Trust & Security Annex from time to time to reflect the evolution of the HCF and operational practices, subject to section 15.2 of the MSA. The Supplier shall not, by way of such updates, materially diminish the security, confidentiality or data-protection commitments to the Customer without the Customer's prior written consent.