ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Annex II to the Standard Contractual Clauses adopted pursuant to the European Commission Implementing Decision (EU) 2021/914, applicable to Module 2 (Controller-to-Processor) and Module 3 (Processor-to-Sub-processor).
Parties:
Associated Sub-processors covered under Module 3:
Key Dates and Governing Law:
This Annex II forms an integral part of the Data Processing Agreement (the "DPA") between the Controller and the Processor dated February 5, 2026, and the Standard Contractual Clauses appended thereto. Capitalized terms not otherwise defined herein shall have the meanings ascribed to them in the DPA or the Standard Contractual Clauses, as applicable.
INTRODUCTION
This Annex II sets out the technical and organisational security measures implemented by the data importer, Skybridge Fintech Ltd. (together with its affiliated sub-processors), to protect the personal data transferred under the Standard Contractual Clauses, as required by Clause 8.6(a) of Module 2 (Controller-to-Processor) and Clause 8.6(a) of Module 3 (Processor-to-Sub-processor). The measures described herein apply to all processing of personal data carried out through the SBF Core platform — Skybridge's proprietary software-as-a-service platform providing real-time payment processing, anti-fraud analytics, and regulatory reporting services to the Controller.
The measures described in this Annex II are applicable as of the execution date of the Standard Contractual Clauses (February 15, 2026) and are subject to periodic review and enhancement in accordance with evolving security threats, regulatory guidance, industry best practices, and the terms of the DPA. Skybridge reserves the right to update and improve these measures from time to time, provided that such updates do not materially diminish the overall level of protection afforded to the personal data.
All sub-processors engaged by Skybridge in connection with the processing of personal data transferred under the Standard Contractual Clauses are required to maintain technical and organisational security measures that are substantially equivalent to those described in this Annex II, pursuant to the flow-down obligations set forth in the DPA and the Module 3 Standard Contractual Clauses. Skybridge remains responsible for ensuring such sub-processor compliance through contractual obligations, periodic assessments, and audit rights as further described herein.
SECTION 1: MEASURES OF PSEUDONYMISATION AND ENCRYPTION OF PERSONAL DATA
1.1 Encryption at Rest
All personal data stored within the SBF Core platform and its underlying infrastructure is encrypted at rest using the Advanced Encryption Standard with 256-bit key length (AES-256). This encryption standard is applied uniformly across all data stores, including relational databases, object storage, file systems, and data warehousing environments used in connection with the processing of the Controller's personal data.
Encryption keys are managed through a dedicated key management service (KMS) with hardware security module (HSM) backing. The HSM infrastructure is operated by Osprey Cloud Infrastructure, Inc. and is validated to FIPS 140-2 Level 3 (or successor standard). Key management practices include the following:
(a) Encryption keys are generated, stored, and rotated within the HSM boundary and are not exportable in plaintext form.
(b) Key rotation is performed on a scheduled basis in accordance with Skybridge's cryptographic key management policy, and emergency key rotation procedures are documented and tested.
(c) Access to key management operations is restricted to a limited number of designated personnel through privileged access controls with multi-factor authentication.
(d) Separation of duties is enforced such that personnel with access to encrypted data do not have administrative access to encryption keys, and vice versa.
Encryption at rest applies to all primary data stores across the following processing locations:
(i) Osprey Cloud US-East region (Ashburn, Virginia, United States) — primary production environment;
(ii) Osprey Cloud EU region (Frankfurt, Germany) — EU data processing environment; and
(iii) Disaster recovery environments within the Osprey Cloud US-East secondary availability zone (Ashburn, Virginia, United States).
Backup copies of personal data are also encrypted at rest using AES-256 encryption, as further described in Section 3.1 below.
1.2 Encryption in Transit
All personal data transmitted between the Controller's systems and the SBF Core platform, between internal SBF Core components, and between Skybridge and its sub-processors is encrypted in transit using Transport Layer Security (TLS) version 1.2 or higher. This requirement applies to all communication channels, including but not limited to API calls, web interface access, inter-service communications, and administrative access sessions.
Deprecated and insecure encryption protocols — including Secure Sockets Layer (SSL) in all versions, TLS 1.0, and TLS 1.1 — are disabled on all production systems. Cipher suite configurations are maintained in accordance with current industry best practices and are periodically reviewed to ensure that only strong cipher suites are enabled.
Skybridge maintains certificate management and rotation procedures that include the following:
(a) TLS certificates are issued by trusted, publicly recognized Certificate Authorities (CAs).
(b) Certificate expiration is monitored through automated alerting, and certificates are renewed in advance of expiration.
(c) Certificate pinning is implemented where technically appropriate for critical service-to-service communications.
(d) Procedures for emergency certificate revocation and replacement are documented and tested.
1.3 Pseudonymisation. Where technically feasible and appropriate given the nature and purpose of the processing, personal data is pseudonymised within SBF Core processing pipelines to reduce the risk associated with unauthorized access or disclosure. Pseudonymisation measures include the following:
(a) Tokenization of sensitive identifiers. Account numbers, Social Security Numbers (SSNs), and Taxpayer Identification Numbers (TINs) are tokenized within the anti-fraud analytics modules of SBF Core. Tokenization replaces the original sensitive data element with a non-reversible or separately reversible surrogate value (token) that retains the referential integrity needed for analytic processing without exposing the underlying data.
(b) Separation of mapping tables. Mapping tables that associate pseudonymised identifiers (tokens) with the original personal data values are stored separately from the pseudonymised data sets. Access to these mapping tables is restricted through dedicated access controls that are independent of and more restrictive than the access controls applicable to the pseudonymised data.
(c) Application-level pseudonymisation. Additional pseudonymisation techniques, such as hashing with salting, are applied at the application level within specific processing workflows where the processing purpose can be achieved without reference to directly identifying data.
The specific pseudonymisation techniques applied to each category of personal data are documented in Skybridge's internal data classification and handling procedures and are subject to periodic review as part of the ongoing security assessment process described in Section 4 below.
SECTION 2: MEASURES FOR ENSURING ONGOING CONFIDENTIALITY, INTEGRITY, AVAILABILITY AND RESILIENCE OF PROCESSING SYSTEMS AND SERVICES
2.1 Confidentiality. Skybridge implements the following measures to ensure the ongoing confidentiality of personal data processed through the SBF Core platform:
(a) Role-based access control (RBAC). Access to the SBF Core platform, its underlying infrastructure, and all personal data processed therein is governed by a role-based access control framework. Each user account is assigned one or more predefined roles, and each role carries a specific, limited set of permissions aligned with the user's job function and operational responsibilities.
(b) Principle of least privilege. The principle of least privilege is applied to all user accounts across the organization, including administrative accounts, developer accounts, operations personnel, and customer support personnel. Users are granted only the minimum level of access necessary to perform their assigned duties, and elevated or temporary access is subject to additional approval and monitoring.
(c) Confidentiality obligations. All Skybridge employees and contractors who have or may have access to personal data are required to execute written non-disclosure agreements and are bound by contractual confidentiality obligations. These obligations survive the termination of the employment or contractor relationship.
(d) Personnel scope. As of the execution date, Skybridge Fintech Ltd. employs approximately one hundred eighty-seven (187) staff members across its Wilmington headquarters and other offices. Skybridge Fintech Europe B.V. employs fourteen (14) staff members, comprising eight (8) engineers, four (4) support personnel, and two (2) compliance personnel. All personnel across both entities who have access to personal data are subject to the confidentiality obligations described herein.
(e) Background checks. Background verification checks are conducted for all personnel prior to granting access to systems containing personal data, to the extent permitted by applicable law.
2.2 Integrity. Skybridge implements the following measures to ensure the ongoing integrity of personal data processed through the SBF Core platform:
(a) Data validation at ingestion. Automated data validation controls are applied at all ingestion points for transaction data received from the Controller. These controls verify the completeness, accuracy, format compliance, and referential integrity of incoming data. The SBF Core platform is designed to process approximately 18.6 million transactions per month for the Controller based on current volume projections, and the validation controls are scaled accordingly.
(b) Comprehensive audit logging. All create, read, update, and delete (CRUD) operations performed on personal data within the SBF Core platform are recorded in comprehensive audit logs. These logs capture the identity of the user or system process performing the operation, the timestamp, the nature of the operation, and the data elements affected. Audit logs are protected against unauthorized modification or deletion, as further described in Section 9 below.
(c) Change management. All changes to production code, configurations, and infrastructure are subject to formal change management procedures. These procedures require documented change requests, peer review and approval by at least one additional authorized reviewer, testing in non-production environments prior to deployment, and rollback plans in the event of adverse effects.
(d) Database integrity controls. Database integrity checks, including checksums and consistency verification, are performed on a regular basis to detect and address any data corruption or unauthorized modification.
2.3 Availability. Skybridge implements the following measures to ensure the ongoing availability of the SBF Core platform and the personal data processed therein:
(a) High-availability architecture. The SBF Core platform is hosted on Osprey Cloud Infrastructure, Inc. in the US-East region (Ashburn, Virginia), utilizing a high-availability architecture deployed across multiple availability zones. This architecture is designed to ensure continued service availability in the event of a failure affecting any single availability zone.
(b) EU processing environment. Personal data of EU data subjects is processed through the Osprey Cloud EU region (Frankfurt, Germany) and through Skybridge Fintech Europe B.V. (Amsterdam, Netherlands), each of which maintains comparable high-availability configurations.
(c) Service level targets. Availability targets for the SBF Core platform are consistent with those set forth in the SaaS subscription agreement between the Controller and Skybridge. The current target is 99.9% uptime, measured on a monthly basis, excluding scheduled maintenance windows.
(d) Monitoring and alerting. Real-time monitoring of system health, performance metrics, and service availability is maintained through automated monitoring tools. Automated alerts are triggered for any service degradation or outage, enabling rapid response by Skybridge's operations team.
2.4 Resilience. Skybridge implements the following measures to ensure the resilience of the SBF Core platform and related processing systems:
(a) Auto-scaling infrastructure. The SBF Core platform is deployed on auto-scaling infrastructure that dynamically adjusts computing resources in response to changes in transaction volume and processing demand. This capability ensures that peak transaction loads — including end-of-month, end-of-quarter, and seasonal volume surges — are accommodated without performance degradation.
(b) Distributed architecture. The SBF Core platform utilizes a distributed microservices architecture designed to tolerate individual component failures without interruption to the overall service. Redundancy is built into critical processing paths, and failover mechanisms are configured to redirect processing to healthy components automatically.
(c) Capacity planning. Regular capacity planning reviews are conducted by Skybridge's VP of Engineering, Sanjay Dhillon, and the infrastructure team to ensure that processing capacity remains adequate for current and projected transaction volumes. Capacity planning reviews take into account the Controller's growth projections, seasonal patterns, and infrastructure lead times.
SECTION 3: MEASURES FOR ENSURING THE ABILITY TO RESTORE THE AVAILABILITY AND ACCESS TO PERSONAL DATA IN A TIMELY MANNER IN THE EVENT OF A PHYSICAL OR TECHNICAL INCIDENT
3.1 Backup Procedures
Skybridge implements the following backup procedures to protect against data loss and to support timely restoration of personal data:
(a) Automated daily backups. Automated backups of all personal data stores within the SBF Core platform are performed on a daily basis. Backup schedules are configured to minimize the risk of data loss while avoiding adverse impacts on production system performance.
(b) Encryption of backups. All backup copies are encrypted using AES-256 encryption, consistent with the encryption-at-rest measures described in Section 1.1 above. Encryption keys for backup data are managed through the same HSM-backed key management service used for production data.
(c) Geographic separation. Backup copies are stored in geographically separated facilities from the primary production environment to protect against regional events affecting data availability. Backup storage locations are within the Osprey Cloud Infrastructure footprint and are subject to the same physical and logical security controls applicable to primary data stores.
(d) Retention alignment. Backup retention periods are aligned with the data retention period specified in the DPA — specifically, the duration of the SaaS subscription agreement plus ninety (90) days following termination, to support the Controller's data return or deletion requirements.
(e) Backup integrity verification. Backup integrity is verified through automated checksum validation and periodic test restoration exercises to confirm that backup data can be successfully restored.
3.2 Disaster Recovery
Skybridge maintains a disaster recovery capability designed to restore the availability of and access to personal data in a timely manner following a physical or technical incident:
(a) Disaster recovery site. The designated disaster recovery site is the Osprey Cloud US-East secondary availability zone located in Ashburn, Virginia. This site is capable of assuming full production processing in the event that the primary production environment becomes unavailable.
(b) Recovery objectives. Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets are defined in the disaster recovery plan and are consistent with the service level commitments set forth in the SaaS subscription agreement. These targets are reviewed and validated through periodic disaster recovery testing.
(c) Disaster recovery testing. The disaster recovery plan is tested at least annually through a combination of tabletop exercises and technical failover tests. Test results are documented, and any identified deficiencies are remediated in a timely manner.
(d) Plan maintenance. The disaster recovery plan is maintained as a living document and is reviewed and updated at least annually, or more frequently in response to material changes in the processing environment, infrastructure, or threat landscape.
3.3 Business Continuity
Skybridge maintains a business continuity program designed to ensure the continued operation of critical processing functions in the event of a disruption:
(a) Business continuity plan. A comprehensive business continuity plan is maintained by CISO Rebecca Muñoz in coordination with Osprey Cloud Infrastructure, Inc. and other relevant stakeholders. The plan addresses scenarios including data center outages, network disruptions, key personnel unavailability, pandemic events, and supply chain disruptions.
(b) Annual exercises. Annual business continuity tabletop exercises are conducted with participation from key Skybridge personnel and, where appropriate, representatives of Osprey Cloud Infrastructure, Inc. Exercise results are documented and inform subsequent plan updates.
(c) Regulatory alignment. The business continuity program is designed to be consistent with the requirements of OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance) applicable to critical third-party service providers to federally regulated financial institutions, including the Controller.
SECTION 4: PROCESSES FOR REGULARLY TESTING, ASSESSING AND EVALUATING THE EFFECTIVENESS OF TECHNICAL AND ORGANISATIONAL MEASURES
4.1 Independent SOC 2 Type II Audit
Skybridge maintains a current Service Organization Controls 2 (SOC 2) Type II report as the primary independent assurance mechanism for the effectiveness of its technical and organisational security measures:
(a) Audit firm. The SOC 2 Type II audit is conducted by Graystone & Ketchum LLP, an independent certified public accounting firm located at 300 Delaware Avenue, Suite 700, Wilmington, DE 19801. The lead audit partner is Sandra Clearfield.
(b) Most recent report. The most recent SOC 2 Type II report is dated September 15, 2025, and covers the audit period from October 1, 2024 through September 15, 2025. The report addresses the Trust Services Criteria for Security, Availability, Processing Integrity, and Confidentiality.
(c) Annual audit cycle. Skybridge maintains an annual SOC 2 Type II audit cycle. Each successive report is expected to cover a twelve-month audit period.
(d) Availability to Controller. The current SOC 2 Type II report is made available to the Controller upon written request as the primary audit mechanism under the DPA. Provision of the SOC 2 Type II report is subject to the confidentiality obligations set forth in the DPA and any applicable non-disclosure requirements of the audit firm.
4.2 Penetration Testing
Skybridge engages an independent third-party security firm to conduct annual penetration testing of the SBF Core platform and supporting infrastructure:
(a) Testing firm. Penetration testing is conducted by Ironvault Security Group LLC, located at 11710 Plaza America Drive, Suite 400, Reston, VA 20190.
(b) Testing scope. The scope of annual penetration testing includes: (i) external network penetration testing; (ii) internal network penetration testing; (iii) application-level testing of the SBF Core platform, including API security testing and authentication/authorization testing; and (iv) social engineering assessments, including phishing simulations.
(c) Remediation. Findings identified through penetration testing are remediated in accordance with Skybridge's risk-based prioritization framework. Critical and high-severity findings are remediated on an expedited basis, and verification testing is conducted to confirm the effectiveness of remediation actions.
(d) Summary reports. Executive summary reports of penetration testing results, including the scope, methodology, findings summary, and remediation status, are made available to the Controller upon written request, subject to the confidentiality obligations set forth in the DPA.
4.3 Vulnerability Management
Skybridge maintains a comprehensive vulnerability management program that includes the following elements:
(a) Continuous vulnerability scanning. Automated vulnerability scanning of production environments is conducted on a continuous or near-continuous basis using industry-standard vulnerability scanning tools. Scans cover operating systems, middleware, application components, and network infrastructure.
(b) Patch management. A formal patch management policy is in place requiring that critical vulnerabilities be patched within defined service-level timelines based on severity. The patch management process includes testing of patches in non-production environments prior to deployment, except where the severity and active exploitation of a vulnerability warrant emergency patching procedures.
(c) Threat intelligence. Skybridge monitors threat intelligence sources, including vendor security advisories, industry information-sharing organizations (ISACs), and government cybersecurity agencies (e.g., CISA), to identify emerging threats and vulnerabilities relevant to the SBF Core platform and supporting infrastructure. Threat intelligence is integrated into vulnerability prioritization and incident response processes.
4.4 Internal Audits and Risk Assessments
In addition to the independent assurance mechanisms described above, Skybridge conducts internal security assessments and risk evaluations:
(a) Internal security assessments. Periodic internal security assessments are conducted under the direction of CISO Rebecca Muñoz and the Skybridge security team. These assessments evaluate the effectiveness of technical and organisational security measures, identify areas for improvement, and track the implementation of remediation actions.
(b) Annual risk assessments. Skybridge conducts formal risk assessments at least annually to evaluate threats to the confidentiality, integrity, and availability of personal data processed through the SBF Core platform. Risk assessments consider internal and external threat actors, emerging attack techniques, regulatory developments, and changes to the processing environment.
(c) Management reporting. Findings from internal security assessments and risk evaluations are reported to General Counsel and Chief Privacy Officer Thomas Elridge and to senior management. Material findings that may affect the security of the Controller's personal data are communicated to the Controller in accordance with the notification and reporting obligations set forth in the DPA.
SECTION 5: MEASURES FOR USER IDENTIFICATION AND AUTHORISATION
5.1 Authentication. Skybridge implements the following authentication measures to verify the identity of users accessing systems that process personal data:
(a) Multi-factor authentication (MFA). Multi-factor authentication is required for all administrative access to SBF Core systems, infrastructure management consoles, production environments, and any system or application that provides access to personal data. MFA implementations utilize a combination of knowledge factors (e.g., passwords) and possession factors (e.g., hardware tokens, authenticator applications, or push notifications).
(b) Strong password policies. Strong password policies are enforced across all Skybridge systems, including minimum password length requirements, complexity requirements (uppercase, lowercase, numeric, and special characters), prohibition of commonly used or previously compromised passwords, and mandatory periodic rotation of passwords.
(c) Single sign-on (SSO). Single sign-on (SSO) integration is available for Controller-facing portal access, enabling the Controller to leverage its own identity provider and authentication policies for user access to the SBF Core portal. SSO integration is implemented using industry-standard protocols (e.g., SAML 2.0, OpenID Connect).
(d) Session management. Automatic session timeout and re-authentication requirements are enforced for idle sessions. Session tokens are managed securely and are invalidated upon logout or timeout.
5.2 Authorization. Skybridge implements the following authorization measures to ensure that authenticated users access only the personal data and system functions necessary for their assigned role:
(a) Role-based access control (RBAC). A granular role-based access control framework is implemented across all SBF Core components and supporting systems. Permission sets are defined for each role and are reviewed periodically to ensure alignment with current job functions and operational requirements.
(b) Segregation of duties. Segregation of duties is enforced between development, operations, and security functions. No single individual has the ability to unilaterally develop, deploy, and administer production systems without independent review and approval.
(c) Privileged access management (PAM). Administrative and root-level accounts are managed through a privileged access management system that provides just-in-time access provisioning, session recording, and enhanced monitoring for all privileged sessions. Standing privileged access is minimized, and privileged sessions are logged and subject to periodic review.
(d) Lifecycle management. Access provisioning and de-provisioning are integrated with Skybridge's human resources onboarding and offboarding processes. New user accounts are provisioned based on documented role assignments with appropriate approvals. Access rights are promptly adjusted upon changes in job function and are revoked upon personnel termination.
5.3 Access Reviews
Skybridge conducts regular access reviews to verify that access to personal data remains appropriate and consistent with the principle of least privilege:
(a) Quarterly access reviews. Comprehensive reviews of all user accounts with access to systems containing personal data are conducted on a quarterly basis. Reviews are performed by system owners or designated managers and are documented for audit purposes.
(b) Immediate revocation. Access to all systems containing personal data is immediately revoked upon personnel termination. In cases of involuntary termination, access revocation is coordinated with human resources and is executed concurrently with or prior to notification of the affected individual. Access is also promptly adjusted upon role changes that no longer require access to personal data.
(c) Orphaned account detection. Automated monitoring is in place to detect and flag orphaned or dormant accounts that may represent unauthorized access risks.
SECTION 6: MEASURES FOR THE PROTECTION OF DATA DURING TRANSMISSION
Skybridge implements the following measures to protect personal data during transmission:
(a) Encryption in transit. All personal data transmitted between the Controller's systems and the SBF Core platform, between SBF Core internal components, and between Skybridge and its sub-processors is encrypted using TLS 1.2 or higher, as detailed in Section 1.2 above.
(b) Secure API endpoints. All data exchanges between the Controller's systems and SBF Core are conducted through secure, authenticated API endpoints. API authentication utilizes industry-standard mechanisms (e.g., OAuth 2.0, API keys with HMAC signing) to verify the identity and authorization of the calling system.
(c) Data integrity verification. Checksums and cryptographic hashes are applied to transmitted data to enable verification of data integrity upon receipt. Any data integrity failures trigger automated error handling and alerting procedures.
(d) Secure file transfer. To the extent that any batch data exchanges occur between the Controller and Skybridge (e.g., bulk data imports or exports), such transfers are conducted using secure file transfer protocols (e.g., SFTP, SCP) with encryption and authentication controls.
(e) Network segmentation. Production environments are logically segmented from development, testing, and staging environments through network controls, including firewalls, virtual private clouds, and access control lists. This segmentation ensures that personal data in production environments is isolated from non-production environments where lesser security controls may apply.
SECTION 7: MEASURES FOR THE PROTECTION OF DATA DURING STORAGE
Skybridge implements the following measures to protect personal data during storage:
(a) Encryption at rest. All personal data at rest is encrypted using AES-256 encryption, as detailed in Section 1.1 above.
(b) Enhanced controls for sensitive data categories. Certain categories of personal data — including Social Security Numbers (SSNs), Taxpayer Identification Numbers (TINs), and behavioral biometric data — are subject to additional access controls and enhanced monitoring beyond the baseline controls applicable to all personal data. Access to these data categories is restricted to a more limited set of authorized personnel and is subject to additional logging and alerting.
(c) Database access restrictions. Access to databases containing personal data is restricted to authorized application services (via service accounts with limited permissions) and a small number of designated database administrators. Direct database access by human users is minimized, monitored, and subject to privileged access management controls.
(d) Media sanitization. Decommissioned storage devices (including hard drives, solid-state drives, and any other media that may have contained personal data) are sanitized in accordance with industry standards, specifically the National Institute of Standards and Technology Special Publication 800-88, Guidelines for Media Sanitization (NIST SP 800-88), or successor guidance. Sanitization methods are selected based on the media type and sensitivity classification, and sanitization is documented and verified.
SECTION 8: MEASURES FOR ENSURING PHYSICAL SECURITY OF LOCATIONS AT WHICH PERSONAL DATA ARE PROCESSED
8.1 Data Center Physical Security (Osprey Cloud Infrastructure, Inc.)
Personal data processed through the SBF Core platform is hosted in data center facilities operated by Osprey Cloud Infrastructure, Inc. at the following locations:
Physical security measures maintained by Osprey Cloud Infrastructure, Inc. at these data center facilities include, but are not limited to, the following:
(a) Twenty-four-hour, seven-days-a-week (24/7) on-site security staffing by trained security personnel.
(b) Biometric access controls (e.g., fingerprint or iris scanning) for entry to secure areas within the data center, in addition to badge-based access controls for general facility entry.
(c) Closed-circuit television (CCTV) surveillance with continuous recording at all entry and exit points, common areas, and critical infrastructure areas, with recordings retained for a minimum period consistent with applicable regulatory and contractual requirements.
(d) Mantrap (airlock) entry systems at critical access points, requiring sequential authentication to prevent tailgating and unauthorized entry.
(e) Environmental controls including fire detection and suppression systems (pre-action dry-pipe or clean-agent systems), climate control (temperature and humidity regulation), and water detection systems.
(f) Visitor management procedures including government-issued identification verification, visitor logging, and escort requirements for all visitors within secure areas.
Osprey Cloud's physical security controls are covered under Osprey Cloud's own SOC 2 Type II report and are subject to the flow-down obligations set forth in the Data Processing Agreement between Skybridge Fintech Ltd. and Osprey Cloud Infrastructure, Inc. dated March 1, 2024 (the "Skybridge–Osprey Cloud DPA").
8.2 Office Physical Security (Skybridge)
Skybridge maintains physical security measures at its office locations where personnel access systems containing personal data:
(a) Skybridge headquarters (4100 Silverside Road, Suite 310, Wilmington, DE 19810): The headquarters office is a secured office space with access card entry systems, visitor sign-in and escort procedures, and a clean desk policy requiring that sensitive materials be secured when not in active use and at the end of each business day.
(b) Skybridge Fintech Europe B.V. (Keizersgracht 482, 1017 EG Amsterdam, Netherlands): The Amsterdam office maintains comparable physical security controls, including access card entry, visitor management procedures, and clean desk policies.
(c) No local data processing. Personal data is not processed on or stored on local workstations at any Skybridge office location. All access to personal data by Skybridge personnel is conducted through secured virtual desktop infrastructure (VDI) or browser-based interfaces, ensuring that personal data remains within the secured processing environment at all times.
SECTION 9: MEASURES FOR ENSURING EVENTS LOGGING
Skybridge implements the following measures to ensure comprehensive events logging across all systems involved in the processing of personal data:
(a) Centralized logging. All access to and actions on personal data within the SBF Core platform and supporting infrastructure are logged through a centralized logging system. Log events include user authentication events (successful and failed), authorization events, CRUD operations on personal data, administrative actions, configuration changes, and security-relevant system events.
(b) Security information and event management (SIEM). Log data from all relevant systems is aggregated into a security information and event management (SIEM) platform. The SIEM provides real-time correlation, analysis, and alerting capabilities, enabling the security team to detect and respond to potential security incidents in a timely manner.
(c) Log retention. Logs are retained for a minimum period consistent with applicable regulatory requirements, industry best practices, and the requirements of the DPA. Log retention periods are defined in Skybridge's data retention policy and are subject to periodic review.
(d) Log integrity. Log integrity is protected through append-only storage mechanisms and tamper-detection controls. Logs cannot be modified or deleted by standard user accounts, and any attempt to alter log data triggers automated alerting.
(e) Automated alerting. Automated alerting rules are configured within the SIEM to detect anomalous access patterns, potential unauthorized access, unusual data access volumes, and other indicators of potential security incidents. Alerts are triaged by the security operations team and escalated in accordance with Skybridge's incident response procedures.
SECTION 10: MEASURES FOR ENSURING SYSTEM CONFIGURATION, INCLUDING DEFAULT CONFIGURATION
Skybridge implements the following measures to ensure secure system configuration across all systems involved in the processing of personal data:
(a) Hardened configurations. All systems are configured in accordance with hardened baseline configurations based on industry-recognized benchmarks, including the Center for Internet Security (CIS) Benchmarks applicable to the relevant operating systems, databases, and application platforms. Hardening procedures include the removal or disabling of unnecessary services, ports, and protocols.
(b) Default credential elimination. Default credentials (including default usernames and passwords shipped with software and hardware) are changed or disabled on all systems prior to deployment in production environments. Automated scanning is conducted to detect the presence of default credentials.
(c) Configuration management. Configuration management tools are used to enforce and continuously monitor baseline configurations across the production environment. Deviations from approved baseline configurations are automatically detected, reported, and remediated.
(d) Change management. All configuration changes to production systems are subject to formal change management procedures requiring: (i) documented change requests with a description of the change, its purpose, and its potential impact; (ii) approval by an authorized approver; (iii) testing in a non-production environment prior to deployment; and (iv) documented rollback plans to restore the prior configuration in the event of adverse effects.
SECTION 11: MEASURES FOR INTERNAL IT AND IT SECURITY GOVERNANCE AND MANAGEMENT
Skybridge maintains a comprehensive information security governance framework that includes the following elements:
(a) Security leadership. Skybridge's information security program is overseen by Chief Information Security Officer (CISO) Rebecca Muñoz. The CISO reports to General Counsel and Chief Privacy Officer Thomas Elridge, ensuring that security and privacy functions are aligned and that security matters receive appropriate visibility at the senior management level.
(b) Information security policies. Skybridge maintains a suite of information security policies covering, among other topics, data classification and handling, access control, encryption, incident response, acceptable use, remote work, mobile device management, and vendor security management. These policies are reviewed and updated at least annually, or more frequently in response to material changes in the threat landscape, regulatory requirements, or the processing environment.
(c) Security awareness training. Security awareness training is required for all Skybridge employees upon hire and on an annual basis thereafter. Training covers topics including phishing awareness, social engineering, password security, data handling practices, incident reporting, and applicable regulatory requirements. Completion of training is tracked and documented, and non-compliance is escalated through management channels.
(d) Dedicated security team. Skybridge maintains a dedicated security team within its 187-person organization. The security team is responsible for the implementation and operation of technical security controls, security monitoring and incident response, vulnerability management, security assessment activities, and security policy development and maintenance.
(e) Board-level visibility. Skybridge's private equity sponsor, Halcyon Ridge Capital Partners, LP, which holds a 34.2% equity interest in Skybridge Fintech Ltd., maintains a board observer, Catherine Shin, who receives periodic updates on Skybridge's security posture, including summaries of audit findings, incident reports, and risk assessment outcomes. This governance structure provides an additional layer of oversight and accountability for information security matters.
SECTION 12: MEASURES FOR CERTIFICATION/ASSURANCE OF PROCESSES AND PRODUCTS
Skybridge maintains the following certifications and independent assurance mechanisms:
(a) SOC 2 Type II certification. Skybridge maintains a current SOC 2 Type II report, as described in Section 4.1 above. The most recent report was issued by Graystone & Ketchum LLP and covers the audit period from October 1, 2024 through September 15, 2025.
(b) EU-U.S. Data Privacy Framework self-certification. Skybridge maintains an active self-certification under the EU-U.S. Data Privacy Framework (DPF). The certification is registered under Certification ID: DPF-2025-03912 and was certified as of July 1, 2025. The DPF self-certification is maintained in accordance with the requirements of the U.S. Department of Commerce and includes the applicable commitments regarding data protection principles, individual rights, recourse mechanisms, and enforcement.
(c) Annual penetration testing. Annual penetration testing by Ironvault Security Group LLC is conducted as described in Section 4.2 above.
(d) Commitment to maintain certifications. Skybridge commits to maintaining these certifications and independent assurance activities throughout the term of the DPA. In the event that any certification lapses, is revoked, or is not renewed, Skybridge will promptly notify the Controller and will implement alternative assurance measures acceptable to the Controller.
SECTION 13: MEASURES FOR ENSURING DATA MINIMISATION
Skybridge implements the following measures to ensure that the collection and processing of personal data is limited to what is necessary for the specified processing purposes:
(a) Limitation to specified data categories. The categories of personal data collected and processed through the SBF Core platform are limited to those specified in Schedule A to the DPA and Annex I to the Standard Contractual Clauses. These categories include: full name, date of birth, Social Security Number (SSN), Taxpayer Identification Number (TIN), account numbers, routing numbers, transaction data, IP addresses, device identifiers, geolocation data, email addresses, telephone numbers, and behavioral biometric data.
(b) Purpose limitation. Processing of personal data is strictly limited to the purposes specified in the DPA: payment processing, anti-fraud analytics, and regulatory reporting through the SBF Core platform. Personal data is not processed for any other purpose without the Controller's prior written instruction or authorization.
(c) Data retention limitation. Data retention is limited to the duration of the SaaS subscription agreement plus ninety (90) days following termination for data return or deletion, except as otherwise required by applicable law or regulation. This retention limitation is further described in Section 15 below.
(d) Data mapping exercises. Periodic data mapping exercises are conducted to identify and document all categories of personal data collected, processed, and stored within the SBF Core platform and supporting systems. These exercises are designed to detect and remediate any instances of unnecessary data collection, retention beyond defined periods, or processing beyond specified purposes.
SECTION 14: MEASURES FOR ENSURING DATA QUALITY
Skybridge implements the following measures to ensure the accuracy and quality of personal data processed through the SBF Core platform:
(a) Automated data validation at ingestion. Automated validation controls are applied to incoming data at the point of ingestion to verify completeness, accuracy, and format compliance. Validation rules are configured based on the data schemas and business rules specified by the Controller and are updated as needed to reflect changes in data formats or requirements.
(b) Error handling and exception reporting. Data quality issues detected during processing — including missing required fields, format errors, referential integrity violations, and duplicate records — are handled through automated exception reporting mechanisms. Exception reports are generated and made available to the Controller through the SBF Core portal or through designated notification channels, enabling the Controller to investigate and address data quality issues at the source.
(c) Cooperation with rectification requests. Skybridge cooperates with the Controller in responding to data subject requests for rectification of inaccurate personal data, in accordance with the obligations set forth in the DPA and applicable data protection laws. Skybridge implements corrections to personal data within the SBF Core platform promptly upon receipt of documented instructions from the Controller.
SECTION 15: MEASURES FOR ENSURING LIMITED DATA RETENTION
Skybridge implements the following measures to ensure that personal data is not retained longer than necessary for the specified processing purposes:
(a) Defined retention period. The retention period for personal data processed through the SBF Core platform is the duration of the SaaS subscription agreement between the Controller and Skybridge, plus ninety (90) days following termination of such agreement, to allow for the orderly return or deletion of personal data as specified in the DPA.
(b) Automated deletion procedures. Upon expiration of the applicable retention period, automated deletion procedures are triggered to securely delete or destroy personal data from all primary data stores, backup media, and any other systems or environments where personal data may be stored. Automated deletion is subject to any applicable legal hold or regulatory retention requirements that may override the standard retention period.
(c) Secure deletion/destruction methods. Deletion and destruction of personal data is carried out using methods consistent with the National Institute of Standards and Technology Special Publication 800-88, Guidelines for Media Sanitization (NIST SP 800-88), or successor guidance. The method of sanitization (e.g., cryptographic erasure, overwriting, physical destruction) is selected based on the media type and the sensitivity of the data.
(d) Deletion confirmation. Upon completion of the deletion process and upon the Controller's written request, Skybridge will provide the Controller with written confirmation that all personal data has been securely deleted or destroyed in accordance with the DPA, except to the extent that retention is required by applicable law.
SECTION 16: MEASURES FOR ENSURING ACCOUNTABILITY
Skybridge implements the following measures to demonstrate accountability for the processing of personal data:
(a) Contractual framework. A comprehensive Data Processing Agreement (DPA) and Standard Contractual Clauses are in place governing all processing of Controller personal data by Skybridge. The DPA establishes the scope, nature, and purposes of processing, the obligations and rights of the parties, and the technical and organisational security measures applicable to the processing.
(b) Records of processing activities. Skybridge maintains records of processing activities pursuant to Article 30 of the General Data Protection Regulation (GDPR) for all processing of personal data of EU data subjects. These records document the categories of processing activities performed on behalf of the Controller, the categories of personal data processed, any transfers of personal data to third countries, and the technical and organisational security measures in place.
(c) DPIA cooperation. Skybridge provides cooperation to the Controller in connection with Data Protection Impact Assessments (DPIAs) at the Controller's reasonable request, as set forth in the DPA. Such cooperation includes providing information about Skybridge's processing operations, technical and organisational measures, and any other information reasonably necessary for the Controller to conduct its DPIA.
(d) Sub-processor oversight. Skybridge manages its sub-processors in accordance with the following framework:
(i) General written authorization from the Controller for the engagement of sub-processors, subject to Skybridge providing at least thirty (30) days' prior written notice to the Controller before engaging any new sub-processor or replacing an existing sub-processor.
(ii) The Controller retains the right to object to any proposed new sub-processor in accordance with the objection mechanism set forth in the DPA.
(iii) Flow-down of substantially equivalent data protection obligations — including the technical and organisational security measures described in this Annex II — to all sub-processors through binding written agreements.
(e) Approved sub-processor list. The current approved sub-processor list (as set forth in Annex III to the Standard Contractual Clauses) comprises: (1) Osprey Cloud Infrastructure, Inc. (2200 Campus Drive, San Jose, CA 95131); and (2) Skybridge Fintech Europe B.V. (Keizersgracht 482, 1017 EG Amsterdam, Netherlands, KvK 82104593).
(f) Sub-processor DPA. An existing Data Processing Agreement between Skybridge Fintech Ltd. and Osprey Cloud Infrastructure, Inc. dated March 1, 2024 is in place, incorporating Module 3 (Processor-to-Sub-processor) Standard Contractual Clauses and substantially equivalent technical and organisational security measures.