Data Processing Addendum

Last updated: August 20, 2026

How this applies. This Data Processing Addendum (“DPA”) is incorporated into and forms part of the Glyde Terms of Service or other written agreement between you and WOX LLC covering the Services (the “Agreement”). It applies automatically, with no signature required, where you are a Controller or Processor subject to Applicable Data Protection Laws and Glyde Processes Personal Data on your behalf.

If your procurement process requires a countersigned copy, email support@glydehq.com with the subject line “DPA Request” and the legal name and address of your contracting entity, and we will return an executed version of this document.

1. Definitions

The terms below have the meanings set out here. Capitalized terms not defined in this DPA have the meanings given in the Agreement. In this DPA, “Glyde,” “we,” and “us” mean WOX LLC, and “Customer” and “you” mean the counterparty to the Agreement.

Affiliate: — any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity, where “control” means the power to direct or cause the direction of that entity, whether through ownership of voting securities, by contract, or otherwise.
Applicable Data Protection Laws: — the privacy, data protection, and data security laws and regulations applicable to Glyde’s Processing of Personal Data under the Agreement, including, as and to the extent applicable, the State Privacy Laws and the GDPR.
Controller: — the entity that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data, including any “business” or “controller” as defined by the California Consumer Privacy Act (the “CCPA”) or other State Privacy Laws.
Customer Data: — information provided or otherwise made available by or on behalf of Customer to Glyde for Processing on Customer’s behalf to perform the Services, including recordings, screenshots, audio, transcripts, and generated documentation.
Data Subject: — the identified or identifiable natural person to whom Personal Data relates.
EEA: — the European Economic Area.
FADP: — the Swiss Federal Act on Data Protection of 25 September 2020, as amended, together with any applicable implementing legislation and ordinances.
FDPIC: — the Swiss Federal Data Protection and Information Commissioner.
GDPR: — as and where applicable to the Processing concerned: (i) Regulation (EU) 2016/679 (the “EU GDPR”); and (ii) the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the “UK GDPR”), including in each case any national implementing or supplementary legislation such as the UK Data Protection Act 2018, and any successor, amendment, or re-enactment.
Information Security Incident: — a breach of Glyde’s security resulting in the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data in Glyde’s possession, custody, or control. This does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, such as unsuccessful log-in attempts, pings, port scans, or denial of service attacks.
Personal Data: — Customer Data that constitutes “personal data,” “personal information,” or “personally identifiable information” as defined in Applicable Data Protection Laws, or information of a similar character regulated by them. Personal Data does not include information that Glyde receives, collects, or generates independently of the Services and not from or on behalf of Customer.
Process or Processing: — any operation performed by Glyde, or on Glyde’s behalf, for Customer under the Agreement on Personal Data, whether or not by automated means — including collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure by transmission, alignment, restriction, erasure, or destruction.
Processor: — the entity that Processes Personal Data on behalf of the Controller, including any “service provider” or “contractor” as defined by the CCPA.
Restricted Transfer: — the disclosure, grant of access, or other transfer of Personal Data to any person located in: (i) in the context of the EEA, a country outside the EEA without a European Commission adequacy decision (an “EU Restricted Transfer”); (ii) in the context of the UK, a country outside the UK without a UK Government adequacy decision (a “UK Restricted Transfer”); and (iii) in the context of Switzerland, a country outside Switzerland without a Swiss adequacy decision (a “Swiss Restricted Transfer”).
SCCs: — the standard contractual clauses approved by the European Commission pursuant to Implementing Decision (EU) 2021/914.
Services: — the Glyde screen recording and documentation service provided under the Agreement.
State Privacy Laws: — the comprehensive U.S. state data privacy laws, and any implementing regulations, in effect and applicable to Glyde’s Processing of Personal Data under the Agreement, including the CCPA as amended by the CPRA and the comparable laws of Texas, Virginia, Colorado, Connecticut, and other states.
Subprocessor: — Glyde’s Affiliates and third parties that Glyde engages to Process Personal Data in relation to the Services.
Supervisory Authority: — any entity with authority to enforce Applicable Data Protection Laws, including (i) in the context of the EEA, as defined in the EU GDPR; (ii) in the context of the UK, the Information Commissioner’s Office; and (iii) in the context of Switzerland, the FDPIC.
UK Transfer Addendum: — template Addendum B.1.0 issued by the Information Commissioner’s Office and laid before Parliament under s119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18 of the Mandatory Clauses in Part 2 of it.

2. Duration and Scope

This DPA remains in effect for as long as Glyde Processes Personal Data, notwithstanding the expiration or termination of the Agreement.

Processing of Personal Data subject to the GDPR is also subject to Annex 2 (European Annex).

Processing of Personal Data subject to the State Privacy Laws, where Customer is a business, controller, processor, or service provider under those laws, is also subject to Annex 3 (State Privacy Laws Annex).

3. Customer Instructions

Glyde will Process Personal Data only in accordance with Customer's documented instructions, including as set out in this DPA, the Agreement, any applicable order form, and any other written instructions Customer provides that are consistent with the Agreement and this DPA. By entering into this DPA, Customer instructs Glyde to Process Personal Data to provide the Services and to perform its obligations and exercise its rights under the Agreement.

Where Customer requests instructions outside the scope of the Services, or that would require Glyde to materially change the Services or undertake work not contemplated by the Agreement, the parties will agree those instructions in a mutually executed amendment.

The details of Glyde's Processing, including the roles of the parties, are described in Annex 1 (Data Processing Details).

4. Security

(a) Security Measures

Glyde will implement and maintain the technical and organizational measures described in Annex 4 (the “Security Measures”), designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access, taking into account the state of the art, the cost of implementation, and the nature, scope, context, and purposes of the Processing and the risks to Data Subjects. Glyde may update the Security Measures from time to time, provided the updated measures do not materially decrease the overall protection of Personal Data.

(b) Personnel

Glyde will ensure that personnel authorized to access Personal Data are subject to appropriate written confidentiality obligations.

(c) Information Security Incidents

Glyde will notify Customer without undue delay, and in any event within 72 hours, of any Information Security Incident of which Glyde becomes aware. The notification will describe, to the extent then known, the nature of the incident, the categories and approximate volume of Personal Data affected, the likely consequences, the steps taken to mitigate it, and any steps Glyde recommends Customer take.

Glyde will reasonably cooperate with Customer and take commercially reasonable steps within its control to assist in investigating the incident. Notification of or response to an Information Security Incident is not an acknowledgement of fault or liability.

Customer is solely responsible for complying with notification laws applicable to it and for any third-party notification obligations. Where a notification directly or indirectly identifies Glyde, Customer agrees, where permitted by law, to notify Glyde in advance and to consider in good faith any clarifications or corrections Glyde reasonably requests that relate to Glyde's involvement and are consistent with applicable law.

5. Customer Security Responsibilities

(a) Customer Responsibilities

Without limiting Glyde's obligations under Section 4, Customer is solely responsible for its use of the Services, including making appropriate use of the Services to ensure a level of security appropriate to the risk; securing the credentials, systems, and devices it uses to access the Services; securing any systems it makes available for Glyde to access; and maintaining its own backups of Personal Data where appropriate.

(b) Customer Assessment

Customer confirms that it has evaluated the Services, the Security Measures, and Glyde's commitments under this DPA, and that based on the information made available to it, they are adequate to meet its needs and provide a level of security appropriate to the risk in respect of the Personal Data.

6. Data Subject Rights

(a) Assistance

Taking into account the nature of the Processing, Glyde will provide Customer with assistance reasonably necessary and technically feasible for Customer to fulfil requests by Data Subjects to exercise their rights under Applicable Data Protection Laws (“Data Subject Requests”) in respect of Personal Data in Glyde's possession or control. Where such assistance requires work beyond the Services, Customer will compensate Glyde at its then-current professional services rates, and Glyde will provide a good-faith estimate on request.

(b) Requests Received by Glyde

If Glyde receives a Data Subject Request relating to Customer, Glyde will promptly notify Customer unless prohibited by law, and will direct the Data Subject to submit the request to Customer. Customer is solely responsible for responding, unless applicable law requires otherwise.

7. Customer Responsibilities and Restricted Data

(a) Notices and consents. Customer is solely responsible for ensuring that it has provided all notices to, and obtained all consents and permissions from, third parties including Data Subjects, and has reserved all necessary rights, as required under Applicable Data Protection Laws for Glyde to Process Personal Data as contemplated by the Agreement. Because the Services record screens and, optionally, audio, this includes any consent required to record individuals who appear or are heard in a recording.

(b) Legal basis. Customer will ensure that there is, throughout the term of the Agreement, a valid legal basis for Glyde's Processing of Personal Data under all Applicable Data Protection Laws, including where applicable Articles 6, 9(2), and 10 of the GDPR, and that all Data Subjects have been given the notices required by Articles 12–14 of the GDPR where applicable.

(c) Restricted Data. Customer represents and warrants that Customer Data does not and will not contain any of the following without the parties' prior written agreement (“Restricted Data”):

Social security numbers or other government-issued identification numbers
Protected health information subject to HIPAA, or other information about an individual's medical history, physical or mental condition, treatment, or diagnosis, or health insurance information
Biometric information
Passwords or credentials for third-party accounts, other than credentials created solely to access the Services, and credentials to any financial account
Tax return data
Payment card information subject to the Payment Card Industry Data Security Standard
Personal Data of children under 16 years of age
Any other information falling within a special category of data as defined in Applicable Data Protection Laws, or “sensitive data” as defined in Clause 8.7 of the SCCs

8. Subprocessors

(a) Authorization

Customer specifically authorizes the engagement of Glyde's Affiliates as Subprocessors, and generally authorizes Glyde to engage third parties as Subprocessors in accordance with this Section 8.

(b) Current Subprocessors

The current list of Subprocessors, including their functions and locations, is maintained at glydehq.com/privacy#subprocessors (the “Subprocessor Site”) and reproduced in Annex 5. Customer approves the Subprocessors listed there as of the effective date of this DPA.

(c) Requirements

When engaging a Subprocessor, Glyde will enter into a written contract containing data protection obligations no less protective than those in this DPA, to the extent applicable to the nature of the services provided. Glyde remains responsible for the performance of all obligations subcontracted to a Subprocessor and is liable for its acts and omissions to the same extent as if Glyde had performed the Processing itself.

(d) Objection to Changes

Before engaging a new Subprocessor that will Process Personal Data, Glyde will notify Customer by updating the Subprocessor Site and giving written notice, including by email, to Customer's designated contact. If Customer objects within 15 days of that notice on reasonable grounds relating to the protection of Personal Data, the parties will work together in good faith to find a mutually acceptable resolution. If they cannot reach one within a reasonable time, Customer may, as its sole and exclusive remedy, terminate the Agreement and cancel the Services on written notice, paying all amounts due as of the termination date.

9. Audits

Customer may audit Glyde's compliance with this DPA up to once per year, and on such other occasions as Applicable Data Protection Laws require, on written request giving reasonable detail and, where available, supporting documentation of the requirement. Glyde will contribute by providing the information and assistance reasonably necessary to conduct the audit.

Where the controls to be assessed are addressed in a SOC 2 Type 1 or Type 2, ISO, NIST, or similar report prepared by a qualified third-party auditor within the preceding 12 months, and Glyde confirms there have been no known material changes to the audited controls, Customer agrees to accept that report in lieu of an audit of those controls. Glyde makes its current report available, subject to a customary non-disclosure agreement, to Customers on an enterprise plan or with a separate written agreement with Glyde, and may make it available to other Customers on written request.

Customer must submit a proposed audit plan describing the scope, duration, and start date at least two weeks in advance. Any third-party auditor must sign a customary non-disclosure agreement, and Glyde may object to an auditor that is, in its reasonable opinion, not independent, a competitor, or otherwise manifestly unsuitable, in which case Customer will appoint another auditor or conduct the audit itself. Audits must take place during regular business hours, must follow the agreed plan and Glyde's safety and security policies, and must not unreasonably interfere with Glyde's business. Nothing in this Section requires Glyde to breach a duty of confidentiality.

Customer will promptly notify Glyde of any non-compliance found and provide any resulting audit reports, unless prohibited by Applicable Data Protection Laws, and may use those reports only to meet its regulatory audit requirements or confirm compliance with this DPA. Audits are at Customer's sole expense, including reasonable documented costs incurred by Glyde at its then-current professional services rates.

10. Return and Deletion

(a) On the date the Services involving the Processing of Personal Data cease (the “Cessation Date”), Glyde will promptly stop Processing Personal Data for any purpose other than storage and the Processing necessary to return, delete, or anonymize it, or as otherwise permitted or required by this DPA or applicable law.

(b) On written request made within 30 days after the Cessation Date (the “Post-cessation Storage Period”), and to the extent technically feasible, Glyde will within a commercially reasonable period either (i) return a complete copy of all Personal Data in its possession by a secure method and then delete or anonymize all other copies, or (ii) delete or anonymize all Personal Data in its possession, as Customer elects.

(c) If Customer gives no such instruction during the Post-cessation Storage Period, Glyde will, within a commercially reasonable time after it expires, delete or anonymize all Personal Data then in its possession, custody, or control to the fullest extent technically feasible.

(d) Glyde may retain Personal Data to the extent permitted or required by applicable law, for no longer than that law requires, provided it maintains the confidentiality of the data and protects it in accordance with the Security Measures, Processes it only for the purpose requiring retention, and deletes or anonymizes it once retention is no longer required. Certification of deletion will be provided on written request.

11. Artificial Intelligence and Automated Processing

(a) Glyde will not use Personal Data to train, fine-tune, develop, or improve any artificial intelligence or machine learning model, whether its own or a third party's, unless that use is reasonably necessary to provide the Services in accordance with Customer's documented instructions or is expressly authorized by Customer in writing.

(b) Glyde will contractually prohibit its Subprocessors, including AI model providers, from using Personal Data for their own model training, fine-tuning, development, or improvement, except as expressly authorized by Customer in writing.

(c) Customer acknowledges that providing the Services requires transmitting Customer Data to the AI model providers identified on the Subprocessor Site, which Process it to generate documentation and return it to the Services. Those providers may retain submitted content for a limited period for abuse monitoring as required by their own terms, after which it is deleted.

(d) The Services do not carry out automated decision-making that produces legal or similarly significant effects on Data Subjects. If that changes, Glyde will disclose it to Customer, provide meaningful information about the logic involved to the extent reasonably available and without disclosing trade secrets, and reasonably cooperate with Customer to enable Data Subjects to exercise their rights.

12. Miscellaneous

(a) Except as expressly modified here, the Agreement remains in full force and effect. The parties agree that Glyde's access to Personal Data does not form part of the consideration exchanged under the Agreement.

(b) Notices Glyde is required or permitted to give Customer under this DPA may be given in accordance with the notice provisions of the Agreement, to Customer's data protection contact in Annex 1, to Glyde's primary points of contact with Customer, or to any email address Customer designates for Services-related communications. Customer is responsible for keeping those addresses valid.

(c) Glyde will cooperate in good faith with Customer to consider amendments reasonably necessary to address compliance with Applicable Data Protection Laws, and may on written notice vary this DPA solely to the extent necessary to maintain such compliance, provided the variation does not materially reduce the protections afforded to Personal Data or materially increase Customer's obligations without Customer's written agreement.

(d) To the extent permitted by Applicable Data Protection Laws and the SCCs, each party's total aggregate liability under or in connection with this DPA and the SCCs is subject to, and will not exceed, the limitations and exclusions of liability agreed in the Agreement. Nothing in this paragraph affects any person's liability to Data Subjects under the third-party beneficiary provisions of the SCCs.

(e) In the event of conflict, this DPA prevails over the Agreement, and any SCCs entered into under Annex 2 prevail over this DPA and the Agreement in respect of the Restricted Transfer to which they apply.

Annex 1 — Data Processing Details

Glyde / Data Importer

Name: WOX LLC, a Washington limited liability company
Address: 539 W. Commerce St #8166, Dallas, TX 75208, USA
Data protection contact: support@glydehq.com
Activities: Provision of the Glyde screen recording and documentation Services, which convert customer screen recordings into written standard operating procedures
Role: Processor, or Subprocessor where Customer is itself a Processor

Customer / Data Exporter

Name: The entity that is a counterparty to the Agreement
Address and data protection contact: As recorded in Customer's account, or as notified to Glyde in writing
Activities: Use and receipt of the Services under the Agreement as part of Customer's ongoing business operations
Role: Controller, or Processor where acting on behalf of a further controller

Categories of Data Subjects

Customer's personnel, including employees and contractors, who use the Services; individuals who appear in, are audible in, or whose information is visible in recordings Customer creates; and Customer's business contacts and representatives.

Categories of Personal Data

Personal details — names, email addresses, job titles, and similar identifying and contact information
Authentication details — usernames, hashed credentials, and authentication tokens used to access the Services
Technical details — IP addresses, device and browser identifiers, extension version, and application activity and diagnostic data
Recorded content — screen recordings, screenshots, optional audio, transcripts, and generated documentation, together with any Personal Data incidentally visible or audible in them

Sensitive Data

None. As set out in Section 7(c), Customer must not submit Restricted Data, which includes sensitive data as defined in Clause 8.7 of the SCCs, without the parties' prior written agreement. No additional safeguards apply.

Frequency, Nature, Purpose, and Duration

Frequency of transfer: Continuous, as initiated by Customer through its use of the Services
Nature of the Processing: The Processing operations required to provide the Services and perform Glyde's obligations under the Agreement and this DPA, including storage, transcription, and AI-assisted generation of documentation
Purpose: To provide the Services as initiated by Customer and to comply with Customer's documented instructions
Duration and retention: For the period determined under the Agreement and Section 10 of this DPA
Transfers to Subprocessors: As described from time to time on the Subprocessor Site and in Annex 5

Annex 2 — European Annex

1. Processing of Personal Data

Where Glyde receives an instruction from Customer that, in its reasonable opinion, infringes the GDPR, Glyde will inform Customer. Customer agrees that any instruction it issues in respect of the Processing of Personal Data will comply with the GDPR and all other applicable laws.

2. Data Protection Impact Assessments

Taking into account the nature of the Processing and the information available to it, Glyde will provide reasonable assistance, at Customer's cost and on written request, to the extent reasonably necessary and technically feasible, with any data protection impact assessment or prior consultation with a Supervisory Authority required of Customer under Article 35 or 36 of the GDPR, in each case solely in relation to Glyde's Processing of Personal Data.

3. Restricted Transfers

3.1 EU Restricted Transfers. Where Processing under this DPA involves an EU Restricted Transfer from Customer to Glyde, the parties will comply with their obligations under the SCCs, which are deemed entered into and incorporated into this DPA by reference and populated as set out in paragraph 4 below.

3.2 UK Restricted Transfers. Where Processing involves a UK Restricted Transfer, the parties will comply with the SCCs as varied by the UK Transfer Addendum, which is deemed entered into and completed as follows: Tables 1, 2, and 3 are populated with the corresponding information in Annex 1 and paragraph 4 below; and in Table 4, neither party may end the Addendum as set out in Section 19 of it.

3.3 Swiss Restricted Transfers. Where Processing involves a Swiss Restricted Transfer, the parties will comply with the SCCs, subject to the following substitutions: “GDPR” means the FADP; “European Union,” “Union,” and “Member State” each mean Switzerland; and “supervisory authority” means the FDPIC.

3.4 New transfer mechanisms. Glyde may, on notice, vary this DPA and replace the SCCs with an alternative transfer mechanism recognized under Applicable Data Protection Laws, provided the replacement affords no less protection to Personal Data.

3.5 Executed copies. On specific written request from Customer accompanied by suitable supporting evidence that a Supervisory Authority, Data Subject, or further controller has required it, Glyde will provide within a reasonable time an executed version of the relevant SCCs, populated in accordance with paragraph 4, for countersignature by Customer.

3.6 Related provisions. When complying with its transparency obligations under Clause 8.3 of the SCCs, Customer will take appropriate steps to protect Glyde's trade secrets and commercially sensitive information. For Clause 10(a) of Module Three, Customer acknowledges that it is solely responsible for notifying any third-party controller of a Data Subject Request. For Clause 15.1(a), Customer is solely responsible for making any notifications to Data Subjects. Section 8 of this DPA governs Glyde's appointment of Subprocessors under the SCCs, and any approval given or deemed given under that Section constitutes Customer's documented instruction to effect onward transfers under Clause 8.8. The audits described in Clauses 8.9(c) and 8.9(d) are subject to Section 9 of this DPA. Certification of deletion under Clauses 8.5 and 16(d) will be provided only on written request.

4. Population of the SCCs

Signature. By agreeing to this DPA, each party is deemed to have signed the SCCs, including their annexes, as of the effective date of this DPA.
Modules. Module Two (controller to processor) applies where Customer is a Controller. Module Three (processor to processor) applies where Customer is a Processor acting on behalf of a further controller.
Clause 7 (docking clause). Applies.
Clause 9 (subprocessors). Option 2, general written authorization, applies, with the notice period set at 15 days as described in Section 8(d) of this DPA.
Clause 11 (redress). The optional independent dispute resolution language does not apply.
Clause 13 and Annex I Part C. The competent Supervisory Authority is the authority of the EEA Member State in which Customer, as data exporter, is established. Where Customer is not established in the EEA, it is the authority of the Member State in which Customer's Article 27 representative is established, or failing that, the authority of the Member State in which the Data Subjects are located.
Clause 17 (governing law). Option 1 applies, and the SCCs are governed by the law of Ireland. For UK Restricted Transfers, the law of England and Wales applies. For Swiss Restricted Transfers, Swiss law applies.
Clause 18(b) (forum). The courts of Ireland. For UK Restricted Transfers, the courts of England and Wales. For Swiss Restricted Transfers, the courts of Switzerland.
Annex I is populated with the information in Annex 1 of this DPA, Annex II with the Security Measures in Annex 4, and Annex III with the Subprocessor list in Annex 5.

Annex 3 — State Privacy Laws Annex

In this Annex, “business,” “controller,” “processor,” “commercial purpose,” “sell,” “share,” “service provider,” and “contractor” have the meanings given in the applicable State Privacy Laws, and “personal information” means Personal Data to the extent it is governed by those laws.

The parties intend that, with respect to personal information, Glyde is a service provider, contractor, or processor as applicable. Glyde: (a) acknowledges that personal information is disclosed by Customer only for the limited and specified purposes described in the Agreement; (b) will comply with its applicable obligations under the State Privacy Laws and provide the same level of privacy protection as those laws require; (c) agrees that Customer may take reasonable and appropriate steps to help ensure that Glyde's Processing is consistent with Customer's obligations; (d) will notify Customer in writing if it determines it can no longer meet its obligations under the State Privacy Laws; and (e) agrees that Customer may, on reasonable notice, take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.

Glyde will not: (a) sell or share any personal information; (b) retain, use, or disclose personal information for any purpose other than providing the Services, including for any commercial purpose other than providing the Services, except as permitted by the State Privacy Laws; (c) retain, use, or disclose personal information outside the direct business relationship between Glyde and Customer; or (d) combine personal information received under the Agreement with personal information received from or on behalf of another person, or collected from Glyde's own interaction with the Data Subject, except as permitted by the State Privacy Laws and necessary to provide the Services. Glyde certifies that it understands these obligations and will comply with them.

Giving Customer notice of Subprocessor engagements under Section 8 satisfies Glyde's obligation under the State Privacy Laws to give notice of, and an opportunity to object to, those engagements. Customer may conduct audits under Section 9 to help ensure that Glyde's use of personal information is consistent with its obligations.

The parties acknowledge that Glyde's retention, use, and disclosure of personal information authorized by Customer's instructions in the Agreement and this DPA are integral to providing the Services and to the business relationship between the parties.

Annex 4 — Security Measures

Glyde maintains the following technical and organizational measures. These measures may be updated from time to time in accordance with Section 4(a).

Security program ownership. Named personnel with assigned responsibility for developing, implementing, and maintaining Glyde’s information security program.
Risk assessment and review. Periodic review and assessment of risks to the organization, monitoring of compliance with internal policies and procedures, and reporting on the state of security to senior management.
Encryption. Industry-standard encryption for Personal Data in transit over public networks (TLS) and at rest in our storage and database layers.
Logical access controls. Role-based access granted on a need-to-know and least-privilege basis, unique user IDs, and prompt revocation of access when employment or job function changes.
Authentication controls. Multi-factor authentication for administrative access, credentials stored using industry-standard hashing and salting, minimum length and complexity requirements, and prohibition on shared passwords.
Data segregation. Logical segregation of each customer’s data, with access scoped to the customer account and organization.
Logging and monitoring. System and event logging with related monitoring procedures to record administrative access and system activity.
Physical and environmental security. Personal Data is hosted in the facilities of our cloud infrastructure providers, which maintain physical access control, environmental hazard protection, and independent audit certifications for their data centers. Glyde does not operate its own data centers.
Operational and change management. Secure configuration and maintenance of systems, review and approval of material changes affecting the security of Personal Data, and secure disposal of systems and media.
Incident management. Documented procedures to investigate, respond to, mitigate, and give notice of security events in accordance with Section 4(c) of this DPA.
Network security. Firewalls, network segmentation, and monitoring designed to protect systems from intrusion and limit the scope of any successful attack.
Vulnerability and patch management. Dependency and vulnerability scanning, timely patching, and threat protection designed to identify and mitigate known security threats and malicious code.
Personnel. Personnel authorized to access Personal Data are bound by written confidentiality obligations that survive the end of their engagement.
Resilience and recovery. Encrypted backups and documented recovery procedures designed to restore the Services and Customer Data following a foreseeable failure or disaster.

Annex 5 — List of Subprocessors

Customer approves Glyde's engagement of the Subprocessors listed at glydehq.com/privacy#subprocessors, which sets out each Subprocessor's name, the purpose for which it Processes Personal Data, and its location. That list is maintained current and forms part of this DPA. Additions are notified in accordance with Section 8(d).

Contact

Questions about this DPA, or requests for a countersigned copy, an executed set of SCCs, or a security review:

Email: support@glydehq.com
Mail: WOX LLC, 539 W. Commerce St #8166, Dallas, TX 75208, USA