Security Addendum

Security Addendum

This Security Addendum describes the technical and organisational measures Virtik USA, Inc. applies to the Virtik platform. It supplements the Terms (LEG-001), the DPA (LEG-010), and any Master Services Agreement (LEG-011) or Order Form (LEG-012) that references it. It is deliberately short: it states only the measures that Virtik can support, and it states what Virtik does not represent. Capitalized terms not defined here have the meanings given in the Terms (LEG-001).

1. What this document does not claim

Stated first, because these are the claims a security addendum is most often read as making.

1.1 Virtik does not currently hold SOC 2 attestation, ISO 27001 certification, HIPAA compliance certification, or FedRAMP authorization, and makes no representation that it does. Where Customer's own obligations require a certification Virtik does not hold, Customer is responsible for determining whether the platform is appropriate for its use.

1.2 No third-party audit report is offered. Section 7 states the audit position.

1.3 No penetration test result is offered, and no test cadence is committed.

1.4 No insurance coverage is represented.

1.5 No service can be guaranteed secure. This Addendum describes measures; it does not warrant an outcome. Section 20 of the Terms applies.

1.6 Virtik makes no representation that the Service holds a StateRAMP authorization or complies with the FBI Criminal Justice Information Services Security Policy, that Virtik monitors the Service around the clock, that the Service meets any uptime or availability level, or that Virtik offers any hosting region or data residency commitment.

2. Control inventory

2.1 Controls stated as configured

These are the controls that the Service's implementation and configuration provide, stated as configured. They do not represent the deployed state of any particular environment. Schedule 6 of the DPA lists the same controls.

2.2 Matters not represented

Virtik makes no representation in this Addendum about: encryption at rest and key management; whether, how often and for how long backups are kept, and restoration objectives; hosting locations and regions; penetration testing cadence; personnel screening standard; security training cadence; vulnerability management and patch cadence; business continuity and disaster recovery, including recovery objectives; physical security of hosting locations; secure development lifecycle and code review; logging retention; endpoint management for personnel with production access; or key rotation. Virtik states a control only by a new version of this Addendum. Nothing in this Section 2.2 or in Section 1 limits the obligation in Section 6.1 of the DPA to take the measures that Article 32 of GDPR (or the equivalent provision of other applicable law) requires of a Processor, and this Addendum does not state that every such measure is in place.

3. Access control and personnel

3.1 Virtik makes no representation in this Addendum about how access to production systems is granted, reviewed or recorded.

3.2 Virtik's commitments about personnel confidentiality and access are in Section 5 of the DPA.

3.3 Virtik makes no representation about personnel screening or the cadence of security training.

4. Customer responsibilities

Security of the platform is shared, and this Section is not a disclaimer — it is the half of the control surface Virtik cannot reach.

4.1 Customer is responsible for:

(a) the security of Customer Systems, including cameras, sensors, access control systems, radios, mobile devices and networks;

(b) credential hygiene, including not sharing Authorized User credentials;

(c) permission configuration within its Organization, and reviewing it when people join, move or leave;

(d) enabling and requiring multi-factor authentication for its own users where the platform offers it;

(e) device management for devices that access the Service;

(f) the decision about what data enters the platform and who may see it;

(g) promptly removing access for individuals who no longer require it.

4.2 A misconfiguration by Customer that exposes Customer Data within Customer's own Organization is not a Security Incident.

5. Security incidents

5.1 Virtik will notify Customer without undue delay after Virtik confirms a Security Incident, as the Terms define that term, and for Customer Personal Data in accordance with Section 10 of the DPA. Virtik confirms a Security Incident when, acting reasonably and without delaying its investigation, it determines that the Security Incident has occurred or reasonably believes, as Section 1.17 of the Terms provides, that it has occurred.

5.2 Operational notification objective. Where reasonably practicable, Virtik's objective is to give that notice within 72 hours after it confirms the Security Incident. That period is an operational notification objective only. It is not an unconditional contractual guarantee or a warranty, and a notice given after 72 hours is not by itself a breach of the Agreement. Section 19.5 of the Terms and Section 10 of the DPA state the position.

5.3 An unsuccessful attempt, or an event that does not compromise the security of Customer Data — including pings, port scans, failed log-ins and denial-of-service attempts that do not result in access — is not a Security Incident.

5.4 Notification is not an admission of fault or liability.

5.5 Report a suspected vulnerability or incident to security@virtik.ai. Customer must not publicly disclose a suspected vulnerability before Virtik has had a reasonable opportunity to remediate.

5.6 Virtik's notice to Customer is separate from any notification that Customer must give to a regulator, to individuals or to others. Those obligations and the periods in which they must be met are determined by applicable law, run from Customer's own awareness, and are Customer's responsibility.

5.7 Virtik makes no representation about an incident-response runbook, on-call coverage, forensic capability, or the tools it uses to detect a Security Incident, and states no response time for a report made under Section 5.5.

6. Subprocessors and hosting

6.1 Virtik engages third parties to host, store, process and bill on its behalf. The Subprocessor List (LEG-009) classifies them as subprocessors, infrastructure providers, the payment processor, providers that Customer supplies, and services whose use Virtik has not verified.

6.2 The current inventory is the Subprocessor List (LEG-009).

6.3 Virtik names no hosting region.

6.4 Data residency is not offered as a commitment (DPA Section 15.4).

7. Audit and assurance

7.1 Virtik will make available information reasonably necessary to demonstrate compliance with this Addendum, primarily through this document and through responses to reasonable security questionnaires. A response to a questionnaire is information only. It is not a representation about a measure that Section 2.1 does not state, and Section 2.2 of this Addendum and Section 19.2 of the Terms continue to apply.

7.2 Audit rights concerning personal data are in Section 14 of the DPA and are not varied here.

7.3 No further audit right. Virtik grants no audit right beyond Sections 7.1 and 7.2 and the conditions in Section 14 of the DPA. No third-party report exists, and Virtik does not grant an audit of its multi-tenant infrastructure in a way that could affect other customers.

8. Changes

8.1 Virtik may update this Addendum provided the level of protection is not materially reduced.

8.2 A material reduction requires notice under the governing agreement, and where the MSA applies, Section 11.4 of the MSA may give Customer a remedy.

Language. This Addendum is drafted in English. Translations are provided for convenience. In the event of a conflict, the English version controls, except where applicable law requires otherwise.

Version history

END OF DOCUMENT