Contract analysis

1. OVERVIEW AND SCOPE 1.1 The Security Measures described in this Schedule B apply to all Personal Data processed by Processor under the Agreement, including, without limitation, Personal Data hosted on infrastructure provided by approved sub-processors, namely Osprey Cloud Infrastructure, Inc. and Skybridge Fintech Europe B.V., as further identified in Schedule C (Approved Sub-Processor List) to the Agreement. 1.2 T

2. INDEPENDENT AUDIT AND CERTIFICATION 2.1 SOC 2 Type II Report 2.1.1 Processor maintains a current System and Organization Controls 2 (SOC 2) Type II report prepared in accordance with the AICPA Trust Services Criteria and issued by an independent certified public accounting firm. 2.1.2 Processor's current SOC 2 Type II report has been issued by Graystone & Ketchum LLP, 300 Delaware Avenue, Suite 700, Wilmington, DE

3. ENCRYPTION 3.1 Encryption at Rest 3.1.1 All Personal Data stored on Processor's systems and on the infrastructure of Osprey Cloud Infrastructure, Inc. is encrypted at rest using the Advanced Encryption Standard with 256-bit keys (AES-256), or a successor cryptographic standard providing equivalent or greater protection. 3.1.2 Encryption keys are managed through a centralized key management system ("KMS") that enfo

4. ACCESS CONTROLS 4.1 Multi-Factor Authentication (MFA) 4.1.1 Multi-factor authentication is required for all administrative access to SBF Core production environments, hosting infrastructure management consoles, and any system or interface through which Personal Data may be accessed, modified, or exported. 4.1.2 MFA is required for all remote access by Processor personnel, including employees of Skybridge Fintech L

5. NETWORK SECURITY 5.1 Firewalls and Network Segmentation 5.1.1 Network firewalls are deployed at all perimeter and internal trust boundaries within Processor's infrastructure. Firewall rule sets are reviewed on at least a semi-annual basis and follow a default-deny posture, permitting only explicitly authorized traffic. 5.1.2 Production environments hosting Personal Data are logically segmented from development, st

6. PENETRATION TESTING 6.1 Processor shall engage an independent, qualified third-party firm to conduct penetration testing of the SBF Core platform and associated infrastructure at least once per calendar year. 6.2 Processor's current penetration testing firm is Ironvault Security Group LLC, 11710 Plaza America Drive, Suite 400, Reston, VA 20190. Processor may change its penetration testing firm upon reasonable writ

7. INCIDENT RESPONSE 7.1 Incident Response Plan 7.1.1 Processor maintains a documented information security incident response plan (the "IRP") that addresses the full lifecycle of incident management, including the following phases: identification, containment, eradication, recovery, and post-incident review. 7.1.2 The IRP is tested at least annually through tabletop exercises and/or simulated incident drills designe

8. EMPLOYEE SECURITY TRAINING AND PERSONNEL CONTROLS 8.1 Security Awareness Training 8.1.1 All Processor personnel receive mandatory security awareness training upon hire and at least annually thereafter. For purposes of this Section 8, "Processor personnel" includes all employees of Skybridge Fintech Ltd. (currently approximately one hundred eighty-seven (187) employees) and all employees of Skybridge Fintech Europe

9. PHYSICAL SECURITY 9.1 Data Center Physical Security (Osprey Cloud Infrastructure, Inc.) 9.1.1 Personal Data processed under the Agreement is hosted exclusively at data center facilities operated by Osprey Cloud Infrastructure, Inc., as follows: (a) Primary / US: Osprey Cloud US-East, located in Ashburn, Virginia, which serves as the primary processing facility and also provides a secondary availability zone used f

10. BUSINESS CONTINUITY AND DISASTER RECOVERY 10.1 Processor maintains a documented business continuity and disaster recovery plan ("BCP/DR Plan") that is designed to ensure the continued availability of the SBF Core platform and the protection of Personal Data in the event of a disruption, including natural disasters, infrastructure failures, cyberattacks, and other adverse events. 10.2 The disaster recovery environ

11. LOGGING, MONITORING, AND AUDIT TRAILS 11.1 Processor maintains comprehensive audit logs of access to systems containing Personal Data, including, without limitation: (a) user authentication events (successful and failed login attempts); (b) administrative actions, including account creation, modification, and deletion; (c) access to Personal Data, including read, write, copy, and export operations; and (d) data m

12. DATA SEGREGATION 12.1 Controller's Personal Data is logically segregated from the data of all other Processor clients within the SBF Core platform. Data segregation is maintained across all environments, including production, backup, and disaster recovery. 12.2 Tenant isolation is enforced at both the application layer and the database layer through a combination of dedicated tenant identifiers, schema-level sepa

13. SECURE DEVELOPMENT PRACTICES 13.1 Processor follows a secure software development lifecycle ("SDLC") for the design, development, testing, and deployment of the SBF Core platform. The SDLC is overseen by Processor's VP of Engineering, Sanjay Dhillon, and incorporates security considerations at each phase of the development process, from requirements definition through post-deployment monitoring. 13.2 Mandatory co

14. SUB-PROCESSOR SECURITY REQUIREMENTS 14.1 Processor imposes data protection and security obligations on all approved sub-processors that are materially consistent with the Security Measures set forth in this Schedule B. 14.2 The security requirements applicable to each currently approved sub-processor are as follows: (a) Osprey Cloud Infrastructure, Inc.: Subject to the Skybridge–Osprey Cloud DPA dated March 1, 20

15. INSURANCE 15.1 Processor shall maintain cyber-liability insurance coverage throughout the term of the Agreement, including any renewal or extension periods, with per-occurrence coverage of not less than ten million United States dollars ($10,000,000). 15.2 Details of Processor's current cyber-liability insurance coverage are as follows: 15.3 Processor shall provide a certificate of insurance evidencing the covera

16. UPDATES TO SECURITY MEASURES 16.1 Processor may update the Security Measures described in this Schedule B from time to time to reflect changes in technology, evolving threat landscapes, changes in applicable law or regulation, and developments in industry best practices, provided that any such update does not materially diminish the overall level of protection afforded to Personal Data processed under the Agreeme