Security Policy

Miro Security Policy

RealtimeBoard, Inc. dba Miro ('Miro') considers protection of Customer Content a top priority. As further described in this Miro Security Policy, Miro uses commercially reasonable organizational and technical measures designed to prevent unauthorized access, use, alteration or disclosure of Customer Content stored on systems under Miro's control. In order to protect our network from evolving threats and disruptions, ensuring effective security controls, Miro may modify this Security Policy, with notice to Customer, to reflect new features and updated practices, but any such modifications will not materially decrease Miro's security obligations during a Subscription Term.

This policy is issued under and forms part of the Master Cloud Agreement or other Miro agreement which references this policy, and any capitalized terms not defined herein shall have the meanings ascribed to them in such Miro agreement.

1. Customer Content Access and Management Controls . Miro implements formal procedures to limit its personnel's access to Customer Content as follows:
2. 1.1. Requires unique user access authorization through secure logins and passwords, including multi-factor authentication for Cloud Hosting administrator access and individually assigned Secure Socket Shell (SSH) keys for external engineer access;
3. 1.2. Limits the Customer Content accessible to Miro personnel on a 'need to know basis';
4. 1.3. Limits access to Miro's production environment by Miro's personnel on the basis of business need;
5. 1.4. Prohibits Miro personnel from storing Customer Content on electronic portable storage devices, such as computer laptops, portable drives and other similar devices;
6. 1.5. Logically separates each of Miro's users' data and maintains measures designed to prevent Customer Content from being exposed to or accessed by other users.
7. Data Encryption . Miro provides industry standard encryption for Customer Content as follows:
8. 2.1. Implements encryption in transport and at rest;
9. 2.2. Uses strong encryption methodologies to protect Customer Content, including AES 256-bit encryption for Customer Content stored in Miro's production environment;
10. 2.3. Encrypts all Customer Content located in cloud storage while at rest; and
11. 2.4. Implements full-disk encryption for hard-drives on all personnel individual workstations.

3. Network Security, Physical Security and Environmental Controls.

• 3.1. Miro implements properly configured and patched firewalls, network access controls and other technical measures designed to prevent unauthorized access to systems processing Customer Content;
• 3.2. Miro maintains effective controls to ensure that security patches for systems and applications used to provide the Service are properly assessed, tested and applied;
• 3.3. Miro monitors privileged access to applications that process Customer Content, including cloud services;
• 3.4. Remote access to Miro's environments is controlled with a virtual private network or other device ('VPN') or private lines, consistent with industry best practices. Two-factor authentication is required for all remote access;
• 3.5. Miro operates on Amazon Web Services ('AWS') and is protected by Amazon's security and environmental controls. Detailed information about AWS security is available at https://aws.amazon.com/security/, and http://aws.amazon.com/security/sharing-the-security-responsibility/. AWS ISO certification and SOC Reports are available at https://aws.amazon.com/compliance/iso-certified/, and