By this instrument, having, on one side,
ZAPPER - WHATSPREAD MARKETING LTDA, a private legal entity, registered with CNPJ/MF under no. 25.128.908/0001-06, based at Rua Iguaçu, no. 40, Saco dos Limões, Florianópolis/SC, ZIP code 88.045-610, by its representatives who sign at the end, hereinafter simply referred to as “ZAPPER” or CONTRACTED,
and on the other side,
Client who signed the terms of the contract in the Summary Table, hereinafter referred to simply as CONTRACTOR,
Both hereinafter referred to collectively as “Parties” and, individually and indistinctly, as “Party”,
CONSIDERING that ZAPPER offers intelligence and security software for monitoring multiple Whatsapp accounts with performance analysis and compliance (“Software”) and
CONSIDERING that the CONTRACTING PARTY has an interest in the services to be provided by ZAPPER,
The parties agree to enter into this contract based on the provisions of the Software Law and the current Civil Code, to sign this Software License Agreement for ZAPPER in accordance with the terms and conditions set forth below (the "CONTRACT").
OBJECT
1.1 The objective of this CONTRACT is the non-exclusive license to use the Software ZAPPER owned and developed by ZAPPER, which aims to enable the CONTRACTING PARTY to monitor conversations from selected Corporate WhatsApp collaborators, allow the continuous storage of these sent and received messages by these collaborators, and extract metrics from this communication.
1.2 The CONTRACT entered into between the Parties shall be in accordance with all its specifications, price, functionalities, and other characteristics provided in the summary table signed by the client, which becomes an integral part of this instrument in an inseparable manner, leaving no doubt regarding the service to be provided by ZAPPER.
ABOUT THE VALUE AND THE PAYMENT METHOD
2.1 By licensing the software, the CLIENT will pay the amounts established according to the quantity and commercial conditions described in the Summary Table of this CONTRACT, which contains all the conditions negotiated with the client.
2.2 If the CONTRACTING PARTY uses the object of this CONTRACT in a quantity greater than the number of monitored users initially contracted, and such practice is identified by the CONTRACTED PARTY, it may, alternatively or cumulatively:
a) immediately charge the amounts corresponding to the additional number of users effectively identified, according to the table in the Summary Table, plus the retroactive amounts due since the beginning of the excess use, calculated based on the value in effect at the time of identification;
b) in the case of a plan with annual validity, consider such additional amounts as contractual upsell, incorporating them into the monthly price until the end of the initial validity period of 12 (twelve) months;
c) allow the CONTRACTING PARTY to reduce the upsell and return to the minimum number contracted, provided that the reduction of the originally contracted minimum will not be allowed before 12 (twelve) months have elapsed since the signing of this CONTRACT, according to clause 2.3.
2.3 In the event of a reduction in the number of licenses contracted at the request of the CONTRACTING PARTY, such reduction may only occur after a minimum period of 12 (twelve) months, counted from the date of commencement of this CONTRACT. The reduction will not have retroactive effect, so amounts already paid will not be refunded.
Single paragraph: During the loyalty period, the CONTRACTING PARTY may increase the number of contracted licenses, subject to the conditions of the current commercial proposal, without prejudice to the minimum number of licenses established in this CONTRACT.
2.4 In case of late payment by the CONTRACTOR, a fine of 2% (two percent) will be applied on the amount due, applied only once, and late fees of 1% (one percent) per month, "pro rata die," calculated on the historical balance amount owed from the day after the due date until the date of actual debt settlement. Monetary adjustment of the total amount, based on the Broad Consumer Price Index (IPCA) or another index that may replace it.
2.5 The prices for the use of the Software may be adjusted annually, based on the variation of the IPCA or any index that replaces it, allowing the parties, if necessary, to renegotiate the contract value, in accordance with market conditions or other relevant factors.
2.6 The CONTRACTED PARTY will not have any obligation to maintain the services if the CONTRACTING PARTY fails to make the due payments within the stipulated timeframe, with this obligation being suspended after 30 (thirty) days of default, without prejudice to other penalties provided for in this contract.
2.7 A CONTRACTED PARTY may apply special or additional conditions for use or access in specific situations, which will be promptly communicated to the CONTRACTING PARTY in detail, in the commercial proposal or in a complementary document.
RESPONSIBILITIES AND OBLIGATIONS OF THE CONTRACTOR
3.1 The CONTRACTED declares it is responsible for providing the necessary tools for the CONTRACTING PARTY to create, develop, and/or integrate compliance policies, using its own team or a third-party team that it may hire.
3.2 The CONTRACTED PARTY, for the provision of the Software ZAPPER, uses the services of cloud infrastructure providers, with the aim of storing/processing the data of its clients and maintaining the service.
3.3 The CONTRACTED PARTY is not responsible for the results of this CONTRACT in the following cases:
(i) If the object of the CONTRACT is affected by external factors such as viruses, unauthorized intrusions by hackers or crackers.
(ii) If there is operational failure or operation performed by unauthorized individuals in the use of the ZAPPER software.
(iii) If damages or losses occur due to acts or administrative, managerial, or commercial decisions aimed at carrying out an activity other than the registration of phone numbers that are not within the scope of executing the CONTRACT with the CONTRACTED PARTY.
3.4 The CONTRACTED PARTY must comply with service levels - Annex I and the functionality of the software ZAPPER.
3.5 The CONTRACTOR is not responsible in case of unavailability of WhatsApp services (failures in its infrastructure, server outages, all related to the platform).
3.6 A CONTRACTOR agrees to provide adequate maintenance, updates, and technical support for the software during the term of this CONTRACT, in accordance with the terms and conditions set forth.
3.7 A CONTRACTOR commits to maintaining constant investments necessary in Development and Innovation to ensure that the software remains a benchmark in performance and scope in the product range it aims to compete in.
The CONTRACTOR commits to executing the services with full compliance with the provisions of this CONTRACT, in strict accordance with applicable legislation, being directly accountable for their quality and suitability.
RESPONSIBILITIES AND OBLIGATIONS OF THE CONTRACTING PARTY
4.1 The CLIENT acknowledges that the CONTRACTOR has no responsibility for the WhatsApp messaging application and is not responsible for any updates or interruptions to the services caused by Facebook Inc., the owner of said application.
4.2 It is the responsibility of the CLIENT:
(i) To make the due payments according to the information provided in the Summary Table;
(ii) To ensure the legality, integrity, and quality of the data and information entered into the ZAPPER software;
(iii) To monitor and maintain comprehensive control over the documents and information generated by the use of the subject of this CONTRACT, immediately informing the CONTRACTOR about any failures or problems encountered;
(iv) To maintain a qualified team to use the ZAPPER software and clearly report any issues that arise, through the communication channel established in Annex I, regarding the Service Level Agreement (SLA);
4.3 The CONTRACTOR shall be responsible for ensuring the necessary notices, permissions, and consents to collect, use, and share the content and personal data, including maintaining a clear privacy policy in accordance with the applicable and current legislation.
4.4 The CONTRACTOR shall not copy, download, share, modify, translate, transform, publish, transmit, sell, sublicense, edit, transfer/assign to third parties or create derivative works from the content provided by the ZAPPER software, nor allow third parties to do so through the User or their device, even without the User's knowledge.
4.4.1 The above does not apply to situations where the tools integrated into the software of ZAPPER legitimately offer export, sharing or integration features, in which case the use by the CONTRATANTE must occur within the limits and for the purposes expressly authorized by the CONTRATADA
4.5 To ensure security, regardless of any other necessary actions not described in this clause and in the clause regarding the General Data Protection Law, the CONTRACTOR must:
(i) Manage and maintain the firewall devices and other securities connecting the network with the services of the CONTRACTED PARTY;
(ii) Ensure that any and all responsibilities regarding information security, fraud, breaches, or any hacking intrusion of information, are the responsibility of the CONTRACTOR.
4.6 In case the CLIENT hires third parties for the management of the ZAPPER software, it agrees to inform, oversee, and ensure that the third party takes responsibility for the obligations set forth in this CONTRACT regarding the regularity of the content, confidentiality, and data privacy, and to keep the CONTRACTOR exempt from any claims or damages arising from the activities of the third parties hired by the CLIENT.
4.7 The CLIENT is solely and exclusively responsible for entering data into the ZAPPER software, exempting for all purposes the CONTRACTOR from any liability in civil, criminal, labor, tax, digital, or any other area of law, in any Court, Instance, Forum, or Tribunal.
4.8 The CLIENT shall be responsible for keeping its authentication data confidential and secure. For this reason, its representatives will be required to choose passwords that meet the highest standards and strength permitted by the ZAPPER software.
4.9 The CONTRACTOR is responsible for the access and confidentiality of the password provided for access to the ZAPPER software platform.
RESPONSIBILITY OF THE PARTIES
5.1 The Parties will be responsible for all direct damages caused to the other Party, and the consequences of any legal action, administrative proceedings, compensation related to damages arising from this contract, or claims from clients, users, or third parties, must be fully borne by the other Party under the respective obligation.
5.2 If the aggrieved party demands the party not directly responsible for the damage, under the terms agreed herein, it shall have the right to full recovery against the other party, and must notify the dispute to appear in the filed process.
TECHNICAL SUPPORT
6.1 A CONTRACTED PARTY will provide technical support during business hours (09:00 to 18:00) from Monday to Friday, except on weekends and national holidays, through interactions with the Support teams (contacts: (11) 4200-2345 and suporte@zapper.to and Customer Success (CS) contact: cs@zapper.to and relacionamento@zapper.to of Zapper, or another way that the CONTRACTED PARTY previously communicates to the CONTRACTING PARTY. With the following requests:
(i) Interactions with the CONTRACTED PARTY aim to assist the CONTRACTING PARTY in the effective use of the Zapper platform, ensuring satisfaction and achievement of the requested objectives;
(ii) The lack of response by the CONTRACTING PARTY or participation may negatively impact the quality of the service provided by the CONTRACTED PARTY and the achievement of the desired result.
6.2 The CONTRACTED PARTY will provide technical support according to the Service Level Agreement, updates, and maintenance as outlined in Annex I.
OF INTELLECTUAL PROPERTY
7.1 The ZAPPER Software and tools used or that may be administered and developed by the CONTRACTOR in its activities or by virtue of this CONTRACT, are the exclusive property of the CONTRACTOR and are duly protected under Law 9.610/98 - Copyright Law;
7.2 All inventions, discoveries, and development or improvements of software, hardware, technical and business schemes, work products of any nature, lists, data, and any other information accessed or developed during or due to the service provision relationship, will be the sole and exclusive property of CONTRACTED PARTY, with no rights for the CONTRACTING PARTY to claim any rights, and may be used by the CONTRACTING PARTY in its business activities during the term of the CONTRACT;
7.3 The brand related to the Software ZAPPER is owned by CONTRATADA, and its use is expressly prohibited and must be preceded by written authorization. CONTRATADA may refer to CONTRATANTE as a client of the platform;
7.4 Any form of sublicensing is prohibited, except for that carried out for subsidiaries and any companies within the same economic group.
7.5 The violation of the Clauses related to Intellectual Property will incur a fine corresponding to the amount of 10 (ten) times the total value of this CONTRACT, as well as compensation for any losses and damages that the CONTRACTOR may suffer, including, but not limited to direct damages, consequential damages, incidental, punitive or indirect damages, or for any damages of economic consequences (including lost profits or loss of profits or revenues), or indemnities, regardless of the basis of the CONTRACTOR.
7.6 The total value of the CONTRACT corresponds to the monthly amount paid for a period of 12 (twelve) months.
OF SECRECY
8.1 The Parties, their employees and agents, undertake to maintain confidentiality regarding any data, materials, documents, technical or commercial specifications, which must be treated as confidential information regardless of prior communication, and may not, under any pretext or excuse, omission, fault, or intent, disclose, reproduce, or make known to third parties, at any time, except if there is express written consent from the other Party, or if such information is freely available, prior to the formation of this CONTRACT, being public knowledge or inherent to the market, or type of business, or to the activities of the Parties.
8.2 Information that has become public domain does not constitute Confidential Information, nor do those that have been approved for release with written authorization from the originating Party, or those that have been or should be disclosed in compliance with a requirement/request from a public agency, by means of legal or administrative determination, or that were already known to the Party to whom it was disclosed, provided that they have promptly indicated such fact at the time of the information's disclosure.
8.3 The unauthorized disclosure of Confidential Information received from the other Party will cause irreparable harm and damage to the other, so that each of them must make their best efforts and take all appropriate and necessary measures, judicial or extrajudicial, in order to minimize the risks arising from the disclosure of the Confidential Information, as well as to prevent such information from being disclosed.
DATA PROTECTION
9.1 The CONTRACTOR and the CLIENT are aware and declare that they will faithfully comply, on their own behalf and on behalf of their partners, administrators, representatives, and employees, as well as enforce compliance by third parties contracted by them, with the provisions of Law 13.709/2018 – General Data Protection Law (LGPD), without excluding other sectoral or general regulations on the subject.
9.2 The CONTRACTING PARTY will act as the Data Controller while the CONTRACTED PARTY will act as the Data Processor.
9.3 A CLIENT is the sole owner and exclusive holder of all data and information entered into the ZAPPER software, being responsible for managing and processing third-party data that feeds the ZAPPER software for any purpose (“General Information”).
9.4 The PARTIES shall keep confidential any Personal Data processed under this Agreement, being responsible for anyone who may access it, ensuring that such individuals are subject to a duty of confidentiality and properly instructed accordingly.
9.5 If, in the scope of using the ZAPPER software by the CONTRACTING PARTY, Personal Data is processed, the CONTRACTING PARTY will be exclusively responsible for collecting any necessary authorizations from the Data Subject, as well as for any processing or storage of Personal Data that is carried out within the functionality of the ZAPPER software and in the context of this CONTRACT.
9.6 The Parties agree to handle any Personal Data involved in the execution of this CONTRACT solely and exclusively for the purpose for which it is intended, observing the following:
9.6.1 A CONTRACTING PARTY, as the controller, is responsible for making decisions regarding the Processing of Personal Data. It is up to them to observe the guidelines established in the General Data Protection Law and to fulfill its role as Controller, performing some activities, but not limited to:
(a) verifying and defining, according to its own criteria, the purpose of processing Personal Data;
(b) maintaining the accuracy of personal data;
(c) informing the Holders of Personal Data about the processing thereof and the modalities for exercising their rights;
(d) preparing notifications (including notifications of data protection breaches) to data protection authorities, among any other activities that are by law the responsibility of the Controller, whenever necessary.
9.6.2 A CONTRACTED PARTY, in the capacity of operator of Personal Data, will carry out the Processing of Personal Data in accordance with the instructions of the CONTRACTING PARTY and solely for the purpose of achieving the objectives defined in this CONTRACT, not being liable to the Data Subject and, also, not to the National Data Protection Authority, in the context of any administrative and/or judicial proceedings, and the CONTRACTING PARTY must make the necessary efforts to exempt the CONTRACTED PARTY from any judicial or administrative proceedings that may be initiated and filed, provided that there is no irregular processing by the CONTRACTED PARTY and/or outside the limits authorized by the CONTRACTING PARTY;
9.7 The CONTRACTED PARTY, as the Operating agent, will carry out any Processing of Personal Data only for the purposes of the services object of this CONTRACT, and agrees to:
(i) Process and use personal data for the purposes established in this CONTRACT or only upon instructions to the CONTRACTED PARTY, documented by the CONTRACTING PARTY and for no other purpose, except with the prior written authorization of the CONTRACTING PARTY. If the CONTRACTED PARTY believes that it does not have sufficient information for the Processing of Personal Data in accordance with the CONTRACT or that an instruction violates data protection laws, the CONTRACTED PARTY will promptly notify the CONTRACTING PARTY and await further instructions;
(ii) Not disclose Personal Data to third parties, except those necessary to achieve the execution of this CONTRACT and that are subject to binding obligations or for compliance with a legal or regulatory obligation;
(iii) Implement the technical and organizational measures necessary to protect Personal Data, taking into account advanced techniques, the cost of implementation, and the nature, scope, context, and purposes of the Processing of Personal Data, as well as the risks presented by the processing, particularly due to destruction, loss, alteration, unauthorized disclosure of personal data (either accidentally or unlawfully) or access to Personal Data transmitted, stored, or otherwise processed.
9.8 During the CONTRACT, the CONTRACTOR may refuse business rules defined by the CLIENT that aim to frustrate the objectives of the LGPD, or even proceed with the development of the services requested by the CLIENT in direct or indirect contradiction to the LGPD, and in this case, the CONTRACTOR is exempt from any responsibility towards the CLIENT or third parties.
9.9 The CONTRACTOR will not be liable to the CLIENT when performing the development of the services in compliance with the principles of the LGPD and after delivery, it is found that a widely adopted market practice would have violated the LGPD, based on judicial or administrative understandings that have not existed up to the present moment.
9.10 If one of the PARTIES is sued by any person (natural or legal), due to irregular processing of Personal Data performed or determined by the other Party, the innocent Party is guaranteed the right to intervene in the litigation, pursuant to article 125, II, of the Code of Civil Procedure, without prejudice to the reimbursement, by the other Party, of any condemnations, fines, and judicial or extrajudicial expenses.
9.11 The PARTIES agree to inform the other of any security incident involving personal data collected, obtained, and/or stored through this Agreement within 48 hours, jointly adopting the necessary measures to mitigate risks and comply with the legislation.
9.12 The Parties agree to inform each other, within 48 hours, of any request from the holder for access, correction, alteration, updating, removal, blocking, deletion, portability, or revocation of consent, in accordance with art. 18 of the LGPD, cooperating with each other for an appropriate response.
9.13 A Party that causes improper treatment or exposure of personal data will be fully liable for damages, ensuring the affected Party has the right of recourse and reimbursement of any amounts incurred, including indemnities, fines, fees, and legal costs.
9.14 The rules regarding Information Security adopted by the CONTRACTOR are outlined in Annex II of this CONTRACT.
OF THE TERM AND TERMINATION OF THE CONTRACT
10.1 The term of this CONTRACT is 12 (twelve) months, starting from the signing of this instrument, unless otherwise stated in the Annexes, and it will be automatically renewed for equal and consecutive periods.
10.2 During the first year of validity of this CONTRACT, the CONTRACTOR may request termination provided that it formalizes its intention 90 (ninety) days in advance.
10.3 The penalty for early termination will not be applied in the case of contractual automatic renewal, in which case the CONTRACTOR must notify the CONTRACTED PARTY of its intention to terminate the CONTRACT at least 30 (thirty) days in advance.
10.4 In the event of non-compliance by the CONTRACTOR with the provisions of clause 10.2, a fine in the amount of 3 (three) monthly installments proportional to the period of non-compliance with the notice period will be due.
10.5 The fines must be paid within 10 (ten) days counted from the termination, without prejudice to the payments due up to that date.
10.6 The CONTRACTED PARTY reserves the right to suspend or delete the account of the CONTRACTING PARTY, upon prior notice of 15 (fifteen) days, in order to investigate any potential violation as per the hypotheses below:
(i) Violation of these terms by the CONTRACTING PARTY; and/or
(ii) The use or access of this ZAPPER software service by the CONTRACTING PARTY causing a violation of laws or regulations; and/or
(iii) In the event of an investigation by legal action or government involvement; and/or
(iv) The account or its use is deemed, at the exclusive discretion of the CONTRACTING PARTY, inappropriate or offensive or in violation of these Terms.
10.7 In the case of suspension or exclusion of the CONTRACTING PARTY accounts, in the situations provided in clause 10.6, it will not grant the CONTRACTING PARTY any right to claims for reimbursements, losses or refunds.
10.8 The suspension or exclusion of accounts due to causes attributable to the CONTRACTOR will not exempt it from paying any applicable fees or amounts. If the service is terminated, the CONTRACTED PARTY will cooperate with the CONTRACTOR in order to allow them to recover personal data or information, provided that the reason for the cancellation was not some type of violation of the legislation regarding the protection of personal data.
10.9 A CONTRACTED PARTY reserves the right to replace or discontinue any of its services and products, provided that it notifies the CONTRACTING PARTY 90 (ninty) days in advance, and may provide a similar or substitute PRODUCT with equivalent usage conditions, in which case no compensation will be owed to the CONTRACTING PARTY.
10.10 In the event of termination of this CONTRACT by decision of the CONTRACTING PARTY, or due to the non-fulfillment of any obligation by the CONTRACTING PARTY, the following will occur:
(i) the immediate suspension of licenses or the revocation of the use of the ZAPPER Software, regardless of judicial or extrajudicial measures for this purpose, accompanying the penalties in item (ii);
(ii) Collection of fines pursuant to Clause 2.4 of these terms, without prior notice.
10.11 All requests for contract termination must be made exclusively via the email cancelamento@zapper.to. Other means of access will not be considered as a formal request for termination.
10.12 In the event of non-compliance with any clause of this CONTRACT, if the breach is not remedied within the period stipulated in the notification sent to the defaulting party, they shall be subject to the payment of a compensatory fine equivalent to 10% (ten percent) of the monthly amount paid to CONTRACTOR, unless a specific penalty is already provided for in this instrument, without prejudice to the losses and damages ascertained.
10.13 Justifiable reasons for the immediate termination of this CONTRACT by the innocent/injured party are:
a) Negligence of the Parties in fulfilling the obligations assumed in this CONTRACT;
b) Breach of the clauses and obligations set forth in this instrument, provided that the default is not remedied within the period stipulated in the notification sent by the injured party, as stated in the clause above;
c) The insolvency, court recovery, out-of-court recovery, or bankruptcy of one of the Parties; and
d) Fortuitous events and force majeure that prevent the fulfillment of this CONTRACT.
FINAL PROVISIONS
11.1 Any and all concessions or tolerances by the Parties, regarding the prerogatives now assured and the conditions established in this CONTRACT, shall be considered mere liberalities, not generating rights and obligations, under any circumstances, in the present or future.
11.2 Any communication between the Parties shall only be valid when made in writing, including through electronic means, provided that official communication channels made available by the CONTRACTED PARTY are used.
11.3 A CONTRACTING PARTY consents freely and expressly, provided that it is informed in advance, to the transfer of its information to third parties, within the same economic group, due to sale, acquisition, merger, or any other corporate reorganization or change in shareholding control, for the continuity in the execution of this CONTRACT.
11.4 Neither Party shall be liable for any non-performance or delay in the fulfillment of their respective non-monetary obligations due to unforeseeable circumstances or force majeure, which must be communicated in writing, specifying the nature and extent of the impediment, by the affected party.
11.5 In the event of a disagreement regarding the object of the CONTRACT, except for the obligation to pay of the CONTRACTING PARTY, the Parties commit to seeking an amicable conflict resolution before pursuing other avenues.
11.6 The Parties expressly acknowledge, in this act, that this CONTRACT, its Annexes and applicable documents are the only instruments capable of regulating the relationship between them regarding the object of this CONTRACT, which is why they consider all and any contracts, commitments, and other agreements, whether tacit or expressed, that the Parties may have maintained prior to the formalization of this instrument, to be fully terminated by law.
11.7 Nothing in this CONTRACT is intended by the Parties to create an agency, partnership, or joint venture between the Parties. The relationship between the Parties shall, at all times, be that of CONTRACTORs independent. Neither Party shall have the authority to hire or bind the other in any way.
APPLICABLE LAW AND JURISDICTION
12.1 This Agreement shall be governed by and construed in accordance with the laws of Brazil. The Parties choose the forum of the District of Florianópolis/SC for the resolution of any disputes arising from this AGREEMENT, waiving any and all others, no matter how privileged they may be.
ATTACHMENT I – SERVICE LEVEL AGREEMENT
Service Level Agreements (SLAs)
1.1 All technical support requests and issues are assigned a severity code based on their impact to the customer or user.
1.2 The severity codes are used to prioritize issues to gain the correct focus, to set predictions for resolving the issues, to establish limits for escalating the problem, and to measure performance against the agreed SLA.
1.3 The achievement of service level goals depends on an updated Business Continuity Plan and the dependencies identified within it, along with relevant hardware/software/third-party service support agreements and SLAs.
1.4 The initial severity code is requested by the client and reviewed by the ZAPPER team at the time the issue is logged in the support system through tickets.
1.5 The SLA for the first response from Support and Customer Success is 24 business hours.
Gravity guidelines
2.1 Severity One: Total service loss
Total loss of service for customer support or cloud SaaS services.
Critical system(s) or service(s) inoperable.
24 business hours to respond after the incident is reported;
48 business hours from the incident to diagnose and report a resolution plan;
72 business hours to resolve since the incident was initially reported or the next business day from the diagnosis provided.
Our service is strictly dependent on WhatsApp. In case of changes in services, infrastructure, deadlines, degradation, or interruption, our resolution goal is, therefore, treated as a best effort basis.
2.2 Severity Two: Partial service loss
Partial loss of service for customer support or cloud SaaS services.
Excessive application or application failure with direct consequences on the client's business, such as delays in system startup.
Multiple unavailable IaaS, DaaS, SaaS, or other cloud services.
Partial failure or unavailability of the application system.
VIP user offboard (critical access to the system).
Failure of a single server component or non-critical service or resource interruption.
2.3 Gravity three: degraded service
Problem affecting the single customer system or user access to the systems.
Missing or incorrect reports.
Slow response from the application system.
New user added/removed (default user deployment).
Rebooting of access security systems (MFA/SSO).
2.4 Gravity Four: No impact on service
Any problem or inquiry that does not impact the service and/or does not require any urgent action.
ANNEX II - ON INFORMATION SECURITY TECHNIQUES
Cryptography and Data Storage
1.1 The CONTRACTED PARTY ensures that all captured data will be stored at rest using the industry-standard AES-256 encryption. The storage will be carried out through the AWS RDS RDBMS management service, according to the latest security specifications and updates recommended by the vendor.
Data Segmentation and Isolation Clause
2.1 A CONTRACTOR will implement logical segmentation at the database level, using unique identifiers for each dataset of the CLIENT. Furthermore, Row Level Security (RLS) policies will be applied to reinforce the security and privacy of the stored data, ensuring that the information of the CLIENT is adequately protected.
API Access Management Clause
3.1 In the API layers, the enterprise-grade Hasura application will be used by the CONTRACTOR as the central middleware to reinforce authentication and access policies. This application will follow best practices in the implementation of Access Control Lists (ACLs), ensuring that only users authorized by the CONTRACTING PARTY have access to the appropriate data.
Access Clause to Production Environments
4.1 The CONTRACTED PARTY has access to restricted production environments primarily through programmatic access. Any direct access to production data will be strictly controlled and limited to collaborators with elevated and specific access privileges within the application domain. All accesses will be temporary and subject to auditing.
4.2 In situations where assistance in using the tool or troubleshooting issues is necessary, temporary access by the support agents of CONTRACTED PARTY may be granted after express consent from the CONTRACTING PARTY. This access will be limited, specifically designated for this purpose, auditable, and the information viewed will be redacted or anonymized to preserve the privacy of the data of the CONTRACTING PARTY.
External Audit Clause
5.1 The application and the operational environments of the CONTRACTED PARTY will be subjected to external audits periodically, conducted by accrediting entities, to ensure compliance with the established and agreed-upon security policies with the CONTRACTING PARTY.
5.2 External information security audits, including penetration tests (pentests), will be conducted periodically by the CONTRACTED PARTY to validate and reinforce adherence to industry best practice standards, including the updated guidelines from OWASP, according to the security needs set by the CONTRACTING PARTY.
