Customer InfoSec Addendum

This Customer Information Security Addendum (“InfoSec Addendum”) forms a part of, and is subject to, the agreement(s) between Customer and Flock Group Inc (“Flock”) related to the provision of Flock Services (the “Agreement”). All capitalized terms used but not defined herein will have the meaning ascribed to them in the Agreement. To the extent of any conflict between this InfoSec Addendum and any other agreement between Customer and Flock, this InfoSec Addendum shall control.

1. SCOPE. This InfoSec Addendum sets forth Flock’s information security program and infrastructure policies in order to protect Customer Data from unauthorized use, access, disclosure, theft, and/or manipulation for the term of the Agreement and for any period of time thereafter during which Flock Safety has possession of or access to Customer Data.

2. PHYSICAL SECURITY.

2.1. Data Center. Flock will exclusively use Amazon Web Services (“AWS”) for the provision of data center facilities. Flock warrants that AWS meet the physical security requirements appropriate for processing and storage of Customer Data and will regularly, but at least annually, review the AWS certification of its data center facilities.

2.2. Flock Offices. Flock offices are protected with locks and cameras. Customer Data in physical or digital form will not be stored in Flock offices.

2.3. Flock Laptops. Notwithstanding Section 2.2 above, Customer Data may be temporarily downloaded onto Flock-owned laptops for data analysis and/or troubleshooting. Laptops are security-hardened with a configuration that includes full-disk encryption, endpoint detection and response agent, enforced password authentication, and automatic screensaver with password unlock.

3. NETWORK, STORAGE, AND HOST SECURITY.

3.1. Transmission. Flock will ensure Customer Data under Flock’s control traversing any public network will be end-to-end encrypted using TLS 1.2 or better, and a cipher suite adhering to the recommendations of NIST SP800-52 of at least AES128-SHA256 or better.

3.2. Geographic Location. Flock does not store Customer Data outside of the United States.

3.3. Storage and Encryption. Flock will store all Customer Data transmitted to Flock in AWS S3 containers set with encryption-at-rest to AES256 or better; or in Flock databases encrypted to AES256 or better; or to online backups (“snapshots”) stored in AWS S3 containers set with encryption-at-rest to AES256 or better. Decryption and management of encryption keys are controlled by Flock. Only NIST-approved ciphers and modes will be used for encryption.

3.4. Storage Media. Flock will not store Customer Data on removable media (e.g., tapes, removable disks, flash drives, etc.) in the normal course of business. Any transfer of Customer Data via removable media is prohibited without Customer’s written approval.

3.5. Intrusion Detection / Prevention. Flock will implement appropriate tools, equipment and mechanisms in the environment of, and within, the application designed to prevent unauthorized access to Customer Data. Such tools may include deployment of firewalls, intrusion detection systems, malware detection, and malware interception software. Flock will monitor all such tools, and assess and take steps to address any incidents of which it becomes aware without undue delay. Flock will implement Endpoint Detection and Response (EDR) tools on laptops and cloud workloads.

4. LOGGING AND MONITORING.

4.1. Availability and Performance. Flock will continuously monitor infrastructure, network, storage, and system performance.

4.2. Security Alerts. Flock maintains intrusion detection systems that log events to Flock’s security team in real-time. Additional security logs are generated for periodic review by the security team including failed and successful login attempts.

5. THIRD PARTY SECURITY.

5.1. Vendor Due Diligence. Flock conducts appropriate due diligence prior to engaging any third party, vendor, subcontractor, or subprocessor used to provide any services to Customer.

5.2. Vendor Management. Flock will evaluate all vendors to ensure their security controls are of a level consistent with or better than Flock’s own, prior to any vendor being given access to any Flock system or Customer Data. Flock uses a formal vendor risk management system based on recommendations in NIST SP 800-39.

5.3. Vendor Certification and Warranty. Flock will evaluate and store vendor credentials, vendor engagement agreements, and any other artifacts as appropriate for the task engaged (such as PCI-DSS attestations for payment processors; ISO27001 for Infrastructure Providers; SOC-2 where applicable for SaaS) for at least one year past the lifetime of the vendor engagement with Flock.  Flock will review such artifacts and credentials annually.

6. CUSTOMER ACCESS CONTROLS.

6.1. Customer Authentication (SAML Login). Customers with Single Sign-On via the “Security Assertion Markup Language” standard (“SAML Login”) will configure any access restrictions via Customer’s IdP. All access controls (such as password complexity, multi-factor authentication, session length validity) are the responsibility of Customer.

6.2. Customer Authentication (OAuth2 Login). Customers with Single Sign-On via the “Open Authentication 2.0” standard (“OAuth2 Login”) will either (a) allow users to configure any access restrictions via their OAuth2 provider, or (b) may restrict the OAuth2 domain to an OAuth2 provider under their control (such as the enterprise Google Workspace). All access controls (such as password complexity or multi-factor authentication) are the responsibility of the OAuth2 account holder. Where Customer controls the OAuth2 provider (such as for Google Workspace), all access controls are the responsibility of Customer.

6.3. Customer Authentication (username/password). Customers may allow username/password as a mechanism to authenticate users. Customer passwords are stored within Auth0 using industry standard techniques to hash and salt the password. Flock will ensure no user password is ever stored in the clear in any Flock-controlled cache, file, database, or access log.

7. CUSTOMER DATA.

7.1. Flock Services. Customer will control access to data obtained by Flock Services, via the Web Interface. Customer may invite, allow access to, remove access from the Web Interface at any time. Upon written request, Flock’s Customer team can assist Customer in updating its Authorized End User permissions. In the case of specific deletion, Flock will use commercially reasonable efforts to remove all Customer Data from shared access, and from Flock’s systems following the completion of backup cycles, as Customer Data may be temporarily retained in Flock backups after deletion.

7.2. Personal Information. To the extent any data processed by Flock constitutes Personal Information (as defined under Applicable Laws), Flock will process such data in accordance with Applicable Law and Flock’s Data Processing Agreement located at www.flocksafety.com/legal.

7.3. Access Control. Flock’s access controls will include commercially reasonable procedures to check and enforce access restrictions for network requests. Flock will employ a web application firewall (WAF) in front of publicly facing web applications.

7.4. Customer Data Segmentation. Data that is captured as part of the Flock service is stored as an individual file, in an encrypted AWS S3 container, with the URL controlled by the Flock Safety servers.

7.5. Customer Data Confidentiality. Flock will not share Customer Data with any third party except as necessary to perform its obligations under the Agreement or as otherwise permitted by the Agreement.

8. INCIDENT MANAGEMENT.

8.1. Incident Response Retainer. Flock will maintain a retainer with a qualified third party incident response firm.

8.2. Assessment and Notification. Flock will promptly investigate all reported or detected security issues and assess the impact. If a confirmed incident affects Customer Data, Flock will notify Customer within the timeframe required by Applicable Law, and in any event within seventy-two (72) hours, at the email address provided by Customer for reporting security incidents.

8.3. Remediation.  For any confirmed incident that affects Customer, Flock may, at its discretion, inform Customer of the progress of any remediation periodically throughout remediation activity. Based on Flock’s assessment, Customer may be involved in the remediation.  Flock will retain all data related to the incident for at least one year following the termination or expiration of the Agreement.

9. FLOCK SAFETY ACCESS CONTROLS.

9.1. Flock Workforce Authentication. Flock staff will use individual credentials to access the Flock system. All access permissions are role-based grants, on the principle of least privilege. Multifactor authentication is mandatory for system access. Additional multifactor authentication is required for access to core systems such as for infrastructure management or financial system access.

9.2. Flock Endpoint Devices. Flock’s end-point devices will be configured to increase protection of any Customer Data that may be accessed, including full-disk encryption, mandatory login passwords, and password-secured screensavers.

10. SOFTWARE DEVELOPMENT.

10.1. Code Development. Flock uses a Secure Software Development Life Cycle (SSDLC) framework for all code development. All branch, feature, and releases must be reviewed by more than one team member. Pull requests must be approved by an authorized team member. Automated code analysis and integration testing is applied before any code merge, and again before release to production.

10.2. Change Management.  Flock requires all code to pass all automated tests prior to being considered for release. A release must be approved by an authorized team member designated for that code area. Emergency fixes may be expedited but will still require approval from an authorized member of the responsible team. Incident management change control will be overseen by Flock’s CTO.

10.3. Software Frameworks. Flock uses industry-standard software frameworks and libraries. All frameworks are regularly reviewed for security issues and amendments made as appropriate to any deployed or in-development code.

10.4. Threat and Vulnerability Management. Flock uses internal vulnerability scanning tools to identify known vulnerabilities. Flock will undergo a penetration test carried out by an independent third party on at least an annual basis.

11. HUMAN RESOURCES SECURITY.

11.1. Background Verification. Flock conducts background verification of its employees and contractors in accordance with relevant laws and regulations. Background verification checks are commensurate with an individual’s job duties and include at a minimum of identity verification and criminal history checks.

11.2. Training. All Flock employees receive regular training on security and privacy requirements to comply with Flock’s information security policies and procedures. Training is provided during employee onboarding and at least annually thereafter.

12. BUSINESS CONTINUITY.

12.1. Backup. Flock will maintain multiple snapshots of operational databases to be able to recover data. Backup restoration is restricted to Flock operations staff, authenticated by multifactor authentication. Snapshots will be encrypted to AES256 or better.

12.2. Resiliency by Design. Flock will design backend servers to be naturally resilient. Single server failures will trigger automatic recovery/failover to another server for that function.

13. AUDIT. Flock and its independent external audit firm publish a SOC 2 Type II audit report annually. Customer may view the SOC 2 report at any time via security.flocksafety.com. Upon Customer's written request, Flock will make available information reasonably necessary to demonstrate Flock's security safeguards, security measures, and compliance with this InfoSec Addendum, provided that Flock shall not be obligated to answer questions or provide information that could lead to (i) disclosure of sensitive Flock intellectual property or trade secrets; (ii) disclosure of non-public information of other Flock customers or individuals; or (iii) a material weakening of Flock's security controls. Any information provided to Customer pursuant to this Section shall be considered Flock Confidential Information.

‍