This Data Protection Addendum (“DPA”), as amended from time to time, is an integral part of the Master Service Agreement (https://www.xtype.io/terms) as may be updated from time to time ("Agreement") by and among Company and Customer (as these terms defined in the Agreement). This DPA shall have effect on the date the Agreement becomes effective ("Effective Date").

Unless otherwise defined in the Agreement or this DPA, all capitalized terms used in this DPA will have the meanings assigned to them in Exhibit A of this DPA (titled “Definitions”).

‍

1.    Roles. This DPA applies whenever Customer Personal Data is processed by Company for the purpose of providing the Subscription Services to Customer. In this context, Company is a “Processor” for Customer; while Customer is a “Controller” (as each of those terms is defined in the Data Protection Laws, as applicable; any similar corresponding classification shall apply under any Data Protection Laws, as defined therein) with respect to Personal Data. The details of processing under this DPA are as set out in Exhibit B hereto.

2.   Compliance with laws. Each party will comply with all laws, rules and regulations applicable to it and binding on it in the performance of the Agreement and this DPA with respect to processing and protection of Customer Personal Data, including, without limitation, any applicable Data Protection Laws..

3. Customer Instructions. The parties agree that this DPA and the Agreement, as well as any ordering documents directed from time to time by Customer to Company in writing within the scope of the Agreement, constitute Customer’s documented instructions regarding Company's processing of Customer Personal Data (“Documented Instructions”). Company will process Customer Personal Data only in accordance with Documented Instructions. Additional instructions outside the scope of the Documented Instructions (if any) require prior written agreement between Company and Customer, including agreement on any additional fees payable by Customer to Company for carrying out such instructions.

4. Personal Data Ownership. Customer shall remain the owner of the Customer Personal Data at all times and nothing herein or in the Agreement shall transfer any title to the Personal Data to Company.

5. Confidentiality of Personal Data. Company will not access or use, or disclose to any third party, any Customer Personal Data, except, in each case, as necessary to maintain or provide the Subscription Services, or as necessary to comply with the law or a valid and binding order of a governmental body (such as a subpoena or court order), subject to Section 15 below.

6.  Confidentiality Obligations of Company's Personnel. Company restricts its personnel from Processing Customer Personal Data without authorization by Company, based on role and need to know. Company imposes appropriate contractual obligations upon its personnel, including relevant obligations regarding confidentiality, data protection and data security.

7.   Security of Data Processing

7.1.  Without derogating from the foregoing, Company has implemented and will maintain the technical and organizational security measures for protecting the Customer Personal Data as described in Company's Security Standards attached as Exhibit D to this DPA.

8.   Sub-processing.

8.1.  Company’s current list of Sub-processors is included in Exhibit C (“Sub-processor List”) and is hereby approved by the Customer. The Sub-processor List as of the date of execution of this DPA, or as of the date of publication (as applicable), is hereby, or shall be (as applicable), authorized by the Customer.

8.2.  Customer shall send an email to compliance@xtype.io with the subject SUBSCRIPTION TO SUB-PROCESSORS NOTIFICATION, to subscribe to notifications of new Sub-processors, and if Customer subscribes, Company shall provide notification of any new Sub-processor(s) before authorizing such new Sub-processor(s) to Process Customer Personal Data in connection with the provision of the Subscription Services.

8.3. Objection Right for Sub-processors. Customer may reasonably object to Company’s use of a Sub-processor for reasons related to the Data Protection Laws by notifying Company promptly in writing within three (3) business days after receipt of Company’s notice in accordance with the mechanism set out in Section 8.2 and such written objection shall include the reasons related to the Data Protection Laws for objecting to Company’s use of such Sub-processor. Failure to object to such Sub-processor in writing within three (3) business days following Company’s notice shall be deemed as acceptance of the Sub-Processor. In the event Customer reasonably objects to a Sub-processor, as permitted in the preceding sentences, Company will use reasonable efforts to make available to Customer a change in the Subscription Services or recommend a commercially reasonable change to Customer’s use of the Subscription Services to avoid Processing of Customer Personal Data by the objected-to Sub-processor without unreasonably burdening the Customer. Suppose the Company is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days. In that case, Customer may, as a sole remedy, terminate the applicable. This DPA with respect only to those Subscription Services which cannot be provided by the Company without the use of the objected-to Sub-Processor by providing written notice to the Company provided that all amounts due under the Agreement before the termination date with respect to the Processing at issue shall be duly paid to the Company. Until a decision is made regarding the Sub-Processor, the Company may temporarily suspend the Processing of the affected Customer Personal Data. Customer will have no further claims against the Company due to the termination of the Agreement (including, without limitation, requesting refunds) and/or the DPA in the situation described in this paragraph.

8.4.   Agreements with Sub-processors. In accordance with Articles 28.7 and 28.8 of the GDPR, if and when the European Commission lays down the standard contractual clauses referred to in such Article, the Parties may revise this DPA in good faith to adjust it to such standard contractual clauses. This Section 5 shall not apply to subcontractors of the Company which provide ancillary services to support the performance of the DPA. This includes, for example, telecommunication services, maintenance and user service, cleaning staff, or auditors

9.    Data Subject Rights

Taking into account the nature of the Subscription Services, should a data subject for which Company acts as a processor hereunder contact Company with regard to any rights granted to it under applicable Data Protection Laws, Company will forward such requests to Customer and use commercially reasonable efforts to assist Customer in complying with such request, to the extent related to Company's operations and Subscription Services provided to the Customer.

10.  Security Breach Notification.

10.1.  Security Incident. Company will (a) notify Customer of a Security Incident without undue delay after becoming aware of the Security Incident, and b) take reasonable steps to mitigate the effects and to minimize any damage resulting from the Security Incident.

10.2. Company's Assistance. Company will include in the notification under section 10.1(a) such information about the Security Incident as Company is reasonably able to disclose to Customer, taking into account the nature of the Subscription Services, the information available to Company, and any restrictions on disclosing the information, such as confidentiality undertakings towards third parties or rights and freedoms of natural persons.

10.3. Communication. Notification(s) of Security Incidents, if any, and any other notifications required or authorized hereunder, will be delivered to the below mentioned point of contact (in case of Company) and as indicated by the Customer at the time of subscription for the Subscription Services (or as subsequently informed by a party hereto in writing):

440 N Barranca Ave. Suite 7741 Covina,  

CA, 91723, US

support@xtype.io

https://xtype.service-now.com/

11.  Audits.

11.1.  Provision by Company of third-party security and compliance documentation shall, in principle, fulfill Company’s audit obligations under this Section 11. Such documentation may include, as available, summaries or copies of Company’s most recent security assessments and certifications (such as SOC 2 reports, ISO 27001 certifications, penetration test executive summaries, or equivalent documentation).

11.2. Upon Customer’s written request (no more than once annually) and subject to confidentiality obligations, Company shall provide such documentation to Customer, together with any other audit or compliance reports reasonably deemed by Company capable to demonstrate Company’s compliance with this DPA and applicable Data Protection Laws.

11.3. Only where (i) Customer’s applicable regulator explicitly requires audit measures beyond the provision of such documentation, or (ii) Customer has reasonably substantiated in writing that such documentation is insufficient to demonstrate Company’s compliance with specific requirements of applicable Data Protection Laws or this DPA, may Customer request additional specific documentation for audit purposes.

11.4. For clarity, Company shall not be required to provide Customer with direct access to its systems (including those that Process Customer Personal Data) or to its physical premises. Under no circumstances shall Customer be granted access to any data or environments belonging to other customers of Company.

11.5.  If, after following the process set out in Sections 11.1–11.3, Customer demonstrates that it still requires further assurance to meet its regulatory obligations, Customer may request that an independent third-party auditor conduct an audit on its behalf. Such engagement shall be (i) no more than once annually, unless Customer’s applicable regulator explicitly requires otherwise, (ii) subject to Company’s prior written consent, and (iii) contingent on an executed confidentiality agreement between the third-party auditor, Customer, and Company. Customer shall bear all costs related to such third-party audit. Customer shall provide Company with any audit report(s) generated in connection with such audit without undue delay following receipt

11.6. Customer may use any audit report(s) provided or produced under this Section 11 solely for the purposes of satisfying its regulatory audit requirements and/or confirming Company’s compliance with this DPA and applicable Data Protection Laws. Such audit report(s) shall constitute the confidential information of both parties.

11.7.  Customer shall exercise its rights under this Section 11 with due regard to minimizing disruption to Company’s business operations.

12.  Privacy Impact Assessment and Prior Consultation. Taking into account the nature of the Subscription Services and the information available to Company, Company will reasonably assist Customer in complying with Customer’s obligations in respect of data protection impact assessments and prior consultation pursuant to Articles 35 and 36 of the GDPR, by providing the applicable information Company makes available under this Section 12.

13. Data transfers outside EEA, Switzerland or UK.  

13.1.  With respect to any transfer (and any subsequent onward transfer) of Personal Data by Company from any EEA member state or from Switzerland, to a country which is not EEA member state or another country that has not been recognized as granting and adequate level of protection to personal data by the EU Commission or the Swiss Federal Data Protection Authority (as applicable) (“Approved Jurisdiction”), the Parties hereto hereby agree to execute and incorporate into this DPA the Standard Contractual Clauses, with the elections and supplements set forth in Exhibit D attached hereto.

13.2. Company shall be deemed the “data importer” and Customer the “data exporter” under the Standard Contractual Clauses.

13.3.  If the European Commission subsequently amends the Standard Contractual Clauses at a date later than the Effective Date of this DPA, such amended terms will supersede and replace any Standard Contractual Clauses executed between the parties, without any further action required of the Parties hereto.

13.4.  Where UK GDPR applies, with respect to any transfer (and any subsequent onward transfer) of Personal Data by Company from the UK to any country outside the EEA or outside an Approved Jurisdiction or to a country that has not been designated by the UK authorized authority as providing an adequate level of protection for Personal Data, the Parties agree that such processing shall be subject to the UK SCC, subject to the IDTA attached as Exhibit F hereto.

13.5.  Alternative Data Export Solution. The parties agree that the data export solutions identified in Section 13 may not apply if and to the extent that Company adopts an alternative data export solution for the lawful transfer of personal data (as recognized from time to time under the Data Protection Laws) from the EEA, Switzerland or UK, as applicable, in which event, Company shall notify Customer of such alternative data export solution and it shall apply instead.

13.6.  In case of a conflict between the provision of the DPA and the provisions of the Standard Contractual Clauses or the UK SCC, the provisions of the Standard Contractual Clauses and/or the UK SCC shall apply, as applicable, unless the DPA provides more stringent protection to Personal Data and the rights of individuals in which case the latter shall prevail.

14.  Obligations under the CCPA

14.1.  To the extent that Company processes Personal Data of Californian residents and its Processing activities fall under the scope of the CCPA:

14.1.1. Company shall not sell Personal Data (as the term "sell" is defined under the CCPA). Company is also prohibited from retaining, using or disclosing such Personal Data for a commercial purpose other than providing the Subscription Service to the Customer under the Agreement, and from retaining, using or disclosing such Personal Data outside of the Agreement.

14.1.2.  Company acknowledges and understands its obligations under this clause, and will comply with them.

15.  Third Party Data Access Requests

15.1.  If Company becomes subject to a binding order or request for disclosure by a law enforcement authority or other competent government authority involving Personal Data that Company processes on behalf of Customer then, to the extent that Company identifies that such legal proceeding is in conflict with applicable Data Protection laws, Company shall make reasonable efforts, unless legally prohibited, to:

15.1.1.  Immediately notify Customer of the binding order or request unless such notification is legally prohibited;

15.1.2.  Inform the law enforcement authority or such other competent government authority that Company is merely a processor of the Personal Data and is not authorized to disclose the Personal Data without Customer’s consent;

15.1.3.  Request that such law enforcement authority or such other competent government authority direct its request directly at Customer; and

15.1.4.  Use reasonable efforts to assist the Customer in its efforts to oppose the request or order, if applicable; at Customer's expense.

15.2.  If Company provides access to or discloses Personal Data in response to third party legal process either with Customer authorization or due to a mandatory legal compulsion, then Company will only disclose such Personal Data to the extent it is legally required to do so and in accordance with applicable lawful process.

15.3.    Data Subjects have the right to enforce, as third-party beneficiary, sections ‎15.1 -‎15.2 against Company in accordance with Clause 3 of the Standard Contractual Clauses.

15.4. Clauses 15.1 and 15.2 shall not apply in the event that Company has a good-faith belief the government request is necessary due to an emergency involving immediate danger of death or serious physical injury to an individual. In such event, Company shall notify Customer of the data disclosure as soon as possible following the disclosure and provide Customer with full details of the same, unless such disclosure is legally prohibited.

16. In the event such binding order or any subsequent disclosure or action by Company prevents or would prevent Company from complying with the Standard Contractual Clauses or the Documented Instructions of Customer, Company agrees, pursuant to Clause 8(1)(b) of the Standard Contractual Clauses, to promptly inform the Customer of its inability to comply.

17. Return or Deletion of Personal Data. During the term of the Agreement and for a period of 30 days following the effective date of termination or expiration of the Agreement (“Termination Date”), Customer may request in writing to retrieve or delete Personal Data. Following the lapse of 30 days as of Termination Date, Company will delete all Personal Data unless prohibited by law or the order of a governmental or regulatory body, or if the retention of the Personal Data is required in order to fulfill any legal rights of Company, to defend any legal proceedings, or if such action may subject Company to liability.

18. Duties to Inform. Where Personal Data becomes subject to confiscation during bankruptcy or insolvency proceedings, or similar measures by third parties while being processed by Company, Company will inform Customer without undue delay. In addition, Company shall inform Customer without undue delay, when its obligations under this DPA or applicable Data Protection Laws; in which case Customer shall have the right to right to stop transmitting Personal Information, and/or request cessation of Processing.

19. Representations and Warranties. Customer represents and warrants to Company that: (1) it has the right and the authority to provide the Customer Personal Data to Company for its use of such Customer Personal Data pursuant to the Agreement and this DPA, including transfers thereof outside the EEA, UK and/or Switzerland, as stipulated hereinabove; (2) It has provided any required notices and to the extent required, has obtained any required consents from individuals as required by Data Protection Laws to collect and process their Personal Data, including, through Company (3) It is fully and solely responsible for the confidentiality, integrity and availability, of the Customer Personal Data it collects and provides to Company (except when and as processed by Company) (4) the processing of the Customer Personal Data including the provision thereof to Company will not violate any Data Protection Laws and/or any other applicable laws (5) The essence of this Agreement shall be made available to any Data Subject by Customer upon such Data Subject’s request.

20. Indemnity. To the extent Company shall be subject to any enforcement action or any third party claim, based on any acts or omissions of Customer related to the Customer Personal Data, or any failure by Customer to comply with any applicable Data Protection Laws, Customer shall hold Company harmless and fully indemnify Company at its first demand, for any expenses, losses and damages, including without limitation, reasonable attorney’s fees and any fines and levies, incurred by Company in connection with and as a result of such enforcement action or claim.

21. Entire Agreement; Conflict. Except as amended by this DPA, the Agreement will remain in full force and effect. If there is a conflict between any other agreements between the parties including the Agreement and this DPA, the terms of this DPA will prevail. In case the applicable Data Protection Laws change in a way that this DPA is no longer adequate for the purpose of governing lawful data processing as stipulated herein, the Parties agree that they will negotiate in good faith to review and amend the Agreement in light of the new legislation.

22. Jurisdiction and Governing Laws. The governing law and the applicable jurisdiction for any dispute arising out of this DPA shall be as set out in the Agreement; except that with respect to Customers having an establishment within the EEA, for any matters arising out of the Standard Contractual Clauses, or the UK SCC, or which arise out of the DPA but are superseded by the Standard Contractual Clauses and/or the UK SCC, as applicable, the Parties submit to the jurisdiction of the competent courts of the EEA member state in which the main establishment or the sole establishment of the Customer resides (or UK, as applicable).

23. General Provisions. Neither Party may assign any of its rights or obligations hereunder, whether by operation of law or otherwise, without the other party’s prior written consent (not to be unreasonably withheld); provided, however, that either Party may assign this DPA, without the other Party’s consent (but upon providing notice) in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets; including, inter alia, Company may transfer the Personal Data processed by the Company hereunder to the purchaser or successor or surviving entity, as the case may be; provided however that the latter shall Process such Customers' Personal Data under the terms of this DPA and/or any other terms to be agreed to by the Customer. This DPA is the complete and exclusive statement of the mutual understanding of the Company and Customer, and supersedes and cancels all previous written and oral agreements, communications, and other understandings relating to the subject matter of this DPA, and all waivers and modifications must be in a writing signed by both Parties, except as otherwise provided herein.

‍

Exhibit A - Definitions

Definitions. Unless otherwise defined in the Agreement, all capitalized terms used in this DPA will have the meanings given to them below:

“Affiliate” means an entity that is either controlling, controlled by, or under a common control, with the subject matter entity, whereby “control” shall mean the direct or indirect holding of more than 50% of equity ownership or voting rights.  

"CCPA" means California Consumer Privacy Act of 2018

“Users” shall have the meaning ascribed to this term in the Agreement.

“Data Subject” has the meaning assigned to it in the GDPR or CCPA, as applicable; any similar corresponding classification shall apply under any applicable Data Protection Laws.

“Data Protection Laws” means all applicable laws, regulations, and requirements of regulatory guidance, in any jurisdiction, relating to data protection, privacy, and confidentiality of personal data, including, without limitation to GDPR, PPL or CCPA and any implementing, derivative or related legislation, rule, regulation, and regulatory guidance, as amended, extended and re-enacted from time to time, applicable to either party under the Agreement, including, without limitation, GDPR in relation to processing of Personal Data of EEA Data Subjects or CCPA in relation to the processing of Personal Data of California Data Subjects. Any reference to a legal framework, statute or other legislative enactment is a reference to it as amended or re-enacted from time to time.

“EEA” means the European Economic Area.

“GDPR” means Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

“Processing” has the meaning given to it in the Data Protection Laws, and “process”, “processes” and “processed” will be interpreted accordingly.

“PPL” the Protection of Privacy Law 1981 and the regulations enacted thereunder, and any amendments or replacements to the foregoing

“Security Incident” means a breach of Company's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

“Standard Contractual Clauses” or "EU SCC" means Annex 1, attached to and forming part of this DPA pursuant to the European Commission Decision of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.  

“Customer Personal Data” means Personal Data of any User other than information collected upon registration to the Subscription Services.  

“Personal Data” as defined in the Data Protection Laws as applicable

“UK SCC” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses or the International Data Transfer Agreement as issued by the UK Commissioner under S119A(1) of the Data Protection Act 2018, attached as Appendix 2 hereto, including any amended, extended, re-enacted or consolidated version in force from time to time.

‍

Exhibit B – Data Processing Details

‍

1. List of Parties:

1. Controller (Data exporter(s) for the purpose of Standard Contractual Clauses):

Name: Customer's entity that has executed the Agreement

Address: Customer's entity's address

Contact person’s name, position and contact details: As provided by Customer on registration to the Subscription Services

Activities relevant to the data transferred under these Clauses: provision of the Subscription Services

Role (controller/processor): Controller

Data Protection Officer contact details: As provided by Customer on registration to the Subscription Services or as published by Controller  

EU representative contact details: as provided by Customer on registration to the Subscription Services, if applicable

2. Processor (Data importer(s) for the purpose of Standard Contractual Clauses):

Name: xtype.io Inc.  

Address: 440 N Barranca Ave. Suite 7741 Covina, CA, 91723, US

Contact person’s name, position and contact details: Yonatan Adomi, General Counsel,

yonatan.admoni@xtype.io

Activities relevant to the data transferred under these Clauses:  provision of the Subscription Services

Role (controller/processor): Processor

Data Protection Officer contact details: compliance@xtype.io  

UK representative contact details: compliance@xtype.io

2. Description of data processing

1. Subject matter. The subject matter of the data processing under this DPA is Customer Personal Data provided to Company or made accessible to Company by Customer in the context of the performance of the Agreement, and provisions of the Subscription Service.

2. Duration. The duration of the data processing under this DPA is determined by Customer. Customer has the sole discretion to remove any Customer Personal Data (without prejudice to any other right under any applicable law to request access, deletion or restriction of processing granted to any Data Subject, to the extent granted).

3. Purpose. The purpose of the data processing under this DPA is to enable the proper use by Customer of the Subscription Services, as intended and provided by Company to Customer, under the Agreement and in accordance with terms of the Agreement.

4. Nature of the processing: the processing of the Personal Data is comprised of storing, analyzing, computing, transferring, organizing and presenting of data, including without limitation the Customer Personal Data, as part of the Subscription Service, for the benefit of the Customer’s purposes.

5. Categories of Data: the Personal Data processed hereunder may contain the following:  

Pertaining to Customer Users: (i) first and last name; (ii) email address; (iii) an identification number assigned by the Company's Subscription Service platform to the User ; (iv) name of the employing company.

6. Categories of data subjects: The data subjects may include any persons using the Subscription Services for and on behalf of the Customer, such as its employees, consultants, contractors, and agents of Customer.  

7. The frequency of the processing:  On an ongoing basis.

8. The period for which the personal data will be retained: in accordance with the DPA

3. Competent supervisory authority in accordance with Clause 13:

EU/EEA: [Customer to provide] the identity of its Lead Supervisory Authority (Data Exporter’s LSA).

Switzerland: FDPIC.

UK: ICO.

‍

‍

Exhibit C – Sub-Processor List

‍

Exhibit D - Security Standards

‍

1. Scope & Principles
   xtype maintains administrative, technical, and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Our program follows defense-in-depth, least privilege, and privacy-by-design principles, aligned to SOC 2 Type II controls and industry best practices.
   

2. Governance & Compliance

• Policies & training: Formal security, access, incident-response, secure-development, and vendor-risk policies; mandatory security & privacy training for all personnel with annual refreshers.

• Independent assurance: Annual external penetration testing and SOC 2 Type II attestation. Remediation is tracked to closure.

• Vendor management: Risk-based due diligence, DPAs; change notifications provided via our support portal.
  

3. Architecture & Isolation

• Cloud infrastructure: Hosted on AWS with multi-AZ redundancy, environment segregation (production/staging/test), and strict network segmentation.

• Customer content boundaries & metadata-only processing: xtype orchestrates syncs and governance actions using operational metadata (e.g., object identifiers, environment names, job IDs, timestamps, status flags, non-content checksums).

• No customer content/IP in the backend: Customer ServiceNow content and IP remain in Customer instances. The xtype backend does not require or store payload contents, credentials, or other sensitive customer information. All network flows are customer-initiated from ServiceNow to xtype; there are no backend-initiated connections into Customer systems.

• Minimal PII handling (traceability only): To display provenance and audit trails, xtype may process limited account identifiers surfaced by ServiceNow (e.g., usernames associated with update sets or actions). Such identifiers are treated as operational metadata, scoped by role-based access, excluded from payload logs, and retained only per log retention policy. No special-category information, behavioral profiling, or marketing use.

• Optional customer uploads: If Customers choose to upload artifacts (e.g., XML or fix scripts) during release workflows, content is encrypted client-side within Customer’s ServiceNow instance with Customer-held keys before transit; xtype cannot decrypt it and treats it as an opaque artifact in transit.
  

4. Encryption & Key Management

• In transit: TLS (modern ciphers; TLS 1.2+ with 1.3 preferred) for all external service endpoints.

• At rest: Strong encryption (e.g., AES-256) for storage and backups; keys managed via AWS KMS with separation of duties and access logging.

• Secrets hygiene: Centralized secret storage with least-privilege access. xtype API tokens are automatically rotated daily. Other internal service credentials are rotated on risk-based triggers (e.g., personnel/access changes, compromise indicators, or configuration changes).
  

5. Access Control & Identity

• RBAC & least privilege: Role-based access with need-to-know scoping; periodic access reviews and immediate revocation on role change or offboarding.

• Strong auth: MFA enforced for privileged access; SSO supported for console and admin tooling.

• Customer-side controls: Fine-grained application roles and permissions; audit trail for sensitive operations.

6. Network & Platform Security

• Segmentation & hardening: security groups, and minimal inbound exposure; hardened AMIs and container images; automated configuration baselines.

• Edge protections: input validation, xtype’s API is not public, which reduces exposure to volumetric attacks.

• Monitoring: Centralized logging, metric and alerting pipelines
  

7. Secure Development & Testing

• SDLC: Secure coding standards, peer review, and CI/CD with automated checks.

• Security testing: SAST, dependency and container image scanning, and DAST on critical services; blocking severity SLAs for fixes.

• Feature flags & gradual rollout: Risk-reduced releases via feature flags and phased enablement.
  

8. Vulnerability & Patch Management

• Scanning cadence: Continuous scanning of images, dependencies, and infrastructure.

• Remediation SLAs: Critical - expedite; High - target within days; Medium/Low - tracked in backlog with risk-based prioritization.

• Third-party advisories: Subscription to vendor and CERT feeds; emergency patching process defined.
  

9. Logging, Monitoring & Incident Response

• Audit logging: Authentication events (including login attempts), administrative actions, and security-relevant application events are logged and retained per policy. AWS control-plane activity is captured. Logs are designed to exclude payload contents; they may include limited operational identifiers (e.g., usernames) for traceability.

• Monitoring & alerting: We maintain baseline health and availability monitoring with threshold-based alerts delivered to internal engineering channels. Alerts are reviewed during business hours with expedited escalation for high-severity issues.

• Incident response: A documented Incident Response process governs triage, containment, remediation, recovery, and post-incident review. Roles and communication paths are defined, including coordination with affected Customers as needed.

• Breach notification: Customers are notified without undue delay and within applicable legal timeframes once a notifiable personal-data breach is confirmed.
  

10. Business Continuity & Disaster Recovery

• Backups: Automated daily backups with encrypted storage.

• Resilience: Multi-AZ deployment and automated service restarts for common failure modes.

• Deletion: On Customer request, Customer Personal Data is returned or deleted.
  

11. Data Subject Rights & Cooperation
    xtype will assist the Customer (as controller) in fulfilling Data Subject requests (access, rectification, erasure, restriction, portability) and in performing DPIAs or consultations with supervisory authorities, in each case to the extent required under applicable law.
    

12. Subprocessors

Subprocessors. xtype uses a small set of infrastructure/platform providers under their standard subscription terms. We rely on each vendor’s published DPA/transfer mechanism and review their public security attestations (e.g., SOC 2/ISO) on a risk-based cadence. Customer content remains in Customer’s ServiceNow instances; subprocessors primarily handle infrastructure/operational metadata. Our current subprocessor list is published, and we notify Customers of material changes according to the DPA.

‍

‍

Annex 1 – Standard Contractual Clauses

The Terms of the EU Standard Contractual Clauses  shall be incorporated by reference to this DPA as follows:

‍

1. With regards to clauses 8 to 18 of the Standard Contractual Clauses, Module Two will apply. The Parties agree to include the optional Clause 7 (Docking clause) to the Standard Contractual Clauses incorporated into this Addendum. For the purpose of Clause 9 (a) Option 2: General Written Authorization shall apply. In Clause 11, data subjects shall not be able to lodge a complaint with an independent dispute resolution body. In Clause 17, Option 1 shall apply.  

2. Annex I to the EU SCC Shall have the details set in Exhibit B of the DPA.

3. Annex II to the EU SCC shall have the details set here: The current list of subprocessors is published in the xtype Support Portal Knowledge Base and is incorporated by reference into this DPA. It is accessible at https://xtype.service-now.com (search: “Subprocessors”). If the URL or article slug changes, xtype will provide the updated location and continue to provide advance notice of material changes as set out in the DPA.

4. Annex III to the EU SCC shall have the details set in Exhibit D of the DPA.

‍

Exhibit F – UK IDTA

‍

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

‍

VERSION B1.0, in force 21 March 2022

‍

This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.

‍

Part 1: Tables

‍

Table 1: Parties

Exhibit D - Security Standards

‍

1. Scope & Principles
   xtype maintains administrative, technical, and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Our program follows defense-in-depth, least privilege, and privacy-by-design principles, aligned to SOC 2 Type II controls and industry best practices.
   

2. Governance & Compliance

• Policies & training: Formal security, access, incident-response, secure-development, and vendor-risk policies; mandatory security & privacy training for all personnel with annual refreshers.

• Independent assurance: Annual external penetration testing and SOC 2 Type II attestation. Remediation is tracked to closure.

• Vendor management: Risk-based due diligence, DPAs; change notifications provided via our support portal.
  

3. Architecture & Isolation

• Cloud infrastructure: Hosted on AWS with multi-AZ redundancy, environment segregation (production/staging/test), and strict network segmentation.

• Customer content boundaries & metadata-only processing: xtype orchestrates syncs and governance actions using operational metadata (e.g., object identifiers, environment names, job IDs, timestamps, status flags, non-content checksums).

• No customer content/IP in the backend: Customer ServiceNow content and IP remain in Customer instances. The xtype backend does not require or store payload contents, credentials, or other sensitive customer information. All network flows are customer-initiated from ServiceNow to xtype; there are no backend-initiated connections into Customer systems.

• Minimal PII handling (traceability only): To display provenance and audit trails, xtype may process limited account identifiers surfaced by ServiceNow (e.g., usernames associated with update sets or actions). Such identifiers are treated as operational metadata, scoped by role-based access, excluded from payload logs, and retained only per log retention policy. No special-category information, behavioral profiling, or marketing use.

• Optional customer uploads: If Customers choose to upload artifacts (e.g., XML or fix scripts) during release workflows, content is encrypted client-side within Customer’s ServiceNow instance with Customer-held keys before transit; xtype cannot decrypt it and treats it as an opaque artifact in transit.
  

4. Encryption & Key Management

• In transit: TLS (modern ciphers; TLS 1.2+ with 1.3 preferred) for all external service endpoints.

• At rest: Strong encryption (e.g., AES-256) for storage and backups; keys managed via AWS KMS with separation of duties and access logging.

• Secrets hygiene: Centralized secret storage with least-privilege access. xtype API tokens are automatically rotated daily. Other internal service credentials are rotated on risk-based triggers (e.g., personnel/access changes, compromise indicators, or configuration changes).
  

5. Access Control & Identity

• RBAC & least privilege: Role-based access with need-to-know scoping; periodic access reviews and immediate revocation on role change or offboarding.

• Strong auth: MFA enforced for privileged access; SSO supported for console and admin tooling.

• Customer-side controls: Fine-grained application roles and permissions; audit trail for sensitive operations.

6. Network & Platform Security

• Segmentation & hardening: security groups, and minimal inbound exposure; hardened AMIs and container images; automated configuration baselines.

• Edge protections: input validation, xtype’s API is not public, which reduces exposure to volumetric attacks.

• Monitoring: Centralized logging, metric and alerting pipelines
  

7. Secure Development & Testing

• SDLC: Secure coding standards, peer review, and CI/CD with automated checks.

• Security testing: SAST, dependency and container image scanning, and DAST on critical services; blocking severity SLAs for fixes.

• Feature flags & gradual rollout: Risk-reduced releases via feature flags and phased enablement.
  

8. Vulnerability & Patch Management

• Scanning cadence: Continuous scanning of images, dependencies, and infrastructure.

• Remediation SLAs: Critical - expedite; High - target within days; Medium/Low - tracked in backlog with risk-based prioritization.

• Third-party advisories: Subscription to vendor and CERT feeds; emergency patching process defined.
  

9. Logging, Monitoring & Incident Response

• Audit logging: Authentication events (including login attempts), administrative actions, and security-relevant application events are logged and retained per policy. AWS control-plane activity is captured. Logs are designed to exclude payload contents; they may include limited operational identifiers (e.g., usernames) for traceability.

• Monitoring & alerting: We maintain baseline health and availability monitoring with threshold-based alerts delivered to internal engineering channels. Alerts are reviewed during business hours with expedited escalation for high-severity issues.

• Incident response: A documented Incident Response process governs triage, containment, remediation, recovery, and post-incident review. Roles and communication paths are defined, including coordination with affected Customers as needed.

• Breach notification: Customers are notified without undue delay and within applicable legal timeframes once a notifiable personal-data breach is confirmed.
  

10. Business Continuity & Disaster Recovery

• Backups: Automated daily backups with encrypted storage.

• Resilience: Multi-AZ deployment and automated service restarts for common failure modes.

• Deletion: On Customer request, Customer Personal Data is returned or deleted.
  

11. Data Subject Rights & Cooperation
    xtype will assist the Customer (as controller) in fulfilling Data Subject requests (access, rectification, erasure, restriction, portability) and in performing DPIAs or consultations with supervisory authorities, in each case to the extent required under applicable law.
    

12. Subprocessors

Subprocessors. xtype uses a small set of infrastructure/platform providers under their standard subscription terms. We rely on each vendor’s published DPA/transfer mechanism and review their public security attestations (e.g., SOC 2/ISO) on a risk-based cadence. Customer content remains in Customer’s ServiceNow instances; subprocessors primarily handle infrastructure/operational metadata. Our current subprocessor list is published, and we notify Customers of material changes according to the DPA.

‍

‍

Annex 1 – Standard Contractual Clauses

The Terms of the EU Standard Contractual Clauses  shall be incorporated by reference to this DPA as follows:

‍

1. With regards to clauses 8 to 18 of the Standard Contractual Clauses, Module Two will apply. The Parties agree to include the optional Clause 7 (Docking clause) to the Standard Contractual Clauses incorporated into this Addendum. For the purpose of Clause 9 (a) Option 2: General Written Authorization shall apply. In Clause 11, data subjects shall not be able to lodge a complaint with an independent dispute resolution body. In Clause 17, Option 1 shall apply.  

2. Annex I to the EU SCC Shall have the details set in Exhibit B of the DPA.

3. Annex II to the EU SCC shall have the details set here: The current list of subprocessors is published in the xtype Support Portal Knowledge Base and is incorporated by reference into this DPA. It is accessible at https://xtype.service-now.com (search: “Subprocessors”). If the URL or article slug changes, xtype will provide the updated location and continue to provide advance notice of material changes as set out in the DPA.

4. Annex III to the EU SCC shall have the details set in Exhibit D of the DPA.

‍

Exhibit F – UK IDTA

‍

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

‍

VERSION B1.0, in force 21 March 2022

‍

This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.

‍

Part 1: Tables

‍

Table 1: Parties

Table 2: Selected SCCs, Modules and Selected Clauses

Table 3: Appendix Information

‍

“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:

Annex 1A: List of Parties: as provided in Exhibit B

Annex 1B: Description of Transfer: as provided in Exhibit B

Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data: as provided in Exhibit B

Annex III: List of Sub processors (Modules 2 and 3 only): See Annex III of EU SCC as provided in Exhibit B

‍

Table 4: Ending this Addendum when the Approved Addendum Changes

Part 2: Mandatory Clauses

‍

Entering into this Addendum

1. Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.

2. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.

Interpretation of this Addendum  

3. Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:

4. This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.  

5. If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.

6. If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws applies.

7. If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.  

8. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.  

Hierarchy  

9. Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in Section ‎10 will prevail.

10. Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.

11. Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs.

Incorporation of and changes to the EU SCCs

12. This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that:

1. together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers;  

2. Sections ‎9 to ‎11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and

3. this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.

13. Unless the Parties have agreed alternative amendments which meet the requirements of Section ‎12, the provisions of Section ‎15 will apply.

14. No amendments to the Approved EU SCCs other than to meet the requirements of Section ‎12 may be made.

15. The following amendments to the Addendum EU SCCs (for the purpose of Section ‎12) are made:  

1. References to the “Clauses” means this Addendum, incorporating the Addendum EU SCCs;

2. In Clause 2, delete the words:

“and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;

3. Clause 6 (Description of the transfer(s)) is replaced with:

“The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”;

4. Clause 8.7(i) of Module 1 is replaced with:

“it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer”;

5. Clause 8.8(i) of Modules 2 and 3 is replaced with:

“the onward transfer is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”

6. References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;

7. References to Regulation (EU) 2018/1725 are removed;

8. References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;

9. The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;

10. Clause 13(a) and Part C of Annex I are not used;  

11. The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;

12. In Clause 16(e), subsection (i) is replaced with:

“the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;

13. Clause 17 is replaced with:

“These Clauses are governed by the laws of England and Wales.”;

14. Clause 18 is replaced with:

“Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and

15. The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11.  

Amendments to this Addendum  

16. The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.

17. If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.

18. From time to time, the ICO may issue a revised Approved Addendum which:  

1. makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or

2. reflects changes to UK Data Protection Laws;

The revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.  

19. If the ICO issues a revised Approved Addendum under Section ‎18, if any Party selected in Table 4 “Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in:  

1. its direct costs of performing its obligations under the Addendum; and/or  

2. its risk under the Addendum,  

and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.

20. The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms.

Alternative Part 2 Mandatory Clauses:

‍