# Security Addendum

Version: October 14, 2026

## About this Security Addendum

This Security Addendum forms part of every Platform License Agreement between Mindsmiths, Inc. and a Customer, together with the Terms of Service (www.mindsmiths.com/terms-of-service), the Data Processing Addendum (www.mindsmiths.com/data-processing-addendum) (“DPA”) and the Service Level Agreement (www.mindsmiths.com/service-level-agreement). It sets out the technical and organisational security measures that Mindsmiths maintains for the Mindsmiths Platform and the Customer Data processed on it. The same Security Addendum forms part of the agreements of Mindsmiths d.o.o. with Customers based in the European Union.

The version in force on the Effective Date of a Platform License Agreement forms part of that agreement; any change to it requires a written amendment signed by both parties, except for the updates provided for in Section 22. Mindsmiths may publish new versions for future agreements.

The following is the Security Addendum incorporated in every Platform License Agreement with Mindsmiths, Inc.

## 1. Information Security Organization and Governance

1.1. Mindsmiths maintains an Information Security Management System ("ISMS") certified against ISO/IEC 27001, with an assigned information security leadership function responsible for the implementation, monitoring, and continuous improvement of the ISMS.

1.2. Mindsmiths maintains documented information security policies, standards, and procedures covering, at a minimum: Identity and Access Management; Application and Interface Security; Business Continuity; Data Backup; Information Lifecycle Management; Hardening Standard; Incident Response; Physical Security; Password and Authentication; Firewall; Visitor Management; Encryption; Anti-Virus/Malware; Change Control and Configuration Management; Log Management; and Media Sanitization and Destruction.

1.3. Policies are reviewed and approved by the information security leadership function at least annually and whenever material changes occur.

1.4. Mindsmiths operates a documented risk management process, including annual risk assessments covering the Platform services.

## 2. Personnel Security

2.1. **Background checks.** Mindsmiths personnel are subject to background and vetting checks commensurate with their role and access level, to the extent permitted by applicable law.

2.2. **Training.** All Mindsmiths personnel complete information security and data privacy awareness training upon hire and annually thereafter. Completion is tracked and reviewed.

2.3. **Access revocation.** Access rights of Mindsmiths personnel to Customer Data are revoked or adjusted without undue delay upon termination of employment or change of role, and in any event within forty-eight (48) hours.

## 3. Access Control and Authentication

3.1. **Least privilege.** Mindsmiths configures access to systems processing Customer Data on the principles of least privilege and need-to-know.

3.2. **Unique identification.** Mindsmiths personnel accessing systems processing Customer Data are uniquely identified and authenticated; shared accounts are prohibited for privileged access.

3.3. **Multi-factor authentication.** Multi-factor authentication is required for all Mindsmiths personnel accessing production systems, administrative interfaces and systems processing Customer Data.

3.4. **Password controls.** Mindsmiths maintains password controls aligned with industry standards, including: minimum length of sixteen (16) characters; secure storage using industry-standard hashing (bcrypt or equivalent); prohibition on reuse of the most recent five (5) passwords; maximum password age of twelve (12) months; and account lockout after five (5) consecutive failed authentication attempts for a period of not less than fifteen (15) minutes.

3.5. **Access provisioning and de-provisioning.** Mindsmiths operates a formal user access management process to provision, modify, and de-provision access, with documented approval workflows.

3.6. **Access review.** Mindsmiths conducts access reviews at least annually. Identified exceptions are remediated within a documented period.

3.7. **Privileged access management.** Privileged access to production systems is restricted, logged, and time-bound where feasible.

## 4. Network Security

4.1. Mindsmiths implements a multi-layered network security architecture designed to monitor, detect, and limit the impact of attacks, including network access controls and firewalls, ingress and egress filtering, continuous monitoring, rate-limiting and abuse-prevention controls and segmentation between environments.

4.2. Firewall rules and network access control lists are reviewed periodically, and at least annually, and upon material change.

4.3. Network segmentation is implemented to restrict communication between environments (production, staging, development) and between workloads processing data of different criticality levels.

4.4. Remote administrative access to production systems requires multi-factor authentication and is logged.

## 5. Encryption and Key Management

5.1. **Encryption at rest.** Customer Data at rest is encrypted using AES-256 or equivalent industry-standard algorithms.

5.2. **Encryption in transit.** All Customer Data transmitted over public networks is protected using TLS 1.2 or higher, with cipher suites supporting Perfect Forward Secrecy.

5.3. **Key management.** Encryption keys are managed in accordance with Mindsmiths' Encryption Policy, which addresses key generation, storage, access controls, rotation and destruction. The Encryption Policy is available to Customer upon reasonable request, subject to confidentiality obligations.

## 6. Logging, Monitoring, and Auditing

6.1. **Logging scope.** Mindsmiths generates and retains logs from information systems, network devices, and applications that process, store, or transmit Customer Data. Logs are designed to support reconstruction of access and processing activities and record: the identity of the acting user or system, time of access, tenant context, the action performed and the outcome.

6.2. **Log retention.** Audit logs are retained for a minimum of twelve (12) months from creation.

6.3. **Log integrity and confidentiality.** Mindsmiths implements technical and organizational measures designed to protect audit logs against unauthorized modification, deletion, or disclosure, including access restrictions, separation of duties, and forwarding to a centralized log aggregation system.

6.4. **System clocks.** Information systems and network devices are synchronized to trusted time sources.

6.5. **Monitoring.** Mindsmiths operates continuous monitoring of production systems for availability and security-relevant events, with alerting on defined thresholds. Events are triaged according to documented severity classifications.

## 7. Vulnerability Management and Secure Development

7.1. **Vulnerability management program.** Mindsmiths maintains a vulnerability management program that prioritizes assets by risk, identifies vulnerabilities through automated and manual means, and classifies criticality.

7.2. **Patch timelines.** Vulnerabilities are remediated in accordance with severity-based timelines: critical and high severity within thirty (30) days of patch availability; medium severity within ninety (90) days. Severity is classified using Common Vulnerability Scoring System (CVSS) methodology or equivalent. Where remediation within the applicable timeframe is not operationally feasible, Mindsmiths implements documented compensating controls until remediation is completed.

7.3. **Penetration testing.** Mindsmiths shall engage an independent third party to perform penetration testing of the production Platform, including its AI components, at least annually. Critical and high-severity findings shall be remediated within the timelines in Section 7.2 or mitigated by documented compensating controls. Mindsmiths shall make the executive summary of the most recent test and the status of its findings available to the Customer on request, and within thirty (30) days of receiving each final report, subject to confidentiality obligations.

7.4. **Vulnerability scanning.** Mindsmiths performs vulnerability scanning of production systems in accordance with Mindsmiths' Hardening Standard, which establishes scanning cadence and remediation procedures.

7.5. **Secure Software Development Life Cycle (SDLC).** Mindsmiths maintains a documented Software Development Life Cycle that includes secure coding practices, code review prior to production deployment, and automated security testing in development pipelines as defined in Mindsmiths' internal standards.

7.6. **Separation of environments.** Production, staging, and development environments are logically separated. Testing configurations are removed prior to production deployment.

7.7. **No Customer Data in testing.** Customer Data is not used in development or testing environments. Testing uses synthetic or anonymized data.

## 8. Change Management

8.1. Mindsmiths maintains a documented change management process for all systems and applications processing Customer Data, including change approval, testing, rollback planning, and post-implementation review.

## 9. Incident Response and Breach Notification

9.1. **Incident management.** Mindsmiths maintains a documented security incident management program (where a "security incident" means any actual or suspected event affecting the confidentiality, integrity, or availability of the Platform or Customer Data), including detection, response, containment, eradication, recovery, and post-incident review procedures.

9.2. **Breach notification.** Mindsmiths shall notify Customer of any personal data breach affecting Customer Personal Data without undue delay and in any event no later than seventy-two (72) hours after becoming aware of such breach. This Section 9 supplements the notification obligation set out in DPA with operational content, staged disclosure, and cooperation requirements.

9.3. **Notification content.** The notification shall include, to the extent available at the time: (i) the nature of the incident, including categories and approximate number of data subjects and records affected; (ii) the likely consequences of the incident; (iii) the measures taken or proposed to address the incident, including any mitigating measures; and (iv) the contact point for further information. Because Mindsmiths' role is limited to processing Customer Personal Data on Customer's instructions, and because Customer Personal Data may be received in pseudonymized form, Mindsmiths may have limited visibility into the content of Customer Personal Data and may therefore be unable to provide information regarding the particular nature of the Customer Personal Data affected; in such cases Mindsmiths shall provide such information as Mindsmiths reasonably possesses.

9.4. **Staged disclosure.** Where not all information is available at the time of initial notification, Mindsmiths shall provide further information in phases without undue delay as it becomes available.

9.5. **Cooperation.** Mindsmiths shall cooperate with Customer in the investigation, remediation, and notification of personal data breaches, including providing such assistance as is reasonably required for Customer to comply with its own obligations under applicable data protection law.

9.6. **Nature of notification.** Communications by or on behalf of Mindsmiths with Customer in connection with a security incident or suspected security incident shall not in themselves be construed as an acknowledgment by Mindsmiths of any fault or liability with respect to such incident.

## 10. Business Continuity and Disaster Recovery

10.1. Mindsmiths maintains documented business continuity and disaster recovery plans designed to ensure continued delivery of the Platform services in the event of a disruptive incident.

10.2. **Recovery objectives.** Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets for production components of the Platform services are defined in the applicable Service Level Agreement (www.mindsmiths.com/service-level-agreement).

10.3. **Testing.** Business continuity and disaster recovery plans are tested at least annually. Summary results are available to Customer upon reasonable request, subject to confidentiality obligations.

## 11. Data Backup

11.1. Customer Data is backed up in accordance with Mindsmiths' Data Backup Policy and the applicable Service Level Agreement.

11.2. Backups are encrypted in transit and at rest and retained in accordance with Mindsmiths' retention schedule. Backups are stored in the same geographic region as the primary processing location unless otherwise agreed.

11.3. Backup restoration procedures are tested periodically at a cadence defined in Mindsmiths' Data Backup Policy. Restoration events are logged, including the identity of the personnel performing the restoration and the justification.

## 12. Tenant Separation

12.1. Mindsmiths operates a multi-tenant architecture in which each Customer's data is logically separated from the data of other customers of Mindsmiths. Separation is implemented through a combination of:

(a) a dedicated logical environment (including dedicated compute resources, as applicable to the Platform) provisioned for Customer, with access restricted to authorized personnel and systems of Customer;

(b) dedicated data stores provisioned for Customer's environment, not shared with other customers of Mindsmiths;

(c) tenant scoping of requests enforced through the dedicated environment described in (a) and (b), such that each request operates strictly within the requesting Customer's data scope;

(d) administrative, technical, and organizational controls designed to prevent unauthorized access to, processing of, or disclosure of Customer's data to any other customer of Mindsmiths or to any third party.

12.2. **Shared infrastructure components.** Where Platform services (including infrastructure orchestration, messaging, ingress, and observability) are shared across Mindsmiths' customers, separation between Customer's data and the data of other customers is enforced through access control, authentication, and authorization mechanisms applied at the application and service layers.

## 13. Physical and Data Center Security

13.1. Mindsmiths processes Customer Data in data centers operated by its cloud infrastructure provider(s). Physical and environmental controls at such data centers are maintained to industry-standard levels and are evidenced by the relevant certifications (including ISO/IEC 27001 and SOC 2, or industry-recognized equivalent frameworks) of the cloud infrastructure provider(s).

13.2. Mindsmiths does not operate its own on-premises data centers for Customer Data processing.

13.3. **Removable media.** Mindsmiths prohibits the use of removable media and portable storage devices for Customer Data, consistent with its cloud-only operational model.

## 14. AI-Specific Measures

14.1. **AI training and subcontractor configurations.** Mindsmiths' agreements with subcontractors that process prompts, queries, or outputs prohibit retention of Customer Data beyond the period required to process the request and any associated security or abuse-prevention controls. Where available, zero-retention configurations are applied. Evidence of these obligations is available to Customer upon reasonable request.

14.2. **Cross-tenant isolation in AI components.** In addition to the controls in §12, AI components implement: (a) isolation of prompts, context, session memory and embeddings within each tenant's dedicated environment; (b) retrieval-augmented generation (RAG) and similar architectures operate strictly within the tenant's own data scope; (c) authorization checks prior to any data retrieval or tool execution.

14.3. **Adversarial robustness.** Mindsmiths implements measures designed to protect against prompt injection, jailbreak attempts, and unauthorized data extraction through AI outputs, including input validation, output filtering, and privilege confinement for AI-invoked tools.

14.4. **AI testing.** Mindsmiths will conduct adversarial testing of AI components (including testing for prompt injection and jailbreak resistance) on material changes to AI models or pipelines, with the first such test completed within twelve (12) months following the Effective Date and recurring at least annually thereafter. Penetration testing of the AI components is performed as part of the engagement described in §7.3. Summary results are available to Customer upon reasonable request, subject to confidentiality obligations.

14.5. **Human oversight.** Recipes, playbooks, and other AI-driven automations are human-authored and human-approved before deployment to production. AI outputs that influence decisions affecting users are designed as recommendations supporting human judgment rather than fully automated decisions.

14.6. **AI audit trail.** Each material AI interaction is logged with sufficient information to reconstruct the interaction, including: the user query, the context retrieved, the model response and any tool invocations executed. Audit trails are available to Customer as part of the applicable logging scope.

14.7. **AI retention.** Prompts, outputs, embeddings and intermediate processing results generated by AI components are retained for no more than twenty-four (24) months from creation, unless a shorter period is required by applicable law or agreed in writing between the parties. Such data is not shared across customers and is not used for training or improvement of AI models.

14.8. **Model change notification.** Mindsmiths shall notify Customer of material changes to the AI models or to subcontractors providing such models in accordance with §22.3. Changes that materially affect the commitments in this Section 14 are subject to the subcontractor change notification and objection procedure set forth in the DPA.

## 15. Pseudonymization and Data Minimization

15.1. **Customer-provided pseudonymization.** Where Customer transmits Customer Personal Data in pseudonymized form, Mindsmiths preserves the pseudonymization throughout processing and does not attempt to re-identify data subjects.

15.2. **Mindsmiths-applied techniques.** Where additional pseudonymization of Customer Personal Data is required by the Platform's architecture, Mindsmiths applies industry-standard techniques in accordance with Mindsmiths' Encryption Policy and Data Security & Information Lifecycle Management Policy.

15.3. **Data minimization.** Mindsmiths implements controls designed to support Customer's data minimization obligations, including configurable data collection scopes and deletion of Customer Data that is no longer required for the purposes of the Platform services.

## 16. Asset and Information Management

16.1. Mindsmiths maintains an inventory of information system assets supporting the Platform, including asset owner, business function, and classification. Inventories are reviewed periodically.

16.2. Mindsmiths operates an information classification scheme that explicitly considers personal data and applies controls commensurate with classification level.

## 17. Return and Deletion of Customer Data

17.1. **Substantive obligation.** The substantive obligation to delete or return Customer Data following termination or expiration of the Platform License Agreement is set out in DPA §10. This Section 17 supplements DPA §10 with operational timelines, the export window, deletion confirmation, and legal-hold exceptions.

17.2. **Export period.** Following termination or expiration of the Platform License Agreement, Customer may, for a period of thirty (30) days, export Customer Data in a structured, commonly used, machine-readable format, without additional charge.

17.3. **Deletion timelines.** Upon the earlier of (i) expiration of the export period or (ii) Customer's written instruction, Mindsmiths shall delete all Customer Data from active systems within thirty (30) days. Backup copies shall be deleted in accordance with Mindsmiths' standard backup retention schedule and in any event within ninety (90) days following deletion from active systems.

17.4. **Deletion confirmation.** Upon Customer's written request, Mindsmiths shall provide written confirmation of deletion as required by DPA.

17.5. **Legal hold exceptions.** Mindsmiths may retain Customer Data to the extent and for the duration required by applicable law, provided such retained data remains protected in accordance with this Addendum.

## 18. Customer Responsibilities

18.1. **Credential and access management.** Customer is responsible for managing and protecting its Builder Team accounts, roles, credentials, and permissions within the Platform services, including:

(a) ensuring that Builder Team personnel keep credentials confidential and do not share accounts;

(b) configuring Builder Team personnel and role-based access controls in accordance with the principle of least privilege;

(c) implementing all Customer-configurable security controls available within the Platform services, including multi-factor authentication and network access restrictions where supported;

(d) maintaining password uniqueness, length, complexity, and expiration in accordance with Customer's own policies;

(e) revoking access in a timely manner upon role change or termination of Customer's own personnel;

(f) monitoring activity within Customer's environment for anomalous or unauthorized behavior, and promptly reporting suspected incidents to Mindsmiths.

18.2. **Data submitted to the Platform.** Customer is responsible for the content, accuracy, legality, and scope of Customer Data submitted to the Platform, including:

(a) ensuring data minimization in accordance with Customer's purposes;

(b) ensuring that any special-category Customer Personal Data is processed only with a valid lawful basis;

(c) where required by Customer's regulatory environment, applying pseudonymization or other protective measures to Customer Data prior to transmission to Mindsmiths;

(d) configuring the Platform services in accordance with Customer's own retention, export, and operational requirements.

18.3. **Sensitive data and regulated environments.** Where Customer's use of the Platform services involves data or use cases subject to additional regulatory requirements (including but not limited to PCI-DSS, sector-specific telecommunications regulation, healthcare, financial services, or AI-specific regulation), Customer is responsible for implementing appropriate Customer-configurable controls and for ensuring such use is within the scope of the Platform services as documented. Where additional amendments are required to support such use, the parties shall agree to them in writing prior to such processing.

18.4. **No assessment obligation.** Mindsmiths has no obligation to assess the content, accuracy, or legality of Customer Data and Customer is responsible for making appropriate use of the Platform to ensure a level of security appropriate to the particular content.

## 19. Compliance, Audit, and Reporting

19.1. **Certifications and attestations.** Mindsmiths maintains ISO/IEC 27001 certification and shall maintain it, or a successor or substantially equivalent certification, during the Term. Mindsmiths' cloud security and privacy practices are guided by ISO/IEC 27017 and ISO/IEC 27018 controls. Mindsmiths is undergoing SOC 2 Type II attestation and shall use commercially reasonable efforts to complete it; on issuance, and annually thereafter, Mindsmiths shall make the report or a customary summary of it available to the Customer on request, subject to confidentiality obligations.

19.2. **PCI-DSS.** Mindsmiths does not store, process, or transmit cardholder data subject to the Payment Card Industry Data Security Standard on behalf of Customer. PCI-DSS is out of scope unless otherwise agreed in writing between the parties.

19.3. **Additional reports.** In addition to the third-party reports referenced in the DPA, Mindsmiths makes available to Customer, upon reasonable request and subject to confidentiality obligations, summary results of penetration tests performed under §7.3 and AI testing performed under §14.4.

19.4. **Customer audit rights - operational mechanics.** Customer audit rights are governed by DPA. The following operational mechanics apply to any audit conducted under DPA:

(a) Notice: not less than thirty (30) days' prior written notice, except where required by a competent supervisory authority on shorter notice;

(b) Frequency: not more than once per calendar year, except in the case of a reasonably suspected personal data breach affecting Customer or where required by a competent supervisory authority;

(c) Audit plan: mutually agreed scope, schedule, and methodology, reasonably limited to the documented concern;

(d) Auditor qualifications: use of a qualified independent auditor bound by appropriate confidentiality obligations. Mindsmiths may object in writing to the engagement of a specific auditor on grounds that the auditor is not suitably qualified, is a direct competitor of Mindsmiths, or does not agree to reasonable confidentiality obligations, in which case Customer shall designate an alternative auditor;

(e) Scope limitations: reasonable limits designed to protect the confidentiality of other customers' data and Mindsmiths' trade secrets;

(f) Costs: borne by Customer, unless the audit identifies material non-compliance with this Addendum, in which case Mindsmiths shall bear reasonable audit costs and remediate findings within a mutually agreed timeframe;

(g) Attestation satisfaction: Customer's audit rights under DPA §11 may be satisfied in whole or in part by delivery of the third-party reports described in §19.3 where those reports reasonably address the subject of the proposed audit.

19.5. **Customer penetration testing.** Customer may, upon advance written request and subject to mutual agreement on scope, schedule, methodology, and risk mitigation, conduct or commission penetration testing of Customer's own tenant and account within the Platform. Penetration testing shall not extend to infrastructure shared with other customers of Mindsmiths or to Mindsmiths' underlying Platform components. Findings shall be shared with Mindsmiths promptly and shall be treated as confidential information of both parties for purposes of remediation.

19.6. **Vulnerability statement.** On the Customer's reasonable request, Mindsmiths shall provide a written statement of the open critical and high-severity vulnerabilities in the production Platform known to Mindsmiths at that time and the status of their remediation, subject to confidentiality obligations.

## 20. Third-Party Risk Management

20.1. Mindsmiths operates a third-party risk management program covering subcontractors and other material vendors, including periodic risk assessments and control reviews.

20.2. **Insurance.** Throughout the Term, Mindsmiths shall maintain with reputable insurers technology errors and omissions insurance with limits of not less than $1,000,000 per claim and $2,000,000 in the aggregate, and cyber liability insurance with limits of not less than $2,000,000 per claim and $3,000,000 in the aggregate. Mindsmiths shall provide certificates of insurance on the Customer's reasonable request, shall notify the Customer of any material cancellation or reduction in cover to the extent its insurer gives such notice, and shall restore any lapsed or reduced cover within thirty (30) days.

## 21. Public Communication

21.1. Mindsmiths maintains a summary of security measures, policies, the subcontractor list and the locations of subcontractors that process Customer Data through AI models, available to Customer upon reasonable request, to support transparent communication and assessment of Mindsmiths' security posture.

## 22. Versioning and Updates

22.1. **Non-material updates.** Mindsmiths may update this Addendum from time to time where such updates: (i) do not materially weaken any commitment to Customer; (ii) reflect operational improvements, clarifications, or responses to new standards; or (iii) are required by applicable law. Non-material updates take effect upon notice to Customer in accordance with §22.3.

22.2. **Material updates.** Material updates, meaning any update that weakens a commitment, expands the scope of processing, changes data location or adds a category of subcontractor not previously notified - require prior written notice to Customer of at least thirty (30) days before the effective date. Customer may object to a material update on reasonable data protection grounds. If Mindsmiths is unable to accommodate the objection, Customer may terminate the affected component of the Platform services without penalty.

22.3. **Notice mechanism.** Notices under this Addendum are delivered by email from notifications@mindsmiths.com to the email address(es) notified by Customer to Mindsmiths in writing for this purpose, or in the absence of such notification, to the email address of the Customer signatory of the Platform License Agreement.

## 23. Contact

23.1. For information security inquiries, contact: security@mindsmiths.com (or such other address designated by Mindsmiths in writing).

© 2026 Mindsmiths, Inc.