Jifflenow Security Policy

Jifflenow Technical & Organizational Security Measures

Jifflenow will, consistent with current best industry standards and such other requirements based on the classification and sensitivity of Information, maintain physical, administrative and technical safeguards and other security measures (i) to maintain the security and confidentiality of Controller Information accessed, collected, used, stored or transmitted by the processor, and (ii) to protect that information from known or reasonably anticipated threats or hazards to its security and integrity, accidental loss, alteration, disclosure and all other unlawful forms of processing. Without limitation, Jifflenow complies with the following requirements:

1. Firewall – Jifflenow has installed and maintaining a working network firewall to protect data accessible
   via the Internet and will keep all Controller Information protected by the firewall at all times.
2. Updates – Jifflenow will keep its systems and software up-to-date with the latest upgrades, updates, bug
   fixes, new versions and other modifications necessary to ensure security of the Controller Information.
3. Anti-malware – Jifflenow will at all times use anti-malware software and will keep the anti-malware
   software up to date. Jifflenow will mitigate threats from all viruses, spyware, and other malicious code
   that are or should reasonably have been detected.
4. Encryption – Jifflenow encrypts data at rest and data sent across open networks in accordance with
   industry best practices.
5. Testing -Jifflenow regularly tests its security systems and processes to ensure they meet the requirements
   of this Security Policy.
6. Access Controls – Jifflenow secures Controller Information, including by complying with the following
   requirements:
1. Jifflenow assigns a unique ID to each person with computer access to Controller Information.
2. Jifflenow restricts access to Controller Information to only those people with a “need-to-know”
   for Permitted Purpose.
3. Jifflenow provides ability for controller to review the list of people and services with access to
   its Information, and provide necessary technical measures and process for removing accounts
   that no longer require access
4. Jifflenow will not use manufacturer-supplied defaults for system passwords and other security
   parameters on any operating systems, software or other systems. Jifflenow will mandate and
   ensure the use of system-enforced “strong passwords” in accordance with the best practices
   (described below) on all systems hosting, storing, processing, or that have or control access to,
   Controller Information and will require that all passwords and access credentials are kept
   confidential and not shared among personnel.
• Password best practices. Passwords must meet the following criteria:
• Contain at least 8 characters and should contain at least one capital letter, one small
  letter and one number or special character;
• Not match previous passwords, the user’s login, or common name;
• Must be changed whenever an account compromise is suspected or assumed; and
• Are regularly replaced after no more than 90 days.
5. Jifflenow will maintain and enforce “account lockout” by disabling accounts with access to
   Controller Information when an account exceeds more than ten 5 consecutive incorrect
   password attempts.
6. Jifflenow will isolate Controller Information at all times (including in storage, processing or
   transmission), from Jifflenow’s and any third party information.
7. Jifflenow will regularly review access logs for signs of malicious behavior or unauthorized
   access.
7. Processor Policy – Jifflenow will maintain and enforce an information and network security policy for
   employees, subcontractors, agents, and suppliers that meets the standards set out in this policy, including
   methods to detect and log policy violations.
8. Subcontract – Jifflenow will not subcontract or delegate any of its obligations under this Security Policy
   to any subcontractors, affiliates, or delegates (“Subcontractors”) without Controller’s prior written
   consent.
9. Remote Access – Jifflenow will ensure that any access from outside protected corporate or production
   environments to systems holding Controller Information or Processor’s corporate or development
   workstation networks requires multi-factor authentication (e.g., requires at least two separate factors for
   identifying users).