In plain English. This Addendum lists the security controls Pazau commits to contractually, not just describes in marketing. Your data is encrypted with AES-256 at rest and TLS 1.2 or higher in transit. You get SSO, SCIM, and enforceable MFA. Our own access to production is phishing-resistant, just-in-time, and reviewed quarterly. We run an independent penetration test every year and fix vulnerabilities on fixed timelines. We can recover from a regional outage within 4 hours with no more than 1 hour of data loss. We hold SOC 2 Type II, ISO 27001, ISO 27701, and ISO 42001 certifications, and PCI DSS for Voice payments. We tell you about a Security Incident within 72 hours, and you can put us through a security review once a year.
This Security Addendum ("Security Addendum") forms part of the Subscription Agreement (the "Agreement") between the Pazau entity identified on the Order Form ("Pazau") and the customer identified on the Order Form ("Customer"). Capitalized terms not defined here have the meanings given in the Agreement or the Data Processing Addendum ("DPA"). This Security Addendum describes the technical and organizational measures referenced in Section 12 of the Agreement and Annex II of the DPA.
1. Definitions
1.1 "Pazau Personnel" means Pazau's employees and individual contractors who have access to Customer Data or to Production Systems.
1.2 "Production Systems" means the infrastructure, software, and networks Pazau uses to host and process Customer Data in providing the Services.
1.3 "Security Incident" has the meaning given in the Agreement and the DPA: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data transmitted, stored, or otherwise processed by Pazau or its Sub-processors.
1.4 "Security Program" means the information security program described in Section 2.
1.5 "Vulnerability" means a weakness in the Services or Production Systems that could be exploited to compromise the confidentiality, integrity, or availability of Customer Data. Vulnerability severity is rated using CVSS v3.1 or later, adjusted for exploitability and context in Pazau's environment.
2. Security program and governance
2.1 Program. Pazau maintains a written Security Program aligned with ISO/IEC 27001 that includes administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Customer Data, appropriate to the nature of the Services and the risks presented by processing Customer Data.
2.2 Accountability. Pazau's Chief Information Security Officer is accountable for the Security Program and reports on it to Pazau's executive leadership and to the audit committee of Pazau's board of directors at least quarterly.
2.3 Policies. Pazau maintains security policies covering acceptable use, access control, asset management, cryptography, secure development, change management, vendor management, incident response, business continuity, data classification, and data retention. Policies are reviewed and approved at least annually.
2.4 Risk management. Pazau performs a formal information security risk assessment at least annually and when significant changes occur, and tracks identified risks to treatment in a risk register.
2.5 No degradation. Pazau may update the Security Program and this Security Addendum from time to time, but will not materially reduce the overall level of protection for Customer Data during the Subscription Term.
3. Certifications and third-party assurance
3.1 Certifications. Pazau maintains, and will maintain throughout the Subscription Term, the following certifications and attestations, or their materially equivalent successors:
| Framework | Scope | Cadence |
|---|---|---|
| SOC 2 Type II | Security, Availability, Confidentiality, Privacy | Annual report, 12-month observation period |
| ISO/IEC 27001 | Information security management system | Annual surveillance audit, three-year recertification |
| ISO/IEC 27701 | Privacy information management | Annual surveillance audit |
| ISO/IEC 42001 | AI management system | Annual surveillance audit |
| PCI DSS | Pazau Voice payment capture (SAQ-D Service Provider) | Annual assessment |
| HIPAA | Safeguards for Protected Health Information | Annual independent assessment |
3.2 Reports. Pazau will make its most recent SOC 2 Type II report, ISO certificates and Statements of Applicability, PCI DSS Attestation of Compliance, and penetration test executive summary available to Customer through the Trust Center at pazau.com/security, subject to confidentiality obligations. These reports are Pazau's Confidential Information.
3.3 Bridge letters. On request, Pazau will provide a bridge letter covering the period between the end of the most recent SOC 2 observation period and the date of the request.
3.4 Audits. Customer's audit rights, including on-site audits following a Security Incident and audits by regulators, are set out in the DPA. This Security Addendum does not create additional audit rights.
4. Personnel security
4.1 Background checks. Pazau conducts background checks on Pazau Personnel before they are granted access to Customer Data or Production Systems, to the extent permitted by applicable law. Checks include identity verification, employment history, and criminal record checks where lawful.
4.2 Confidentiality. All Pazau Personnel are bound by written confidentiality obligations that survive the end of their engagement.
4.3 Training. Pazau Personnel complete security and privacy training at onboarding and at least annually. Engineers complete secure-coding training annually. Personnel with access to Protected Health Information or cardholder data complete HIPAA or PCI DSS training, as applicable.
4.4 Discipline. Violations of Pazau's security policies are subject to disciplinary action up to and including termination.
4.5 Offboarding. Pazau revokes access to Production Systems and Customer Data within 24 hours of the termination of any Pazau Personnel's engagement, and immediately for involuntary terminations.
5. Access control
5.1 Least privilege. Pazau grants access to Customer Data and Production Systems on a least-privilege, need-to-know basis tied to job role.
5.2 Production access. Access to Production Systems requires phishing-resistant multi-factor authentication (FIDO2 hardware security keys) and a managed, compliant device. Standing access to Customer Data is not granted. Access is granted just-in-time for a limited duration, requires documented justification and approval by a second authorized person, and is logged.
5.3 Support access. Pazau support personnel access Customer's tenant only as needed to resolve a support request or as Customer authorizes. On Enterprise plans, Customer may require that Pazau obtain Customer's explicit in-product approval before any support access to its tenant.
5.4 Access reviews. Pazau reviews access to Production Systems and systems containing Customer Data at least quarterly, and removes access that is no longer required.
5.5 Credentials. Pazau stores secrets in a managed secrets vault, rotates service credentials regularly, and prohibits shared accounts for Production Systems.
6. Customer-facing security features
6.1 Single sign-on. On Business and Enterprise plans, the Services support single sign-on using SAML 2.0 and OpenID Connect. Customer may require SSO for all Authorized Users.
6.2 Provisioning. On Business and Enterprise plans, the Services support user provisioning and deprovisioning through SCIM 2.0.
6.3 MFA. Multi-factor authentication is available on all plans, and Customer administrators may enforce it for all Authorized Users.
6.4 Roles and permissions. The Services provide role-based access control, including granular permissions for editing Procedures, enabling Actions, managing integrations, viewing Traces, and exporting data.
6.5 Audit logs. The Services record administrative and security-relevant events in Customer's tenant, including sign-ins, permission changes, Procedure and Action changes, data exports, and API key activity. Customer may view and export these logs and stream them to its SIEM. Audit logs are retained for at least 1 year, or longer as configured on Enterprise plans.
6.6 Session and network controls. Customer may configure session timeouts and, on Enterprise plans, IP allowlisting for access to the Services and APIs.
6.7 Pazau Guard. The Services include Pazau Guard, which detects and redacts personal data such as payment card numbers, government identifiers, and health information from conversations, Traces, and logs according to Customer-configured policies.
7. Encryption and key management
7.1 At rest. Pazau encrypts Customer Data at rest using AES-256. Encryption keys are managed in AWS Key Management Service using envelope encryption with per-tenant data keys.
7.2 Customer-managed keys. On Enterprise plans, Customer may use customer-managed keys held in Customer's own AWS KMS account. If Customer revokes access to its key, Customer Data encrypted with that key becomes inaccessible to Pazau, and Pazau is not responsible for resulting unavailability of the Services.
7.3 In transit. Pazau encrypts Customer Data in transit over public networks using TLS 1.2 or higher, preferring TLS 1.3, with strong cipher suites and HTTP Strict Transport Security. Connections between services within Production Systems are also encrypted.
7.4 Voice. Pazau Voice media is encrypted in transit using SRTP where supported by the carrier or endpoint. Payment card data captured in Pazau Voice is tokenized at capture and is not stored in recordings or transcripts.
7.5 Key controls. Access to key management functions is restricted to a small number of authorized personnel, logged, and reviewed. Keys are rotated at least annually.
8. Infrastructure and data residency
8.1 Hosting. Pazau hosts the Services on Amazon Web Services. Physical and environmental security of data centers is provided by AWS and is covered by AWS's SOC 2 and ISO 27001 reports, which Pazau reviews annually.
8.2 Regions. Customer Data is hosted in the region selected on the Order Form:
| Region | Primary | Failover |
|---|---|---|
| United States | us-east-1 (N. Virginia) | us-west-2 (Oregon) |
| European Union | eu-west-1 (Dublin) | eu-central-1 (Frankfurt) |
Customer Data at rest remains in the selected region, including backups and failover, except as described in the DPA and the Sub-processors page.
8.3 Tenant isolation. The Services are multi-tenant. Pazau logically isolates each Customer's data using tenant identifiers enforced at the application and data layers, per-tenant encryption keys, and automated tests that verify isolation on every release.
8.4 Network security. Production Systems run in private virtual networks with default-deny security groups, web application firewalls, and DDoS protection. Administrative access is only through an authenticated access gateway. Production and non-production environments are separated, and Customer Data is not used in non-production environments.
8.5 Hardening. Pazau builds Production Systems from hardened, immutable images, and scans them for misconfiguration against CIS benchmarks.
9. Secure development and change management
9.1 SDLC. Pazau follows a documented secure software development lifecycle that includes threat modeling for significant changes, peer code review for every change to production code, and automated testing.
9.2 Scanning. Pazau runs static application security testing, software composition analysis for dependency vulnerabilities, secrets scanning, and infrastructure-as-code scanning on every change, and dynamic application security testing at least weekly.
9.3 Change management. Changes to Production Systems are deployed through an automated pipeline that requires approved code review and passing tests. Emergency changes are documented and reviewed after the fact.
9.4 AI Features. Changes to the AI Features are also subject to the evaluation and red-teaming requirements in the AI Addendum.
10. Vulnerability management and testing
10.1 Penetration testing. Pazau engages an independent, qualified third party to perform a penetration test of the Services at least annually, covering the web application, APIs, AI Features (including prompt injection and Action abuse), and cloud infrastructure. An executive summary of the most recent test is available to Customer under confidentiality obligations.
10.2 Remediation timelines. Pazau remediates or implements compensating controls for Vulnerabilities in Production Systems within the following timelines from validation:
| Severity | Remediation target |
|---|---|
| Critical | 7 days |
| High | 30 days |
| Medium | 90 days |
| Low | 180 days |
10.3 Bug bounty. Pazau operates a bug bounty and vulnerability disclosure program. Reports may be submitted to security@pazau.com.
10.4 Customer testing. Enterprise customers may conduct their own penetration test of their tenant once per year, at Customer's cost, with at least 14 days' prior written notice to security@pazau.com and in accordance with Pazau's testing rules of engagement. Customer will share material findings with Pazau and treat them as Pazau's Confidential Information. Load testing, denial-of-service testing, social engineering, and testing of other tenants or Sub-processors are not permitted.
11. Logging and monitoring
11.1 Logging. Pazau collects security logs from Production Systems, including authentication events, privileged actions, network flows, and application errors, in a centralized, tamper-resistant logging system. Security logs are retained for at least 1 year.
11.2 Monitoring. Pazau's security operations function monitors Production Systems 24 hours a day, 7 days a week, using automated alerting and an on-call rotation.
11.3 Endpoints. Pazau-managed endpoints run endpoint detection and response software, full-disk encryption, automatic screen lock, and managed patching. Only managed, compliant devices may access Production Systems or Customer Data.
12. Security Incident response
12.1 Plan. Pazau maintains a documented incident response plan with defined roles, severity levels, escalation paths, and communication procedures. The plan is tested at least annually through tabletop exercises.
12.2 Notification. Pazau will notify Customer of a Security Incident without undue delay and in any event no later than 72 hours after becoming aware of it. Notification will be sent to Customer's designated security contact and will include the information required by the DPA, supplemented as further information becomes available.
12.3 Response. Pazau will promptly take reasonable steps to contain, investigate, and remediate the Security Incident, and will provide Customer with reasonable cooperation, including relevant logs and Traces, to help Customer meet its own notification obligations.
12.4 Post-incident report. Within 30 days after resolving a Security Incident affecting Customer Data, Pazau will provide Customer with a written summary of root cause and remediation measures.
12.5 No admission. Pazau's notification of or response to a Security Incident is not an acknowledgment of fault or liability.
13. Business continuity and disaster recovery
13.1 Resilience. Production Systems are deployed across multiple AWS availability zones within the primary region, with automatic failover for stateless services and replicated data stores.
13.2 Backups. Pazau takes continuous point-in-time backups and daily snapshots of Customer Data. Backups are encrypted with AES-256, stored within Customer's selected hosting geography (replicated to Oregon for the US region and Frankfurt for the EU region), and retained for 35 days.
13.3 Recovery objectives. In the event of a disaster affecting the primary region, Pazau targets a Recovery Point Objective of 1 hour and a Recovery Time Objective of 4 hours, using the failover region identified in Section 8.2.
13.4 Testing. Pazau tests its disaster recovery plan, including restoration from backup and regional failover, at least annually, and its business continuity plan at least annually. A summary of results is available on request.
13.5 Availability commitments. Service availability commitments and service credits are set out in the Service Level Agreement.
14. Vendor management
14.1 Pazau assesses the security of each Sub-processor before engagement and at least annually, based on the Sub-processor's risk and access to Customer Data, including review of independent audit reports where available.
14.2 Pazau imposes written data protection and security obligations on Sub-processors that are no less protective than those in this Security Addendum and the DPA, to the extent applicable to the services the Sub-processor provides. Model Providers are additionally bound by the commitments in the AI Addendum.
15. Data retention and deletion
15.1 Customer may export Customer Data for 30 days after termination or expiration of the Agreement. Pazau deletes Customer Data from Production Systems within 90 days after termination or expiration, and from backups as they expire in the ordinary course, except where retention is required by law.
15.2 Pazau uses logical deletion and cryptographic erasure (destruction of per-tenant keys) to delete Customer Data. Physical media are sanitized by AWS in accordance with NIST SP 800-88.
15.3 Pazau will provide written confirmation of deletion on request.
16. Customer security reviews
16.1 Trust Center. Pazau maintains a Trust Center at pazau.com/security with its audit reports, policies overview, a completed SIG Lite questionnaire, and a completed CSA CAIQ.
16.2 Annual review. Once in any 12-month period, Customer may submit a reasonable security questionnaire. Pazau will respond within 30 days, relying on its standard questionnaires and reports where they answer the question. Pazau will also make a member of its security team available for one follow-up call of up to 90 minutes.
16.3 Additional reviews. Customer may conduct an additional review following a Security Incident affecting Customer Data or where required by a regulator with authority over Customer.
16.4 Confidentiality. Information Pazau provides in a security review is Pazau's Confidential Information.
17. Customer responsibilities
17.1 Customer is responsible for (a) configuring the security features of the Services appropriately, including SSO, MFA enforcement, roles, and Pazau Guard policies; (b) securing credentials, API keys, and the systems it connects through Actions and integrations; (c) promptly deprovisioning Authorized Users who no longer require access; and (d) notifying Pazau at security@pazau.com of any suspected unauthorized access to its account.
17.2 Customer will not configure Actions that grant the Services broader access to Customer's systems than required for the relevant Procedure.
18. Insurance and general
18.1 Pazau maintains the insurance described in Section 16 of the Agreement, including cyber liability and technology errors and omissions coverage of at least $10,000,000 per claim and in the aggregate.
18.2 If this Security Addendum conflicts with the DPA regarding the processing of Personal Data, the DPA prevails. If it conflicts with the Agreement regarding security obligations, this Security Addendum prevails. For Protected Health Information, the Business Associate Agreement prevails.
18.3 Security questions may be sent to security@pazau.com. To report a suspected vulnerability or incident, email security@pazau.com.