Trust and Security.

ID Privacy, Inc. (“ID Privacy”) maintains a documented information security and privacy program to protect the confidentiality, integrity, and availability of client data. This page describes that program in general terms and explains how to request the list of third-party subprocessors we use. It is referenced in our Master Services Agreement (Section 7.1 and Exhibit 1). This page may be updated from time to time. If it differs from a signed agreement, the agreement controls.

Our Security Program

Our program is risk-based. Controls cover people, process, and technology, and we review them periodically as operational, regulatory, cybersecurity, and AI-related risks change.

We maintain written policies for information security, data protection, acceptable use, access management, encryption, incident response, business continuity, AI governance, and change management. Management is accountable for security and AI governance controls, and policies are reviewed and updated as risks and standards evolve.

Compliance Status

Our controls are designed to align with the control objectives of the SOC 2 Trust Services Criteria, ISO/IEC 27001, and ISO/IEC 42001, the standard for AI management systems.

Alignment describes how we design and run our program. It is not a certification, and it does not mean an audit has been completed. ID Privacy does not represent that it holds a SOC 2 report or an ISO certification. If we obtain one, we will list it on this page.

Access Control

• Role-based access control is enforced across our systems, and access is granted on a least-privilege basis.
• Multi-factor authentication is required for administrative and privileged access.
• Access to production systems is logged and periodically reviewed.
• Access is revoked promptly when a role changes or employment ends.

Data Protection and Encryption

• Data is encrypted in transit using industry-standard secure protocols (TLS).
• Sensitive data is encrypted at rest using strong encryption standards, such as AES-256.
• Encryption keys are managed securely, with access restricted to authorized personnel.

Infrastructure and Operations

• Our services run on enterprise-grade cloud infrastructure, primarily Google Cloud Platform in the United States.
• Network controls include firewalls, monitoring, and segmentation.
• Vulnerability management and patching follow risk-based remediation timelines.
• Logging and monitoring are in place to detect anomalous or unauthorized activity.

Secure Development and Change Management

Our software development lifecycle includes the following controls:

• Peer code review before changes merge to protected branches.
• Source control protections, including branch protection rules and access restrictions.
• Deployment pipelines with automated security checks and integrated security testing.
• Dependency management and tracking of third-party library vulnerabilities.
• Documented approval, testing, and validation before changes reach production, with an emergency change procedure for critical issues.

Risk Management

We assess security, privacy, operational, vendor, and AI-related risks periodically. Risks are evaluated by likelihood and potential impact, assigned to owners, and tracked through remediation. We reassess as the threat and operating environment changes.

Incident Response and Notification

We maintain a documented incident response plan covering identification, investigation, containment, remediation, and communication. It applies to security incidents, privacy events, and AI-related incidents, including output anomalies, model misuse, and unauthorized model access.

If a security incident involving client data is confirmed, we take appropriate containment and remediation steps, notify affected clients as our agreement and applicable law require, and complete a post-incident review to strengthen our controls.

AI Governance and Responsible AI

Our AI governance framework is designed to align with the objectives of ISO/IEC 42001. It includes:

• Human oversight of AI-assisted workflows, particularly where outputs influence customer communications, credit-related signals, or identity resolution.
• AI risk assessment as part of our overall risk management program.
• Output validation, using automated checks and human review where required.
• Monitoring of deployed models for degradation, drift, unexpected behavior, or misuse.
• Security and privacy due diligence on AI model providers before engagement, with periodic reassessment.
• Transparency with clients about where AI-assisted processing occurs.
• Clear responsibility: clients remain responsible for final decisions wherever AI outputs inform regulated or high-stakes determinations.

We do not use client-identifiable data to train models that serve other customers. Client data may be used to improve a client’s own deployment, and in de-identified or aggregated form to improve the platform, as described in Section 5 of our Master Services Agreement.

Vendor and Subprocessor Oversight

Cloud, AI, communications, and analytics providers go through security and privacy due diligence before we engage them and periodic reassessment afterward. Subprocessors are bound by written agreements requiring confidentiality, data protection, and security safeguards no less protective than those we maintain. ID Privacy remains responsible for the acts and omissions of its subprocessors with respect to client data.

Data Retention and Deletion

• Client data is kept only as long as needed to provide the services or meet legal or contractual obligations.
• When services end, client data is securely deleted or anonymized under the terms of the agreement.
• Backup and archive data is protected and purged under our retention policies.

Business Continuity and Disaster Recovery

We maintain backup, recovery, and continuity procedures that are reviewed and tested periodically to support resilience and availability. The program includes defined recovery time and recovery point objectives, backup and restore testing, disaster recovery exercises, and post-test reviews that feed improvements.

Our People

• Personnel are bound by confidentiality obligations.
• Security and privacy awareness training is provided.
• Background screening is performed consistent with role requirements.

Insurance

ID Privacy maintains commercial insurance consistent with industry standards for technology and data-driven service providers, including general liability, umbrella liability, workers’ compensation, and technology errors and omissions coverage that includes cyber liability. Certificates of insurance are available on request. Coverage is subject to the terms, conditions, retentions, exclusions, and limits of the applicable policies.

Authorized Subprocessors

We use a limited number of third-party subprocessors to help deliver our services, in categories such as cloud infrastructure, communications, data and analytics, AI model inference, and developer tools. Complete details about our authorized subprocessors, including what each one does and where it processes data, are available on request. Contact your ID Privacy representative or write to legal@idprivacy.ai.

Questions

To request security documentation, a security questionnaire, a certificate of insurance, or the complete list of authorized subprocessors, or to ask about anything on this page, contact your ID Privacy representative or write to legal@idprivacy.ai.