Data Processing Addendum

Nova & the Scope of This Document

Nova is a product of Inceptica LLC. Inceptica LLC is the service provider and legal contracting party; “Nova”, “we”, “us” and “our” refer to Inceptica LLC when describing the provider’s rights and obligations. Nova Brain is the company-context intelligence foundation used across AI Code Reviews, Developer Device Security and Compliance for SOC 2 and other frameworks. It is not a separate legal entity.

Nova Cloud provides workspace-level services and team visibility. Nova Endpoint provides developer-device and local development workflows. The data processed depends on the features used, the systems connected, the permissions granted and the customer’s configuration—not simply on an application or asset appearing in a product illustration.

Expanded Processing Description — Annex 1

The subject matter includes customer-authorized company-context processing through Nova Brain for AI Code Reviews, Developer Device Security and Compliance. Processing operations include collection, organization, storage, retrieval, correlation, AI-assisted analysis, generation of findings and recommendations, authorized disclosure, export and deletion. Duration and deletion obligations remain those in Section 12 and the applicable agreement.

In addition to the categories listed in Annex 1, personal data can appear in source code and diffs, repository and review metadata, device and software inventories, security posture findings, company documents and messages, access metadata, policies and evidence. Data subjects include developers, employees, contractors, collaborators and other individuals whose data appears in authorized sources. No new permission to process unnecessary special-category data is granted.

Instructions, AI Providers & Source Permissions

Customer instructions include authorized configuration of connected sources and workflows. Nova Brain analysis and use of AI providers remain subject to the purpose limitation, confidentiality, sub-processor, international-transfer and security obligations in this DPA. Customer Personal Data must not be used for unauthorized AI training or product improvement without explicit consent. The service is not intended for solely automated decisions producing legal or similarly significant effects on individuals.

A customer-connected application is a source system, not automatically an Inceptica sub-processor. A vendor processing data on Inceptica’s behalf is subject to the sub-processor provisions. Access to Google Drive, Slack and other company knowledge is limited by the customer’s authorization and the configured integration scopes. Workspace reporting may make relevant developer and device findings available to customer-authorized users.

Introduction

This Data Processing Addendum ("Addendum" or "DPA") is entered into between Inceptica LLC, provider of Nova ("Nova", "we", "us", "our") and the Customer (as defined in the Agreement) and forms part of any agreement, terms of service, or order under which Customer uses Nova's Nova Brain-powered engineering and compliance platform and related services ("Services") (the "Agreement"). By using the Services, Customer agrees to this DPA.

Customer enters into this DPA on behalf of itself and any Affiliates authorized to use the Services under the Agreement and who have not entered into a separate contractual arrangement with Nova. For the purposes of this DPA only, and except where otherwise indicated, references to "Customer" shall include Customer and such Affiliates.

1. Definitions

In this DPA, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly:

"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control or ownership with either Customer or Nova (as the context allows), where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise.

"Compliance Framework" means any security, privacy, or compliance standard that Customer is seeking to achieve or maintain through the Services, including but not limited to SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, and other industry standards.

"Customer Personal Data" means any Personal Data provided by or made available by Customer to Nova or collected by Nova on behalf of Customer which is Processed by Nova to perform the Services.

"Controller to Processor SCCs" means the standard contractual clauses for cross-border transfers published by the European Commission on June 4, 2021 governing the transfer of EU Area Personal Data to Third Countries as adopted by the European Commission, the Swiss Federal Data Protection and Information Commissioner ("Swiss FDPIC") relating to data transfers to Third Countries (collectively "EU SCCs"); (ii) the international data transfer addendum ("UK Transfer Addendum") adopted by the UK Information Commissioner's Office ("UK ICO") for data transfers from the UK to Third Countries; or (iii) any similar such clauses adopted by a data protection regulator relating to Personal Data transfers to Third Countries, including without limitation any successor clauses thereto.

"Data Protection Laws" means any local, state, or national law regarding the processing of Personal Data applicable to Nova in the jurisdictions in which the Services are provided to Customer, including, without limitation, privacy, security, and data protection law.

"EU Area" means the European Union, European Economic Area, United Kingdom, and Switzerland.

"EU Area Law" means (i) Regulation (EU) 2016/679 ("EU GDPR") together with applicable legislation implementing or supplementing the same; (ii) the EU GDPR as saved into United Kingdom Law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 (the "UK GDPR"); (iii) the Swiss Federal Act on Data Protection and its implementing ordinances, as amended ("Swiss DPA"); (iv) any other law relating to data protection, security, or privacy of individuals that applies in the EU Area; or (v) any successor or amendments thereto.

"Integration" means any connection between the Services and third-party systems (including but not limited to GitHub, AWS, Azure, GCP, Slack, Jira, Google Workspace, Microsoft 365, Okta, and other business systems) for authorized company-context analysis, code reviews, device security, automated evidence collection and compliance monitoring.

"Security Incident" or "Personal Data Breach" means any breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data being Processed by Nova.

"Services" means the services to be supplied by Nova to Customer or Customer's Affiliates pursuant to the Agreement.

"Sub-processor" means any processor engaged by Nova to process Customer Personal Data.

"Third Country" means countries that, where required by applicable Data Protection Laws, have not received an adequacy decision from an applicable authority relating to cross-border data transfers of Personal Data.

The terms "Business", "Business Purpose", "Commercial Purpose", "Contractor", "Controller", "Data Subject", "Personal Data", "Process"/"Processing", "Processor", "Sell", "Service Provider", "Share", "Supervisory Authority", and "Third Party" have the same meanings as described in applicable Data Protection Laws and cognate terms shall be construed accordingly.

2. Scope, Order of Precedence, and Governing Law

2.1 This DPA applies to Nova's Processing of Customer Personal Data under the Agreement to the extent such Processing is subject to Data Protection Laws.

2.2 This DPA is governed by the governing law of the Agreement unless otherwise required by Data Protection Laws.

2.3 In the event of any inconsistency between provisions, they will take priority in this order: (a) any Standard Contractual Clauses or other cross-border transfer mechanisms, (b) this DPA, (c) the Agreement. In the event that any provision of this DPA and/or the Agreement contradicts the Controller to Processor SCCs, the Controller to Processor SCCs will control.

3. Roles of the Parties

3.1 The Parties acknowledge and agree that with regard to the Processing of Customer Personal Data, and as more fully described in Annex 1 hereto, Customer acts as a Business or Controller (or Processor on behalf of its

own clients), and Nova acts as a Service Provider or Processor (or Sub-processor where applicable).

3.2 Customer shall be solely responsible for ensuring timely communications to Customer's Affiliates or the relevant Controller(s) who receive the Services, insofar as such communications may be required to enable compliance with Data Protection Laws.

3.3 Customer is solely responsible for complying with Security Incident notification laws applicable to Customer and fulfilling any obligations to give notices to government authorities, af fected individuals or others relating to any Security Incidents.

3.4 Customer as Audited Entity: Where Customer undergoes compliance audits or assessments, Customer acknowledges that Nova processes audit-related Personal Data on Customer's behalf. Customer remains responsible for the accuracy and completeness of information provided to auditors through the Services.

4. Description and Purpose of Personal Data Processing

4.1 In Annex 1 to this DPA, the Parties have mutually set out their understanding of the subject matter and details of the Processing of Customer Personal Data. The Parties may make reasonable amendments to Annex 1 on mutual written agreement as reasonably necessary to meet requirements of Data Protection Laws.

4.2 The purpose of Processing under this DPA is the provision of the Services pursuant to the Agreement and any Order Form(s).

5. Data Processing Terms

5.1 Customer Obligations

Customer shall:

Comply with all applicable Data Protection Laws in connection with the performance of this DPA

Process Customer Personal Data within the Services in accordance with applicable Data Protection Laws

Be solely responsible for the lawfulness of Personal Data it supplies

Provide required notices to Data Subjects

Not provide Nova with any special categories of data unless necessary for the Services

Not provide unnecessary data concerning a natural person's health, religion or other special categories as defined in Article 9 of the GDPR unless required for compliance assessment purposes

Ensure proper authorization for all Integrations and that access credentials provided to Nova have appropriate scope limitations

Maintain accurate and current information in the Services for compliance assessments

Review and validate automated evidence collected by the Services before submission to auditors or regulatory bodies

5.2 Nova Obligations

Nova shall comply with all applicable Data Protection Laws in the Processing of Customer Personal Data and

shall:

a) Process solely on instructions: Process Customer Personal Data for the purposes of the Agreement and as set out in Annex 1, solely on the documented instructions of Customer. The Agreement, this DPA, and Customer's use of the Services' features are Customer's written instructions.

b) Purpose limitation: Not Sell or Share Customer Personal Data under CCPA/CPRA, nor use, retain, disclose, or otherwise Process Customer Personal Data outside of the business relationship with Customer or for any commercial purpose except as required or permitted by law.

c) Confidentiality: Ensure that personnel authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality .

d) Security measures: Implement and maintain the technical and organizational measures set out in Annex 2, taking into account the state of the art, costs of implementation, and the nature, scope, context and purposes of Processing, including:

Pseudonymization and encryption of Customer Personal Data

Ensuring ongoing confidentiality , integrity, availability and resilience of processing systems

Ability to restore availability and access to Customer Personal Data in a timely manner

Regular testing, assessing and evaluating effectiveness of security measures

e) Sub-processors: Customer hereby generally authorizes Nova to engage Sub-processors, subject to Nova:

Notifying Customer at least thirty (30) days in advance of any intended changes to Sub-processors

Including materially equivalent data protection obligations in contracts with Sub-processors

Remaining liable for Sub-processor performance

f) Government requests: To the extent legally permissible, promptly notify Customer of legally binding requests for disclosure of Customer Personal Data. Where requests are not legally binding, Nova will reject them and notify Customer where lawful.

g) Data Subject rights: Reasonably assist Customer with Data Subject requests, taking into account the nature of Processing. Customer agrees to pay Nova for reasonable time and expenses incurred.

h) Security Incident notification: Upon becoming aware of a Security Incident involving Customer Personal Data, notify Customer without undue delay and no later than 24 hours, including available information required for Customer's compliance with breach reporting obligations.

i) Regulatory assistance: Provide reasonable assistance with Customer's obligations pursuant to Articles 32 to 36 of the GDPR, including privacy impact assessments and prior consultations with Supervisory Authorities.

j) Deletion/return: Upon termination or expiry of the Agreement, at Customer's option, either return or delete all Customer Personal Data, unless retention is required by law. Nova will provide certification of deletion upon request.

k) Records: Maintain necessary records to demonstrate compliance with obligations for Processing Customer Personal Data.

l) Audit rights: Make available information necessary to demonstrate compliance and allow for audits, including inspections, by Customer or its mandated auditor, subject to:

Reasonable prior notice (at least 30 days)

Conduct during normal business hours

Minimizing disruption to operations

No more than once per year (except after Security Incidents or regulatory requirements)

Customer bearing its costs and Nova's reasonable expenses

Execution of reasonable confidentiality agreement

Nova may satisfy audit requirements by providing relevant security documentation and certifications when available

6. No Sale/Sharing and Business Purposes

6.1 Nova does not Sell or Share Customer Personal Data. Nova will not combine Customer Personal Data with Personal Data from other sources except as necessary to perform the Services.

6.2 For processing involving California consumers, Nova processes Personal Data for the following Business Purposes:

Helping to ensure security and integrity

Debugging to identify and repair errors

Performing services on behalf of the business (maintaining compliance records, automated evidence collection, processing compliance assessments, verifying information, providing analytics)

Undertaking internal research for technological development

Maintaining quality or safety of services

Retaining service providers or contractors as subcontractors

Building or improving service quality

Preventing, detecting, or investigating security incidents or illegal activity

6.3 AI Processing: Where Nova uses artificial intelligence or machine learning for compliance automation, such processing is:

Limited to authorized company-context analysis, AI Code Reviews, Developer Device Security, compliance assessment and evidence analysis purposes

Subject to human review for critical compliance decisions

Documented and auditable

Not used for automated decision-making that produces legal effects concerning Data Subjects

7. Sub-Processors

7.1 Customer authorizes Nova to use Sub-processors listed in Annex 3 (available at privacy@teamnova.ai or upon request).

7.2 Nova will notify Customer of new Sub-processors via email at least 30 days in advance. Customer may object on reasonable grounds related to data protection; if no resolution is found within 14 days, Customer may terminate affected Services without penalty upon 30 days' written notice.

7.3 Nova enters written agreements with Sub-processors imposing materially equivalent data protection obligations and remains liable for their performance.

7.4 Critical Sub-processors: Nova acknowledges that certain Sub-processors are essential to Service delivery. Changes to critical infrastructure providers (AWS, MongoDB Atlas) will include migration support and extended notice periods.

8. Third-Party System Integrations

8.1 Evidence Collection: Nova facilitates integrations with customer systems (including but not limited to GitHub, GitLab, Bitbucket, AWS, Azure, GCP, Slack, Jira, Confluence, Google Workspace, Microsoft 365, Okta, Active Directory, and other platforms) for automated evidence collection as part of compliance assessments.

8.2 Customer Authorization: These integrations operate under Customer's direct authorization and credentials. Customer grants Nova limited access solely for:

Collecting compliance evidence

Monitoring security configurations

Assessing control implementation

Generating compliance reports

8.3 Integration Security: Nova implements the following safeguards for Integrations:

OAuth 2.0 or API key authentication where available

Principle of least privilege for access scopes

Encrypted storage of authentication credentials

Regular review and rotation of access credentials

Audit logging of all integration activities

Automatic revocation upon Service termination

8.4 Customer Responsibilities: Customer is responsible for:

Ensuring appropriate permissions and compliance with applicable laws for data accessed through Integrations

Reviewing and approving integration scopes before authorization

Promptly notifying Nova of any access revocations or changes

Ensuring third-party systems comply with Customer's own data protection obligations

8.5 Read-Only Access: Unless explicitly authorized in writing, Nova maintains read-only access to integrated systems and does not modify, delete, or write data to Customer's third-party systems.

9. Security Measures

Nova maintains administrative, technical, and organizational measures appropriate to the risk as detailed in Annex 2, including:

Encryption: AES-256 encryption at rest and TLS 1.2+ in transit

Access Controls: Multi-factor authentication, role-based access control, and principle of least privilege

Infrastructure Security: Network segregation, Web Application Firewall (WAF), and DDoS protection

Vulnerability Management: Regular scanning, penetration testing, and responsible disclosure program

Development Security: Secure SDLC, code reviews, and dependency scanning

Monitoring: 24/7 security monitoring, SIEM, and automated alerting

Incident Response: Documented incident response plan with defined SLAs

Business Continuity: Disaster recovery plan with RTO/RPO objectives

Compliance: Commitment to security best practices and industry standards

Employee Security: Background checks, security training, and signed NDAs

10. International Transfers

10.1 Where Customer Personal Data is transferred outside its origin to a Third Country, Nova uses appropriate safeguards:

a) For EU/EEA transfers: EU SCCs (Module Two - controller to processor) with:

Clause 7: Optional docking clause applies

Clause 9: Option 2 applies with 30-day notice for sub-processors

Clause 11: Optional language does not apply

Clause 17: Option 1 applies, governed by Irish law

Clause 18(b): Disputes resolved before courts of Republic of Ireland

Annex I and II: As set forth in this DPA

b) For UK transfers: EU SCCs as modified by UK Transfer Addendum, with conflicts resolved per Sections 10-11 of UK Addendum

c) For Swiss transfers: EU SCCs with modifications:

References to GDPR interpreted as Swiss DPA

References to EU/Union interpreted as Switzerland

Governed by Swiss law with Swiss court jurisdiction

10.2 Transfer Impact Assessment: Nova has conducted transfer impact assessments and implements supplementary measures where necessary, including:

Enhanced encryption standards

Pseudonymization where feasible

Access restrictions to transferred data

Contractual commitments from Sub-processors regarding government access

10.3 Nova processes Personal Data using AI/ML technologies within secure cloud infrastructure regions, prioritizing data residency where available.

11. Security Incidents

11.1 Notification Timeline: Nova will notify Customer without undue delay and within 24 hours of becoming aware of a Security Incident affecting Customer Personal Data.

11.2 Initial Notification will include available information about:

Nature and description of the incident

Date and time of occurrence and discovery

Categories and approximate number of Data Subjects affected

Categories and approximate number of Personal Data records concerned

Initial assessment of risk to Data Subjects

Immediate containment measures taken

Contact point for more information

11.3 Follow-up Reporting: Nova will provide updates as investigation progresses, including:

Root cause analysis

Full impact assessment

Remediation measures implemented

Recommendations to prevent recurrence

Evidence preservation for potential regulatory inquiries

11.4 Customer Support: Nova will provide reasonable assistance for:

Customer's breach notification obligations

Communication with Data Subjects

Regulatory reporting requirements

Forensic investigation needs

11.5 Post-Incident Review: Nova will conduct post-incident reviews and implement lessons learned to improve security posture.

12. Data Retention and Deletion

12.1 Retention Periods: Nova retains Customer Personal Data for the duration of the Agreement plus:

Compliance evidence: As specified by relevant Compliance Framework requirements (typically 3-7 years)

Audit logs: 12 months

Support tickets: 24 months

Backup data: 90 days post-deletion

12.2 Deletion Process: Upon termination or Customer request:

Production data deleted within 30 days

Backup data deleted within 90 days

Certificates of deletion provided upon request

Exceptions only for legal/regulatory requirements

12.3 Data Portability: Customer may export their data through the Services' export functionality in commonly used formats (CSV, JSON, PDF) at any time during the Agreement term.

13. Warranties and Compliance

13.1 Each party warrants that it will comply with applicable Data Protection Laws.

13.2 Nova specifically warrants:

Maintenance of appropriate technical and organizational measures

Personnel are adequately trained in data protection

Sub-processors are contractually bound to equivalent standards

Regular security and compliance assessments

No unauthorized use of Customer Personal Data for AI training or product improvement without explicit consent

13.3 Security Documentation: Nova maintains and will provide upon request:

Security policies and procedures documentation

Privacy policy

Sub-processor agreements confirmation

Third-party security certifications as they become available

14. Liability and Indemnification

14.1 Liability Cap: Liability remains as defined in the Agreement, except that for data protection violations, liability shall not be less than the greater of (a) amounts specified in the Agreement or (b) statutory minimums under applicable Data Protection Laws.

14.2 Nothing in this DPA limits:

Data Subjects' non-waivable rights under applicable law

Rights under SCCs/UK Addendum

Liability for willful misconduct or gross negligence

14.3 Indemnification: To the extent permissible by law:

Customer shall defend and indemnify Nova from claims arising from Customer's breach of this DPA or Data Protection Laws

Nova shall defend and indemnify Customer from claims arising from Nova's breach of this DPA where Nova is independently determined to be at fault

14.4 Insurance: Nova maintains cyber liability insurance with minimum coverage appropriate for the nature of the Services, including coverage for data breaches and privacy violations.

15. Data Protection Officer

For privacy matters and Data Subject requests, contact: Data Protection Officer Email: privacy@teamnova.ai Address: 2389 Main St. STE 100, Glastonbury, CT 06033

Response time: Within 48 hours for general inquiries, within 24 hours for urgent matters or Security Incidents.

16. Transparency and Accountability

16.1 Privacy Notice: Nova maintains a publicly available privacy notice describing its data processing practices.

16.2 Records of Processing: Nova maintains records of processing activities as required under Article 30 of GDPR.

16.3 Privacy by Design: Nova implements privacy by design principles in Service development and updates.

16.4 Regular Reviews: This DPA is reviewed annually and updated as necessary to maintain compliance with evolving Data Protection Laws.

17. Severability

If any section of this DPA is held unlawful or unenforceable, it shall not invalidate other sections. The parties will negotiate in good faith to replace invalid provisions with valid ones achieving similar objectives.

18. Changes

18.1 Nova may update this DPA to reflect:

Changes in Data Protection Laws

New Service features or Sub-processors

Industry best practices

Regulatory guidance

18.2 Material changes will be notified via email at least 30 days in advance. Continued use of Services after the effective date constitutes acceptance of updates.

18.3 Changes that materially reduce data protection will require explicit Customer consent.

19. Priority of Signed DPAs

If Customer has a separately signed Data Processing Addendum with Nova, that signed DPA governs to the extent it conflicts with this page.

20. Miscellaneous

20.1 Entire Agreement: This DPA, together with the Agreement, constitutes the entire agreement regarding Processing of Customer Personal Data.

20.2 No Third-Party Beneficiaries: Except for Data Subject rights under applicable law, this DPA does not create third-party beneficiary rights.

20.3 Survival: Provisions that by their nature should survive termination will remain in effect.

20.4 Assignment: Neither party may assign this DPA without the other's prior written consent, except in connection with a merger, acquisition, or sale of all or substantially all assets.

Annex 1: Description of Processing Activities

List of Parties

Data Exporter (Controller):

Name: Customer (as defined in Agreement)

Address: As set forth in relevant Order Form

Contact: As set forth in relevant Order Form

Activities: Recipient of Services provided by Nova

Role: Controller/Business

Signature: By accepting Terms of Service or executing Order Form

Data Importer (Processor):

Name: Inceptica LLC (provider of Nova)

Address: 2389 Main St. STE 100, Glastonbury, CT 06033

Contact: Data Protection Officer , privacy@teamnova.ai

Activities: Provision of Nova Brain-powered engineering and compliance services to Customer

Role: Processor/Service Provider

Acceptance: As provided in the Agreement

Processing Information

Categories of Data Subjects:

Customer's employees, contractors, consultants, and authorized users

Customer's compliance team members, security personnel, and auditors

System administrators and technical personnel

Customer's vendors, partners, and third-party service providers (as applicable)

Individuals whose data appears in compliance evidence or audit logs

Customer's end-users (if Customer provides services to consumers)

Prospective employees (in background check contexts)

Categories of Personal Data:

Identity Data: Names, usernames, employee IDs, email addresses, phone numbers, job titles, departments

Authentication Data: Login credentials, MFA tokens, session identifiers, API keys

Professional Data: Role information, reporting structures, work locations, team assignments

System Access Data: Access logs, permission levels, IP addresses, device identifiers, browser information

Compliance Evidence: Code commits and review history

Infrastructure configurations and change logs

Security scan results and vulnerability reports

Access control lists and permission matrices

Incident reports and remediation records

Training completion records

Policy acknowledgments

Communication Data: Support tickets, chat logs, meeting recordings (if applicable)

Audit Trail Data: User activities, system changes, timestamp data, approval workflows

Integration Data: Data collected from connected third-party systems

Metadata: File metadata, system metadata, application usage patterns

Sensitive Personal Data (processed only when necessary for specific Compliance Frameworks):

Government identification numbers (for background checks if applicable)

Financial account information (for PCI DSS compliance if applicable)

Health information (for HIPAA compliance if applicable)

Criminal background check data (where legally required)

Special Security Measures for Sensitive Data:

Additional encryption layers

Restricted access on need-to-know basis

Enhanced audit logging

Automatic data minimization

Processing Operations:

Collection (via integrations, file uploads, manual entry)

Recording and organization in compliance management system

Structuring for compliance framework mapping

Storage in secure cloud infrastructure

Retrieval for compliance assessments and reporting

Analysis using automated compliance checking algorithms

Transmission to authorized recipients (auditors, regulators if directed)

Access control and permission management

Anonymization/pseudonymization where applicable

Backup and disaster recovery operations

Deletion according to retention policies

Purpose of Processing:

Compliance Management: Automated compliance monitoring and assessment

Control implementation and testing

Evidence collection and management

Gap analysis and remediation tracking

Compliance framework mapping (SOC 2, ISO 27001, HIPAA, etc.)

Audit Support: Audit preparation and readiness

Evidence packaging for auditors

Continuous compliance monitoring

Audit trail maintenance

Risk Management: Risk assessment and scoring

Vulnerability management

Security posture monitoring

Vendor risk assessment

Service Delivery: Account administration and user management

Platform access and authentication

Customer support and success

Training and onboarding

Platform Operations: Service reliability and performance

Security monitoring and incident response

Feature development and improvement

Analytics and reporting

Duration of Processing:

Active processing: Duration of the Agreement term

Retention: As specified in Section 12 (Data Retention and Deletion)

Post-termination: 30 days for data export, then deletion per retention schedule

Frequency of Transfer:

Continuous during provision of Services

Real-time for integration synchronization

Batch processing for compliance assessments

Nature of Processing:

Automated and manual processing

Cloud-based processing

Machine learning analysis (with human oversight)

Annex 2: Technical and Organizational Security Measures

1. Governance and Compliance Security Governance:

Information Security Management System (ISMS) aligned with industry best practices

Designated Chief Information Security Officer (CISO) or equivalent

Security Steering Committee with quarterly reviews

Annual risk assessments and treatment plans

Security policies reviewed and updated annually

Regular internal and external security assessments

Compliance Program:

Working toward SOC 2 certification

GDPR compliance program

CCPA/CPRA compliance program

HIPAA compliance capabilities (where applicable)

Regular compliance training for all personnel

2. Human Resources Security

Pre-Employment:

Background checks (where legally permissible)

Reference verification

Security clearance for sensitive roles

During Employment:

Signed confidentiality and data protection agreements

Annual security awareness training

Role-specific compliance training

Clean desk policy

Acceptable use policies

Post-Employment:

Immediate access revocation

Return of company assets

Continued confidentiality obligations

Exit interviews for security concerns

3. Asset Management Asset Inventory:

Comprehensive asset register

Data classification scheme (Public, Internal, Confidential, Restricted)

Data flow mapping

Regular asset audits

Data Handling:

Data handling procedures by classification

Secure disposal procedures

Media sanitization standards (NIST 800-88)

Chain of custody for sensitive data

4. Access Control Identity Management:

Centralized identity provider (IdP)

Single Sign-On (SSO) where feasible

Multi-factor authentication (MFA) mandatory

Strong password policies (minimum 14 characters, complexity requirements)

Password managers encouraged

Access Management:

Role-Based Access Control (RBAC)

Principle of least privilege

Segregation of duties for critical functions

Formal access request and approval workflow

Quarterly access reviews

Automated de-provisioning

Privileged Access Management (PAM) for administrative accounts

Network Access:

Zero Trust network architecture

VPN for remote access

Network segmentation

Jump boxes for production access

5. Cryptography Encryption Standards:

Data at rest: AES-256 encryption

Data in transit: TLS 1.2 minimum, TLS 1.3 preferred

Key management using hardware security modules (HSM) or key management service (KMS)

Certificate management and rotation

Cryptographic key rotation annually or upon compromise

Cryptographic Controls:

FIPS 140-2 validated cryptographic modules

Perfect Forward Secrecy (PFS)

Certificate pinning for critical connections

Code signing for software releases

6. Physical and Environmental Security Data Center Security (via AWS):

SOC 2 certified data centers

24/7 physical security

Biometric access controls

CCTV surveillance

Environmental controls (HVAC, fire suppression, UPS)

Geographically distributed for resilience

Office Security:

Badge-controlled access

Visitor management system

Security cameras in common areas

Secure equipment disposal

7. Operations Security Change Management:

Formal change control process

Change Advisory Board (CAB)

Testing in non-production environments

Rollback procedures

Post-implementation reviews

Capacity Management:

Resource monitoring and alerting

Auto-scaling capabilities

Performance baselines

Capacity planning reviews

Backup and Recovery:

Automated daily backups

Point-in-time recovery capability

Backup encryption

Geographic backup distribution

Monthly restoration testing

Documented RTO/RPO objectives

Logging and Monitoring:

Centralized log management (SIEM)

Real-time security monitoring

Automated alerting for security events

Log retention per compliance requirements

Log integrity protection

Security Operations Center (SOC) monitoring

8. Communications Security Network Security:

Next-generation firewalls (NGFW)

Intrusion Detection/Prevention Systems (IDS/IPS)

Web Application Firewall (WAF)

DDoS protection

DNS security (DNSSEC)

Email security (SPF, DKIM, DMARC)

Application Security:

API gateway with rate limiting

Input validation and sanitization

Output encoding

Session management controls

CORS policies

9. System Development and Maintenance

Secure Development:

Security Development Lifecycle (SDL)

Threat modeling for new features

Security requirements in design

Secure coding standards

Peer code reviews

Security Testing:

Static Application Security Testing (SAST)

Dynamic Application Security Testing (DAST)

Software Composition Analysis (SCA)

Container security scanning

Infrastructure as Code (IaC) scanning

Annual penetration testing

Bug bounty program

Vulnerability Management:

Continuous vulnerability scanning

Risk-based patching (Critical: 24 hours, High: 7 days, Medium: 30 days)

Zero-day response procedures

Vulnerability disclosure program

Security advisory monitoring

10. Supplier Relationships Vendor Security:

Security assessment questionnaires

Risk-based vendor tiering

Contractual security requirements

Right to audit clauses

Annual vendor reviews

Vendor security scorecard monitoring

Sub-processor Management:

Due diligence process

Data Processing Agreements

Security addendums

Ongoing monitoring

Incident notification requirements

11. Information Security Incident Management Incident Response:

Documented incident response plan

Incident response team with defined roles

24/7 incident hotline

Severity classification (P1-P4)

Communication escalation matrix

Evidence preservation procedures

Post-incident reviews and lessons learned

Business Continuity:

Business Continuity Plan (BCP)

Disaster Recovery Plan (DRP)

Annual BCP/DRP testing

Crisis communication plan

Alternative work arrangements

12. Compliance Management

Audit and Assessment:

Internal audit program

Security assessments and reviews

Self-assessments

Compliance tracking and reporting

Corrective action tracking

Privacy Controls:

Privacy by Design implementation

Data Protection Impact Assessments (DPIA)

Data Subject request procedures

Consent management

Data retention controls

Right to erasure mechanisms

13. Cloud Security

Cloud Infrastructure (AWS):

AWS Well-Architected Framework alignment

AWS Security Best Practices implementation

CloudTrail logging

GuardDuty threat detection

Security Groups and NACLs

AWS WAF and Shield

Secrets Manager for credentials

Systems Manager for patch management

Container Security:

Container image scanning

Runtime protection

Kubernetes security policies

Service mesh security

Container registry controls

14. Data Loss Prevention

DLP Controls:

Data classification tagging

Endpoint DLP agents

Cloud Access Security Broker (CASB)

Email DLP policies

Database activity monitoring

USB device controls

15. Security Metrics and Reporting

Key Performance Indicators:

Mean Time to Detect (MTTD)

Mean Time to Respond (MTTR)

Vulnerability remediation SLAs

Security training completion rates

Phishing simulation results

Security incident trends

Reporting:

Monthly security dashboards

Quarterly security reviews

Annual security report

Board-level security briefings

Annex 3: Sub-Processors

Nova engages the following sub-processors to provide its services. This list is maintained current and will be updated with at least 30 days' advance notice for any changes.

Current Sub-processor List

Core Infrastructure:

1. Amazon Web Services, Inc. (AWS) Purpose: Cloud infrastructure and services

Services Used: EC2, S3, RDS, Lambda, CloudWatch, VPC, IAM, KMS, WAF, CloudFront, Route 53, and other AWS services

Location: United States (primary), with data residency options available

Security: SOC 2, ISO 27001, PCI DSS certified

Data Processing: Infrastructure provider for all Customer Personal Data

2. MongoDB, Inc. (MongoDB Atlas) Purpose: Document database for storing compliance data and configurations

Location: United States (configurable based on customer requirements)

Security: SOC 2, ISO 27001 certified

Data Processing: Compliance records, evidence metadata, configuration data

AI and Automation:

3. OpenAI, L.L.C. Purpose: Large Language Model API for compliance automation and intelligence

Services: AI model APIs for authorized analysis, recommendations and report generation

Location: United States

Security: Security measures aligned with industry standards

Data Processing: Relevant customer-authorized inputs and context for AI-assisted code reviews, security analysis and compliance workflows, subject to this DPA

Productivity and Collaboration:

4. Google LLC (Google Workspace) Purpose: Corporate email and productivity suite

Services: Gmail, Drive, Docs, Sheets, Calendar, Meet

Location: United States & EU data centers

Security: SOC 2, ISO 27001, ISO 27017, ISO 27018 certified

Data Processing: Internal business communications only (not customer data processing)

Payment Processing:

5. Stripe, Inc. Purpose: Payment processing for subscriptions

Location: United States

Security: PCI DSS Level 1, SOC 2

Data Processing: Payment information (not stored by Nova)

Categories of Sub-processors Sub-processors may be engaged for the following categories of services:

Cloud hosting and infrastructure providers

Database and storage services

Artificial intelligence and machine learning services

Email delivery and communication services

Customer support and ticketing tools

Identity and access management

Application monitoring and error tracking

Content delivery and security services

Payment processing (where applicable)

Productivity and internal collaboration tools

Sub-processor Requirements

All sub-processors are:

Bound by written Data Processing Agreements

Subject to security and privacy assessments

Required to maintain appropriate technical and organizational measures

Prohibited from using Customer Personal Data for their own purposes

Required to notify Nova of any security incidents

Subject to audit rights or must provide security certifications

Integration Partners (Not Sub-processors)

The following are systems that Customer may choose to integrate with Nova for evidence collection. These are NOT sub-processors as they are controlled directly by Customer:

Development Tools: GitHub, GitLab, Bitbucket, Azure DevOps

Cloud Providers: AWS, Microsoft Azure, Google Cloud Platform

Identity Providers: Okta, Azure AD, Google Workspace, OneLogin

Collaboration Tools: Slack, Microsoft Teams, Confluence, Jira

HR Systems: BambooHR, Workday, ADP, Rippling

Security Tools: CrowdStrike, SentinelOne, Qualys, Tenable

Other Business Systems: As authorized by Customer

For questions about sub-processors or to request the current list, contact privacy@teamnova.ai

Annex 4: Security Incident Response Procedures

Incident Classification Severity Levels:

Critical (P1): Confirmed breach with unauthorized access to Customer Personal Data

High (P2): Suspected breach or vulnerability actively being exploited

Medium (P3): Security vulnerability identified but not exploited

Low (P4): Security improvement opportunity

Response Timeline

Response times below specify internal escalation, customer notification, initial report and full report respectively. The 24-hour personal-data-breach notification obligation in Section 11 takes precedence for any qualifying breach.

Critical: Internal escalation within 15 minutes; customer notification within 24 hours; initial report within 48 hours; full report within 7 days.

High: Internal escalation within 1 hour; customer notification within 48 hours; initial report within 72 hours; full report within 14 days.

Medium: Internal escalation within 4 hours; customer notification within 7 days; initial report within 14 days; full report within 30 days.

Low: Internal escalation within 24 hours; customer notification at the next quarterly review; initial and full reports are not applicable.

Notification Contents

Initial Notification:

Incident reference number

Date and time of discovery

Initial severity assessment

Systems affected

Initial containment measures

Dedicated contact for updates

Follow-up Report:

Detailed timeline of events

Root cause analysis

Data categories affected

Number of records impacted

Remediation completed

Preventive measures implemented

Lessons learned

Annex 5: Data Subject Rights Procedures

Supported Rights Nova supports Customer in responding to:

Right of access (GDPR Article 15)

Right to rectification (GDPR Article 16)

Right to erasure/"right to be forgotten" (GDPR Article 17)

Right to restriction of processing (GDPR Article 18)

Right to data portability (GDPR Article 20)

Right to object (GDPR Article 21)

Rights related to automated decision-making (GDPR Article 22)

Process

1. Request Receipt: Forward to privacy@teamnova.ai within 24 hours

2. Verification: Confirm identity and validity of request

3. Search: Comprehensive search across all systems

4. Review: Legal review for exceptions or redactions

5. Response: Provide data or explanation within legal timeframes

6. Documentation: Maintain records of all requests and responses

Response Timeframes

Standard requests: 30 days

Complex requests: Up to 60 additional days with notice

Manifestly unfounded or excessive requests: May be refused or charged

End of Data Processing Addendum

Effectiveness and precedence are determined by the applicable Agreement and Section 19.

For questions about this DPA, please contact our Data Protection Officer at privacy@teamnova.ai