DATA PROCESSING ADDENDUM

Last updated: October 15, 2026

This Data Processing Addendum ("DPA") is entered into by and between HillGenius Inc., a Delaware corporation ("HillGenius" or "Provider"), and the Customer identified in the HillGenius Terms of Service or such other written agreement governing Customer's use of the Services (the "Agreement"). This DPA is incorporated into and forms part of the Agreement.

Capitalized terms used but not defined in this DPA have the meanings given in the Agreement. This DPA is effective as of the effective date of the Agreement.

1. Definitions

1.1 "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity, where "control" refers to the power to direct or cause the direction of the management and policies of an entity.

1.2 "Applicable Data Protection Laws" means the privacy, data protection, and data security laws and regulations of any jurisdiction within the United States applicable to HillGenius's Processing of Personal Data under the Agreement, including the State Privacy Laws.

1.3 "Customer Data" means information provided or otherwise made available by or on behalf of Customer to HillGenius for Processing on Customer's behalf to provide the Services.

1.4 "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.

1.5 "Information Security Incident" means a breach of HillGenius's security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in HillGenius's possession or under its control. An Information Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, such as unsuccessful log-in attempts, pings, port scans, denial-of-service attacks, and other network attacks on firewalls or networked systems.

1.6 "Personal Data" means Customer Data that constitutes "personal data," "personal information," or "personally identifiable information" as defined in Applicable Data Protection Laws, or information of a similar nature that is subject to such laws. For the avoidance of doubt, Personal Data includes personal information about Customer's Authorized Users (such as names and business email addresses) that HillGenius Processes in providing the Services.

1.7 "Process" or "Processing" means any operation or set of operations performed by HillGenius (or on HillGenius's behalf) for Customer under the Agreement on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

1.8 "Restricted Data" means social security numbers or other government-issued identification numbers; protected health information as defined under HIPAA or other information regarding an individual's medical history, condition, treatment, or diagnosis; health insurance information; financial account numbers or any payment card information subject to the Payment Card Industry Data Security Standard; biometric identifiers; driver's license numbers; tax return data; passwords or other credentials to third-party online or financial accounts (other than credentials created solely to access the Services); personal data of children under 16 years of age; any information that falls within a special category of data as defined in Applicable Data Protection Laws; and any other categories of data identified in Annex 1 as requiring special handling.

1.9 "De-identified Data" means data that cannot reasonably be used to infer information about, or otherwise be linked to, a particular natural person or household, provided that HillGenius: (a) has implemented technical safeguards and business processes that prohibit re-identification of the data; (b) has implemented business processes to prevent inadvertent release of de-identified data; and (c) makes no attempt to re-identify the data. For the avoidance of doubt, data is considered De-identified Data if it meets the foregoing standard or any comparable standard under Applicable Data Protection Laws, and HillGenius may determine the specific technical method of de-identification in its reasonable discretion.

1.10 "Security Measures" has the meaning given in Section 4.1.

1.11 "Services" has the meaning given in the Agreement.

1.12 "State Privacy Laws" means, collectively, the comprehensive state-specific data privacy laws (and any implementing regulations) currently in effect and applicable to HillGenius's Processing of Personal Data, including the California Consumer Privacy Act (as amended by the California Privacy Rights Act), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Texas Data Privacy and Security Act, and substantially similar laws enacted or effective in other US states.

1.13 "Sub-processors" means HillGenius's Affiliates and third parties that HillGenius engages to Process Personal Data in relation to the Services.

2. Duration and Scope

2.1 Duration. This DPA will remain in effect so long as HillGenius Processes Personal Data, notwithstanding the expiration or termination of the Agreement.

2.2 Scope. Processing of Personal Data subject to the State Privacy Laws with respect to which Customer is a Business, Controller, Processor, or Service Provider (as such terms are defined in State Privacy Laws) is subject to the additional terms set out in Annex 2 (State Privacy Laws Annex).

3. Customer Instructions

3.1 Compliance with Instructions. HillGenius will Process Personal Data only in accordance with Customer's documented instructions to HillGenius, including as set out in this DPA, the Agreement, any applicable order form(s), and any other written instructions provided by Customer that HillGenius has accepted in writing.

3.2 Complete Instructions. The Agreement and this DPA (including Annex 1) constitute Customer's complete and final instructions to HillGenius at the time of execution with respect to the Processing of Personal Data. Any additional or different instructions must be mutually agreed in writing.

3.3 Inconsistent Instructions. If HillGenius reasonably considers that an instruction from Customer would be inconsistent with applicable law, or is otherwise outside the scope of the Services, HillGenius will promptly notify Customer and may decline to follow the instruction to the extent required by applicable law.

3.4 Compelled Disclosure. If HillGenius receives a subpoena, court order, warrant, or other legally binding demand from a government authority or other third party for disclosure of Personal Data, HillGenius will, to the extent legally permitted: (i) promptly notify Customer of the demand before disclosing any Personal Data, so that Customer may seek a protective order or other appropriate remedy; (ii) not disclose Personal Data except to the extent legally compelled; (iii) inform the requesting party that HillGenius is a processor acting on Customer's behalf and that the request is more appropriately directed to Customer; and (iv) take reasonable and lawful measures to challenge or narrow any demand that HillGenius considers to be overbroad, unlawful, or otherwise improper. If HillGenius is legally prohibited from notifying Customer in advance, HillGenius will use reasonable efforts to obtain a waiver of that prohibition and, where permitted, to inform Customer as soon as possible thereafter. This Section 3.4 reflects the sensitivity of the confidential client and legislative matters that Customer's Authorized Users may handle through the Services.

4. Security

4.1 Provider Security Measures. HillGenius will implement and maintain technical and organizational security measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data ("Security Measures"). The current Security Measures are described in Annex 3. HillGenius may update the Security Measures from time to time, provided that any such updates will not materially diminish the overall level of protection afforded to Personal Data.

4.2 Security Compliance and Confidentiality. HillGenius will require that its personnel who are authorized to access Personal Data be subject to appropriate confidentiality obligations. HillGenius will treat Personal Data as confidential information and will not disclose Personal Data to any third party except as expressly permitted by this DPA, the Agreement, or as required by applicable law. This obligation is in addition to, and does not limit, any confidentiality obligations set out in the Agreement.

4.3 Information Security Incidents. HillGenius will notify Customer without undue delay, and in any event within 72 hours of becoming aware, of any Information Security Incident. Such notification will describe, to the extent known at the time: (i) the nature of the Information Security Incident; (ii) the categories and approximate number of Data Subjects concerned; (iii) the categories and approximate volumes of Personal Data records concerned; (iv) the likely consequences of the Information Security Incident; and (v) any measures taken or proposed to address the incident. HillGenius may provide notification in phases as information becomes available. Notification of an Information Security Incident does not constitute an admission of fault or liability by HillGenius. HillGenius will reasonably cooperate with Customer and take such commercially reasonable steps within HillGenius's control as are reasonably requested by Customer and mutually agreed in good faith, to support the investigation of an Information Security Incident. Customer is solely responsible for complying with any breach-notification laws applicable to Customer and for fulfilling any third-party notification obligations relating to an Information Security Incident.

4.4 Coordination of External Communications. If Customer proposes to notify any government authority, Data Subject, or the public of an Information Security Incident and such notice directly or indirectly identifies or refers to HillGenius, Customer will, to the extent legally permitted and reasonably practicable, notify HillGenius in advance and consider in good faith any clarifications or corrections HillGenius reasonably requests, except where doing so would delay a notification that Customer is legally required to make within a fixed time period.

5. Customer's Security Responsibilities and Assessment

5.1 Customer's Security Responsibilities. Customer agrees that, without limitation of HillGenius's obligations under Section 4, Customer is solely responsible for its use of the Services, including: (i) using the Services in compliance with applicable law; (ii) ensuring that Authorized Users use the Services only as permitted under the Agreement; (iii) maintaining the confidentiality of account credentials; (iv) evaluating whether the Services and Security Measures are appropriate for Customer's needs and risk tolerance; (v) not submitting Restricted Data to the Services without the Parties' prior written agreement; and (vi) maintaining, as applicable, its own backups of Personal Data that Customer submits to the Services.

5.2 Customer's Security Assessment. Customer acknowledges that it has evaluated the Services, the Security Measures, and HillGenius's commitments under this DPA and, based on information made available by HillGenius, has determined that such measures are sufficient for Customer's requirements and risk profile.

6. Data Subject Rights

6.1 HillGenius's Assistance. HillGenius will (taking into account the nature of the Processing) provide Customer with assistance reasonably necessary and technically feasible to enable Customer to fulfill its obligations to respond to Data Subject requests under Applicable Data Protection Laws, including requests for access, correction, deletion, or portability of Personal Data. To the extent such assistance requires work beyond what is required under Applicable Data Protection Laws and this DPA, Customer will compensate HillGenius for the assistance at HillGenius's then-current professional-services rates, and HillGenius will, on request, provide a good-faith estimate of the applicable fees in advance.

6.2 Customer's Responsibility for Requests. If HillGenius receives a Data Subject request directly from a Data Subject, HillGenius will: (i) promptly notify Customer (unless prohibited by applicable law); and (ii) advise the Data Subject that their request should be directed to Customer. HillGenius will not respond substantively to any such request without Customer's prior written authorization, except as required by applicable law.

6.3 Assessments and Regulatory Consultation. Taking into account the nature of the Processing and the information available to HillGenius, HillGenius will provide Customer with reasonable assistance and information necessary to enable Customer to (i) conduct and document any data protection assessment or similar risk assessment required of Customer under the State Privacy Laws in connection with its use of the Services, and (ii) cooperate with or consult any regulatory authority to the extent required of Customer under Applicable Data Protection Laws.

7. Customer Responsibilities

7.1 Notices and Consents. Customer will ensure (and is solely responsible for ensuring) that it has provided all notices to, and obtained all consents and permissions from, Data Subjects (including Customer's own clients whose names or other personal information may be submitted to the legislative monitoring and alerting features of the Services or other Services) as required by applicable law to enable HillGenius to lawfully Process Personal Data under this DPA and the Agreement.

7.2 Restricted Data. Customer represents and warrants to HillGenius that Customer Data does not and will not contain Restricted Data unless the Parties have agreed in writing to additional safeguards for such data. Customer acknowledges that the Services are not designed to process Restricted Data and that HillGenius bears no liability for any Restricted Data submitted in breach of this Section 7.2.

7.3 Data Accuracy and Access Controls. Customer is responsible for maintaining the accuracy of Personal Data submitted to the Services and for configuring and maintaining appropriate access controls for its Authorized Users.

8. Sub-processors

8.1 Consent to Sub-processor Engagement. Customer specifically authorizes the engagement of HillGenius's Affiliates as Sub-processors and generally authorizes HillGenius to engage third parties as Sub-processors, subject to this Section 8. The Sub-processors currently engaged by HillGenius are listed at https://www.hillgenius.com/subprocessors (the "Sub-processor List").

8.2 Information about Sub-processors. HillGenius maintains a current list of Sub-processors that Process Personal Data in the Sub-processor List. HillGenius will update the Sub-processor List when Sub-processors are added, changed, or removed, in accordance with Section 8.4.

8.3 Requirements for Sub-processor Engagement. When engaging any Sub-processor, HillGenius will enter into a contract with such Sub-processor containing data protection obligations that are materially consistent with those in this DPA (to the extent applicable to the nature and scope of the services provided by such Sub-processor). HillGenius will remain responsible for the performance of the obligations subcontracted to each Sub-processor and, subject to the limitations and caps on liability set out in the Agreement and Section 12.4, will be liable for the acts and omissions of its Sub-processors to the same extent HillGenius would be liable if it performed the Processing itself. With respect to AI model Sub-processors specifically, HillGenius will comply with, and will contractually impose on each such Sub-processor, the obligations set out in Section 11.2.

8.4 Opportunity to Object to Sub-processor Changes. HillGenius will provide Customer at least 10 business days' prior notice by email or through the Services before engaging a new Sub-processor ("New Sub-processor Notice"); provided that HillGenius may engage a replacement or new Sub-processor without prior notice where reasonably necessary due to an emergency, including the unavailability, degradation, or suspension of an existing Sub-processor's services, revocation of access, an Information Security Incident, or regulatory action (each, an "Emergency Sub-processor Change"), in which case HillGenius will update the Sub-processor List and notify Customer as soon as reasonably practicable and in any event within 10 business days. Customer may object to a new Sub-processor solely on data protection grounds by providing written notice to HillGenius, specifying the objection in reasonable detail, within 10 business days of receipt of the applicable notice. The Parties will discuss the objection in good faith; if unresolved within 15 business days, HillGenius may, in its sole discretion, either (a) proceed with the Sub-processor, in which case Customer's sole and exclusive remedy is to terminate the affected Services upon 30 days' written notice and receive a pro-rata refund of prepaid fees for the remainder of the then-current subscription term, or (b) elect not to engage the Sub-processor for that Customer's data. Failure to object within the applicable period constitutes deemed consent to the engagement of the new Sub-processor. Customer's objection right with respect to an Emergency Sub-processor Change will not require HillGenius to cease using the replacement Sub-processor during the objection period.

8.5 Data Localization. HillGenius stores Personal Data at rest within the United States and Processes it in the locations identified for each Sub-processor in the Sub-processor List. If HillGenius determines that it is necessary or operationally appropriate to Process Personal Data outside the United States (including through the engagement of a Sub-processor with infrastructure outside the United States), HillGenius will: (i) ensure that appropriate contractual protections are in place with the relevant Sub-processor; and (ii) ensure that such Processing complies with Applicable Data Protection Laws.

9. Audits

9.1 Audit Right. Customer may audit HillGenius's compliance with its obligations under this DPA up to once per calendar year and on such other occasions as may be required by Applicable Data Protection Laws. Audits will be conducted with not less than 30 days' prior written notice, during normal business hours, and in a manner designed to minimize disruption to HillGenius's operations. Any audit will be conducted at Customer's cost and expense (including reimbursement of HillGenius's reasonable, documented costs incurred in connection with the audit, such as reasonable internal time expended by HillGenius personnel at HillGenius's then-current professional-services rates), unless the audit reveals a material breach by HillGenius of its obligations under this DPA, in which case each Party will bear its own costs. HillGenius may require Customer to execute a non-disclosure agreement as a condition of conducting any audit.

9.2 Compliance Information. At Customer's written request (subject to any applicable confidentiality obligations), HillGenius will make available to Customer information reasonably necessary to demonstrate HillGenius's compliance with this DPA, including completed third-party audit reports or security certifications where available.

9.3 Third-Party Certifications. If the scope of a requested audit is addressed by an SOC 2, ISO, or comparable third-party audit report or certification issued within the prior twelve (12) months, and HillGenius provides that report or certification confirming no known material changes to the controls covered, Customer agrees to accept those findings in lieu of conducting an audit of the same controls. Any on-site audit will be limited to the systems, facilities, and records relevant to the Processing of Personal Data under this DPA, will not access the data or confidential information of HillGenius's other customers, and may be conditioned on the auditor executing a confidentiality agreement acceptable to HillGenius.

10. Return and Deletion

10.1 Post-Termination Obligations. Upon expiration or termination of the Agreement or the cessation of all Services involving the Processing of Personal Data (the "Cessation Date"), HillGenius will, at Customer's written election made within 30 days of the Cessation Date, either return or delete all Personal Data (including existing copies) in HillGenius's possession or control. If Customer does not make an election within such 30-day period, HillGenius will delete all Personal Data. HillGenius will complete such return or deletion from active production systems within 30 days after the end of such 30-day election period, subject to Sections 10.2 and 10.3.

10.2 Legal Retention. HillGenius may retain Personal Data to the extent and for the duration required by applicable law, provided that HillGenius will: (i) limit Processing of such retained Personal Data to the purpose(s) required by applicable law; (ii) maintain the confidentiality of such Personal Data; and (iii) delete such Personal Data promptly once the legal requirement expires.

10.3 Backup Copies. Residual copies of Personal Data contained in HillGenius's disaster-recovery and business-continuity backup systems will be overwritten in the ordinary course of backup rotation. Until they are overwritten, such backup copies will remain subject to this DPA and will not be accessed or used for any purpose other than system recovery.

11. Artificial Intelligence and No Model Training

11.1 No Training on Personal Data. HillGenius will not use Personal Data, or Output (as defined in the Agreement) generated for Customer, to train, fine-tune, or otherwise improve any foundation or large language model of HillGenius or of any third party, regardless of any account settings.

11.2 Sub-processor Restrictions. HillGenius will prohibit its Sub-processors, including any AI model providers, from using Personal Data for their own model training, fine-tuning, development, or improvement purposes, except as expressly authorized by Customer in writing.

11.3 Usage Data and Organization Settings. Customer instructs HillGenius to Process technical and usage data as described in Section 6.8 of the Agreement and, where an Organization Setting is enabled under that Section, to carry out the corresponding Processing, in each case subject to Sections 11.1 and 11.2. Such Processing does not involve disclosing Customer Data to any third party other than Sub-processors engaged in accordance with Section 8.

11.4 Aggregated and Anonymous Data. Notwithstanding anything to the contrary in this DPA, HillGenius may create, use, and disclose aggregated or De-identified Data derived from Customer Data for HillGenius's own legitimate business purposes, including product analytics, benchmarking, capacity planning, and service improvement, provided that: (i) such data does not identify or permit identification of Customer, any Authorized User, or any Data Subject; (ii) HillGenius does not attempt to, and does not knowingly permit any third party to, re-identify such data; (iii) HillGenius applies industry-standard de-identification techniques sufficient to prevent re-identification; and (iv) such data is not shared with third parties in a form that could reasonably be linked to Customer or any Data Subject.

11.5 No Automated Significant Decisions. The Services produce informational outputs (such as transcripts, summaries, drafted text, and analytical responses) intended solely for review, evaluation, and use by Customer's Authorized Users in their professional judgment. HillGenius does not use Personal Data for automated decision-making that produces legal effects concerning Data Subjects or similarly significant effects on them, as those terms are understood under Applicable Data Protection Laws. No output of the Services is intended to serve as the sole or determinative basis for any decision producing legal or similarly significant effects on any natural person. HillGenius will notify Customer in advance of any introduction of such processing and, where required by applicable law, will obtain Customer's prior written consent.

12. Miscellaneous

12.1 Relationship to Agreement. Except as expressly modified by this DPA, the terms of the Agreement remain in full force and effect. To the extent of any conflict or inconsistency between this DPA and the other terms of the Agreement, this DPA will govern. Notwithstanding anything in the Agreement or any order form entered in connection therewith to the contrary, the Parties acknowledge and agree that HillGenius's access to Personal Data does not constitute part of the consideration exchanged by the Parties in respect of the Agreement. Notwithstanding anything to the contrary in the Agreement, any notices required or permitted to be given by HillGenius to Customer under this DPA may be given (a) in accordance with any notice clause of the Agreement; (b) to Customer's contact details for data protection set out in Annex 1; (c) to HillGenius's primary points of contact with Customer; or (d) to any email address designated by Customer in writing for the purpose of receiving Services-related communications or alerts. Customer is solely responsible for ensuring that such email addresses are valid.

12.2 Cooperation on Amendments. HillGenius agrees to cooperate in good faith with Customer to consider any amendments that may be reasonably necessary to address compliance with the Applicable Data Protection Laws.

12.3 Regulatory Updates. HillGenius may, on written notice, vary this DPA solely to the extent necessary to maintain compliance with Applicable Data Protection Laws from time to time, provided that any such variation will not materially reduce the protections afforded to Personal Data or materially increase Customer's obligations under this DPA without Customer's written agreement.

12.4 Limitation of Liability. The total aggregate liability of either Party to the other Party, however arising, under or in connection with this DPA will under no circumstances exceed any limitations or caps on, and will be subject to any exclusions of, liability and loss agreed by the Parties in the Agreement.

12.5 Governing Law. This DPA will be governed by the same law and subject to the same dispute resolution mechanisms as the Agreement.

12.6 Binding Effect. By entering into the Agreement, Customer agrees to be legally bound by this DPA.

12.7 Severability. If any provision of this DPA is held to be invalid, illegal, or unenforceable, the validity, legality, and enforceability of the remaining provisions will not in any way be affected or impaired, and such provision will be reformed to the minimum extent necessary to make it valid, legal, and enforceable while preserving the Parties' original intent.

12.8 No Third-Party Beneficiaries. This DPA is for the sole benefit of the Parties and their respective successors and permitted assigns. Nothing in this DPA, express or implied, is intended to or shall confer upon any Data Subject or other third party any legal or equitable right, benefit, or remedy of any nature whatsoever under or by reason of this DPA.

Annex 1 - Data Processing Details

Details of the Processing activities carried out under this Data Processing Addendum (DPA).

Annex 2 - State Privacy Laws Annex

For purposes of this Annex 2, the terms "business," "controller," "processor," "commercial purpose," "sell," "share," "service provider," and "contractor" shall have the respective meanings given to them in the State Privacy Laws.

It is the Parties' intent that with respect to any personal information Processed under this DPA, HillGenius is a service provider, contractor, and/or processor, as applicable under the State Privacy Laws. HillGenius: (a) acknowledges that personal information is disclosed to it only for the limited and specified purposes consistent with providing the Services; (b) agrees to comply with all applicable obligations imposed on a service provider, contractor, and/or processor under the State Privacy Laws and to provide the same level of protection for personal information as required by the applicable State Privacy Laws; (c) agrees that Customer has the right to take reasonable and appropriate steps to help ensure that HillGenius Processes personal information in a manner consistent with Customer's obligations under the State Privacy Laws; (d) will notify Customer in writing if HillGenius determines that it can no longer meet its obligations under the applicable State Privacy Laws; and (e) agrees that Customer has the right, upon reasonable notice (including under clause (d) above), to take reasonable and appropriate steps to stop and remediate any unauthorized use of personal information. HillGenius certifies that it understands the restrictions set out in this Annex 2 and will comply with them.

HillGenius will not: (a) sell or share any personal information; (b) retain, use, or disclose any personal information for any purpose other than the specific purpose of providing the Services, including retaining, using, or disclosing personal information for a commercial purpose other than providing the Services; or (c) combine personal information it receives from Customer with personal information it receives from or collects on behalf of any other person, or collects from its own interactions with individuals, except as permitted by applicable State Privacy Laws.

HillGenius is not a "third party" as that term is defined in the California Consumer Privacy Act (Cal. Civ. Code § 1798.140(ai)) with respect to Personal Data Processed under this DPA. HillGenius's Processing of Personal Data is limited to performing the Services on behalf of Customer and does not constitute a disclosure of Personal Data to a third party.

Giving Customer notice of Sub-processor engagements in accordance with Section 8.4 of this DPA will satisfy HillGenius's obligation under applicable State Privacy Laws to provide notice of and an opportunity to object to the use of subcontractors or Sub-processors.

Customer may conduct audits, in accordance with Section 9 of this DPA, to help ensure that HillGenius's use of personal information is consistent with HillGenius's obligations under the State Privacy Laws.

The Parties acknowledge that HillGenius's retention, use, and disclosure of personal information as authorized by Customer's instructions documented in the Agreement and this DPA is integral to providing the Services and is consistent with the State Privacy Laws.

Annex 3 - Security Measures

HillGenius implements and maintains the following administrative, technical, and organizational security measures for the protection of Personal Data:

1. Organizational management. Designated personnel responsible for developing, implementing, and maintaining HillGenius's information security program.

2. Risk assessment. Periodic internal review and assessment of risks to HillGenius's systems and data, including a documented self-assessment against a recognized application security standard and independent penetration testing.

3. Data security controls. Logical segregation of data, restricted (role-based) access controls and monitoring, and utilization of commercially available industry-standard encryption for Personal Data in transit. Encryption at rest is implemented where available and supported by HillGenius's infrastructure providers.

4. Access controls. Logical access controls that limit customer access to data according to organizational role, that manage HillGenius personnel's access to data and system functionality on a need-to-know and least-privilege basis, and that restrict administrative access to designated personnel using multi-factor authentication.

5. Authentication controls. Customer authentication is passwordless, using single-use email verification codes or single sign-on. Administrative access requires multi-factor authentication, and credentials for administrative and infrastructure accounts are managed consistent with current industry standards.

6. Audit logging. System event logging and related monitoring procedures to record user access and system activity.

7. Physical and environmental security. Physical and environmental security of data center facilities provided by HillGenius's infrastructure Sub-processors, identified in the Sub-processor List. These providers implement enterprise-grade physical access controls, environmental protections, and redundancy. Customers with questions about the underlying infrastructure risk profile may contact their HillGenius account representative for further information.

8. Operational security. Procedures and controls for secure configuration, monitoring, and maintenance of technology and information systems, including deletion of data from systems and backup media in accordance with Section 10, with physical media disposal performed by infrastructure Sub-processors.

9. Change management. Change management procedures designed to test, approve, and monitor material changes to HillGenius's technology and information assets that may affect the security of Personal Data.

10. Incident management. Incident management procedures designed to allow HillGenius to investigate, respond to, mitigate, and provide notifications regarding Information Security Incidents in accordance with this DPA.

11. Network security. Host firewalls with default-deny inbound rules, automated blocking of repeated failed access attempts, restriction of internal services from public access, and network protections provided by infrastructure Sub-processors.

12. Vulnerability management. Vulnerability assessment, patch management, and threat protection technologies and monitoring procedures designed to identify, assess, mitigate, and protect against security threats.

13. Business continuity. Business resiliency and disaster recovery procedures designed to maintain the Services and/or enable recovery from foreseeable emergencies or disasters, including backup and recovery mechanisms consistent with Section 10.3 of this DPA.