This Security Addendum is incorporated into and forms part of your Terms of Service (the "Agreement") with HRMXGO Inc. ("HRMXGO"). Any capitalized terms used but not defined in this Security Addendum have the meaning set forth in the Terms.
The Service includes the LockDocOS Platform. The computing services utilized to offer the Service are cloud-based and provided to HRMXGO via one or more cloud service providers and represent our "Cloud Environment."
1. HOSTING LOCATION OF CUSTOMER DATA.
1.1. General Storage and Processing Location.
(a) Customer Data (including Document Data, Inputs and Outputs, as defined in the Terms) will be stored and processed by HRMXGO and its authorized data subprocessors (listed at https://lockdocos.com/legal/subprocessors) in data centers located in the geographic region specified on Your currently operative Order or as otherwise agreed in writing, which by default is the United States.
(b) For clarity, and notwithstanding Section 1.1(a), all processing of Customer Data by Third Party LLMs via the LockDocOS Platform (the HRMXGO AI Platform, part of the Service) occurs in the United States in accordance with ToS Section 4.1(b)(ii)-(iii) and DPA Section 12.1.
The Cloud Environment utilized to offer the Service is provided to HRMXGO via one or more cloud service providers as described in the Preamble.
1.2. Request for Specific Geographic Region.
You may request to have Your Customer Data stored in a separate specific geographic region. HRMXGO will use commercially reasonable efforts to do so where supported by our underlying cloud service provider(s), where supported by our Third Party LLM providers for zero data retention configurations as described at https://lockdocos.com/legal/data-security, and where otherwise in compliance with applicable laws and regulations.
Any such regional request that would require HRMXGO to enable an optional feature of a Third Party LLM that causes Inputs to be stored (such as asynchronous or queued inference) or that would move AI inference outside the United States is subject to ToS Section 4.1(b)(iii) — such feature will remain disabled by default and may only be enabled by Your Administrator with the retention and location consequence disclosed in the Documentation.
2. ENCRYPTION.
2.1. Encryption in Transit and at Rest.
HRMXGO encrypts Customer Data (including Document Data, Inputs and Outputs as defined in the Agreement) at-rest using AES 256-bit (or better) encryption. HRMXGO uses Transport Layer Security (TLS) 1.2 (or better) for Customer Data in-transit over public or untrusted networks, consistent with ToS Section 4.1(b)(i) and DPA Annex II(1).
This applies to Customer Data as stored and processed by the Service, including the LockDocOS Platform, within the Cloud Environment.
2.2. Key Management and Rotation.
HRMXGO rotates encryption keys at least annually. A copy of critical encryption keys is safeguarded in a digital vault and in physical hardware security modules (HSMs). HRMXGO logically separates encryption keys from Customer Data.
3. SYSTEM AND NETWORK SECURITY.
3.1. HRMXGO personnel access to our Cloud Environment is provisioned with a unique user ID and is consistent with the principle of least privilege. Access requires a secure connection, multi-factor authentication, and passwords meeting NIST SP 800‑63 Rev 4 guidelines complexity requirements.
3.2. HRMXGO personnel will not access Customer Data except (i) to provide or support the Service, including the LockDocOS Platform, or (ii) to comply with the law or a binding order of a governmental body.
3.3. Our Cloud Environment leverages industry-standard threat detection tools with daily signature updates. HRMXGO does not have an obligation to monitor Customer Data or Input for Malicious Code.
4. ADMINISTRATIVE CONTROLS.
4.1. HRMXGO maintains security awareness and training programs for its personnel including at time of on-boarding and at least annually thereafter. Such security awareness training includes the following topics: (i) individual responsibilities in terms of information security and data privacy, (ii) understanding of our IT security policies and standards, and (iii) requirements for maintaining the security of their devices, credentials, and accounts.
4.2. HRMXGO trains all software developers on secure development practices appropriate to their role at least annually. Training content is adjusted depending on the evolving threat landscape and may include secure design principles, prevention of authentication and authorization bypass attacks, and prevention of the use of vulnerable libraries.
4.3. HRMXGO personnel are required to sign confidentiality agreements and are required to acknowledge responsibility for reporting security incidents involving Customer Data.
4.4. HRMXGO removes access to critical systems (including systems containing Customer Data) for all separated personnel within 1 day and removes access to all systems within 3 days. HRMXGO additionally reviews the access privileges of its personnel to its Cloud Environment at least quarterly.
4.5. HRMXGO will conduct the following background screening checks for all personnel with access to Customer Data, to the extent permitted under applicable law: (i) ID check, (ii) right to work check, and (iii) criminal history check.
4.6. HRMXGO reviews all highly-privileged accounts (“administrator” or “root” accounts) in systems that contain or have access to Customer Data at least quarterly and reduces administrative access if it is no longer needed (in other words, the least privilege principles are followed).
5. VENDORS AND SUB-PROCESSORS.
5.1. HRMXGO ensures that any of its vendors that process Customer Data or Content maintain security measures consistent with our obligations under this Security Addendum.
5.2. HRMXGO maintains a list of sub-processors at https://lockdocos.com/legal/subprocessors.
6. PHYSICAL DATA CENTER CONTROLS.
6.1. Our Cloud Environment is maintained by one or more cloud service providers. We ensure that our cloud service providers data centers have appropriate controls as audited under their third-party audits and certifications. Each cloud service provider will have SOC 2 Type II annual audit and ISO 27001 certification, or industry recognized equivalent frameworks. Such controls include:
- Physical access to facilities are controlled at building ingress points;
- Visitors are required to present ID and must be signed in;
- Physical access to servers is managed by access control devices;
- Physical access privileges are reviewed regularly;
- Facilities utilize monitor and alarm response procedures;
- Facilities utilize CCTV;
- Facilities have adequate fire detection and protection systems;
- Facilities have adequate back-up and redundancy systems; and
- Facilities have appropriate climate control systems.
6.2. HRMXGO does not maintain physical offices other than for limited corporate and executive purposes. Under no circumstances is Customer Data or Content stored or hosted at such offices.
7. INCIDENT DETECTION AND RESPONSE.
7.1. If HRMXGO becomes aware of a breach of security leading to the destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data or Content (a “Security Incident“), HRMXGO will notify You without undue delay, and in any case, within 48 hours after becoming aware. You will be notified at the security notice email address indicated on Your currently operative order form or as otherwise determined appropriate by HRMXGO.
7.2. In the event of a Security Incident as described above, HRMXGO will promptly take reasonable steps to contain, investigate, and mitigate any Security Incident. Any logs determined to be relevant to a Security Incident, will be preserved for at least 1 year.
7.3. HRMXGO will provide You with timely information about the Security Incident, including the nature and consequences of the Security Incident, the status of our investigation, and a contact point from which additional information may be obtained. HRMXGO will also share information about the measures taken or proposed by HRMXGO to mitigate or contain the Security Incident after the investigation into the Security Incident has concluded. Customer acknowledges that because HRMXGO personnel may not have visibility to the content of Customer Data and Content, it may be the case that we are unable to provide detailed analysis of the type of Customer Data and Content impacted by the Security Incident. Communications in connection with a Security Incident will not be construed as an acknowledgment by HRMXGO of any fault or liability with respect to the Security Incident.
8. AUDIT LOGGING.
8.1. HRMXGO will create, protect, and retain information system audit records to the extent needed to maintain integrity, and will enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity. Actions of human information system users can be uniquely traced to those users.
8.2. Audit logs are retained for the minimum of 1 year, and may be retained up to a maximum of 10 years. Audit logs are protected against tampering.
9. CUSTOMER RESPONSIBILITIES.
9.1. It is Your responsibility to ensure that You are authorized to use any Input or Customer Data with the Service and that Your usage complies with relevant legal and regulatory obligations.
9.2. You are responsible for managing and securing Your methods to access the Service (for example, password, email inboxes for email-code-authentication, etc.). User credentials must be kept confidential and may not be shared with unauthorized parties. A single account may not be shared among multiple persons. You must promptly report any suspicious activities related to Your account(s) (such as when You reasonably believe that credentials have been compromised).
9.3. You are responsible for keeping Your relevant IT systems (such as the browser You use to access the Service) up-to-date and appropriately patched.