Trust and Security Agreement (“TSA”)

Part 1. Information Security Program

1.1 Overview

NexusIQ is an AI-native compliance platform built on the Salesforce Force.com platform. It operates within Salesforce’s multi-tenant cloud infrastructure and inherits that platform’s physical security, network controls, encryption services, and compliance certifications. Intelligent document processing is performed by a separate Empact-operated service hosted in Microsoft Azure, as described in Annex 2, which inherits Azure’s infrastructure controls for that function. Empact adds application-layer controls, operational policies, and personnel safeguards specific to the processing of labor, supply chain, and domestic content compliance data.

This Part sets out the technical and organizational measures Empact maintains. It is the measure referenced in Section 2.6. The specific technologies, infrastructure providers, and control implementations described in this Part reflect Empact’s environment as of the Effective Date. Empact may change them, provided that no change materially reduces the overall level of protection afforded to Client Data, and provided further that any change of infrastructure provider processing Personal Data is subject to the subprocessor notice and objection rights in Section 2.8.

Capitalized terms used but not defined in this TSA, including “Software,” have the meaning given to them in the Master Services Agreement between Empact and Client (the “MSA”). This TSA is incorporated into the MSA by reference and forms a part of it. Where a term of this TSA conflicts with a term of the MSA, the MSA controls in accordance with its precedence provisions.

1.2 Shared Responsibility Model

Security of the Software is divided between Salesforce and Microsoft Azure, as infrastructure providers, and Empact, as application owner and operator. The table below states which party is accountable for each domain. Empact does not control, and cannot commit on behalf of, the Salesforce or Microsoft Azure infrastructure layers. Where a domain below is delivered in Azure rather than Salesforce, the applicable infrastructure provider performs the corresponding role.

Table 1-1. Allocation of security responsibility between Salesforce and Empact.

1.3 Certifications and Frameworks

As of the Effective Date set forth in the Order Form, the Salesforce platform on which NexusIQ is hosted holds SOC 1 Type II, SOC 2 Type II, ISO 27001, and FedRAMP Moderate. Current certifications for Empact and its infrastructure providers are available on request. Microsoft Azure, which hosts Empact’s intelligent document processing service, holds SOC 1 Type II, SOC 2 Type II, ISO 27001, and FedRAMP High. Empact Technologies is SOC 2 Type II accredited. Empact aligns its internal security practices with the NIST Cybersecurity Framework.

1.4 Encryption

• In transit. All traffic is encrypted using TLS 1.2 or higher.
• At rest. Sensitive fields, including personally identifiable information, are encrypted using AES-256 within Salesforce. Documents held transiently by the Azure-hosted intelligent document processing service reside on encrypted disks and are deleted once processing is complete.
• Field-level encryption. Enforced for Social Security Numbers and employee identifiers.

1.5 Access Management

Access to NexusIQ is governed by role-based access control. Authentication controls include:

• Password complexity requirements, with credentials stored in hashed form and not visible to Empact personnel;
• Multi-factor authentication;
• Session timeout and login auditing; and
• Administrative access restricted to authorized Empact personnel with a documented business need.

1.6 Personnel Security

All Empact employees undergo background checks before receiving access to production systems. Security and privacy training is delivered on hire and annually thereafter. All personnel authorized to process Client Data are bound by written confidentiality obligations that survive termination of employment.

1.7 Vulnerability Management and Penetration Testing

Salesforce performs regular third-party penetration testing and security scanning of the underlying platform. Empact independently performs vulnerability assessments of all custom components built on Force.com. The intelligent document processing service hosted in Azure is subject to automated third-party security scanning, accepts only HTTPS connections secured by certificates from a recognized public certificate authority, restricts Client access by network allowlist, and permits internal administrative access only through a bastion host.

1.8 Business Continuity and Disaster Recovery

Salesforce provides disaster recovery with automated failover and replication, together with daily backups and defined recovery time objectives. Empact maintains business continuity procedures to sustain support and compliance operations during an outage.

1.9 Incident Response

Empact maintains a formal Incident Response Plan covering detection, containment, investigation, remediation, and post-incident review. Incidents are logged and reviewed as part of Empact’s internal response procedures, and response exercises are conducted periodically. Client notification obligations are set out in Section 2.7.

1.10 Data Backup, Retention, and Destruction

Empact will follow its standard archival procedures for storage of all Client Data. Client Data is retained for the Term unless otherwise specified. On termination, data is securely deleted or returned as instructed, in accordance with Section 2.13.

1.11 Insurance

Empact maintains an active cyber liability insurance policy covering data breaches and privacy violations, third-party liability, and incident response costs, as required by the Insurance Section of this Agreement. Coverage limits are available on request under the confidentiality terms of this Agreement.

1.12 Subprocessors

Empact engages the subprocessors listed in Annex 2. Each is required to maintain security safeguards equal to or stronger than those described in this Part. Changes to the subprocessor list are governed by Section 2.8.

Part 2. Data Processing Addendum (United States)

2.1 Scope and Roles

This Addendum applies to Empact’s processing of Personal Data on behalf of Client in connection with the Software and related Services. Client is the Controller and, where applicable, the Business. Empact is the Processor and, where applicable, the Service Provider.

2.2 Definitions

“Personal Data” and “Personal Information” mean information that identifies, relates to, describes, or is reasonably capable of being associated with an identified or identifiable individual, and that Empact processes on Client’s behalf under this Agreement.

“Security Incident” means a breach of Empact’s security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data or other Client Data in Empact’s custody.

“Subprocessor” means a third party engaged by Empact to process Personal Data.

“Consumer Rights Request” means a request by an individual to exercise a right under an applicable state privacy statute.

“Controller” and “Business” mean the party that determines the purposes and means of processing Personal Data; “Processor” and “Service Provider” mean the party that processes Personal Data on behalf of, and under the instructions of, the Controller or Business. Each such term has the meaning given under the applicable state privacy statute.

2.3 Processing Instructions and Purpose Limitation

Empact will process Personal Data only on Client’s documented instructions and solely to provide the Services described in this Agreement and Annex 1. Any processing beyond those purposes requires Client’s prior written consent. Empact will not retain, use, or disclose Personal Data outside the direct business relationship between the Parties, and will notify Client if it determines it can no longer meet its obligations under applicable privacy law.

2.4 Categories of Data and Data Subjects

The subject matter, duration, nature, and purpose of processing, together with the categories of Personal Data and data subjects, are set out in Annex 1. Sensitive data categories will be processed only where necessary for statutory compliance reporting or with the individual’s explicit consent, and in accordance with applicable law.

2.5 Confidentiality

All personnel authorized to process Personal Data are bound by written confidentiality obligations and receive data protection training as described in Section 1.6.

2.6 Security Measures

Empact will implement and maintain the administrative, technical, and physical safeguards described in Part 1, which are intended to prevent unauthorized access to, and unauthorized use, modification, deletion, or disclosure of, Client Data. Those measures are reviewed periodically and updated to address emerging threats and vulnerabilities. Empact may modify the measures provided the modification does not materially reduce the overall level of protection.

2.7 Security Incident Notification

Empact will notify Client of a Security Incident without undue delay and in any event within three (3) business days after Empact becomes aware of it. The notification will describe if known the nature of the incident, the location of the records affected, and the containment and remediation steps taken or planned. Empact will provide reasonable cooperation and information to support Client’s own notification obligations. An initial notification is not an acknowledgment of fault or liability.

2.8 Subprocessors

Client authorizes Empact to engage the Subprocessors listed in Annex 2. Empact will impose on each Subprocessor written obligations no less protective than those in this Addendum and remains responsible for each Subprocessor’s performance.

Empact will give Client at least thirty (30) days’ prior written notice before engaging any new Subprocessor that will process Personal Data. The notice will identify the Subprocessor, the service it will perform, the categories of Personal Data involved, and the processing location.

Any new Subprocessor will be engaged only for processing that is consistent in nature, purpose, and scope with the processing performed by the Subprocessors listed in Annex 2 as of the effective date of this Addendum, and will be bound to the same restrictions on use, retention, disclosure, and training of models. Empact will not expand the purposes for which Personal Data is processed through the addition of a Subprocessor.

Client may raise reasonable data protection concerns during the notice period. Empact will work with Client in good faith to resolve them, including by adjusting the scope of the proposed processing, applying additional safeguards such as redaction or pseudonymization, identifying an alternative Subprocessor, or performing the activity without the proposed Subprocessor.

2.9 Assistance with Consumer Rights Requests

Empact will assist Client in responding to Consumer Rights Requests, including requests for access, correction, deletion, portability, and opt-out. Empact will promptly forward to Client any such request it receives directly and will not respond except to confirm receipt and direct the individual to Client. Empact maintains documented procedures for handling these requests and tests them to confirm timely and accurate response.

2.10 Opt-Out Mechanisms

Empact will implement and honor opt-out signals for the sale of Personal Information and for targeted advertising, including universal opt-out mechanisms where required by applicable law, to the extent such processing occurs. Empact does not use Personal Data for advertising purposes.

2.11 Restrictions on Sale and Sharing

Empact will not sell, rent, share, or otherwise disclose Personal Data for monetary or other valuable consideration. Empact will not combine Personal Data received under this Agreement with data received from other sources except as permitted by applicable law. Disclosure is limited to Subprocessors bound by equivalent contractual obligations.

2.12 Data Protection Assessments

Empact will provide reasonable cooperation and information to support Client in conducting data protection assessments for high-risk processing activities, including information sufficient to evaluate risks to individuals and to document mitigating measures.

2.13 Return and Deletion of Personal Data

On termination or expiration of this Agreement, Empact will return or securely delete all Personal Data in accordance with Client’s written instruction, unless retention is required by applicable law or the data is held in routine backup media pending scheduled deletion. Written confirmation of deletion will be provided on request.

2.14 Audit and Verification

On Client’s reasonable written request, and no more than once in any twelve (12) month period, Empact will make available its then-current SOC report and complete a reasonable security questionnaire to demonstrate compliance with this Addendum. If that information is not sufficient to demonstrate compliance, Client may conduct an on-site audit no more than once in any twelve (12) month period, on at least thirty (30) days’ prior written notice, during normal business hours, at Client’s expense, and scoped so as not to unreasonably disrupt Empact’s operations. Empact is not required to provide access to infrastructure controlled by Salesforce or Microsoft Azure, or to the data or systems of other clients.

2.15 Data Location

Personal Data processed under this Agreement is hosted and processed in the United States. All Subprocessors listed in Annex 2 process data within the United States, including the Microsoft Azure regions in which Empact’s intelligent document processing service and its Azure OpenAI deployment are provisioned. Empact will not transfer Personal Data outside the United States without Client’s prior written consent and an appropriate transfer mechanism.

2.16 State Privacy Law Terms

Empact will comply with applicable U.S. state privacy laws in its capacity as Processor or Service Provider. The following provisions apply in addition to the terms above.

2.16.1 California (CCPA / CPRA)

Empact acts as a Service Provider. Empact will not sell or share Personal Information, will process it only for the business purposes specified in this Agreement, and will not retain, use, or disclose it for any other purpose. Empact certifies that it understands and will comply with these restrictions, will provide the same level of privacy protection as required of Client, and will assist Client in responding to consumer rights requests. Client may take reasonable steps to stop and remediate unauthorized use of Personal Information.

2.16.2 Virginia (VCDPA)

Empact will process Personal Data only on Client’s instructions and will assist Client in fulfilling consumer rights, including access, correction, deletion, and opt-out of targeted advertising. The Parties’ respective roles and responsibilities are defined in this Addendum, and Empact’s personnel are subject to a duty of confidentiality. On Client’s request, Empact will make available information reasonably necessary to demonstrate compliance.

2.16.3 Colorado (CPA)

Empact will support opt-out mechanisms for sale and targeted advertising, cooperate with Client in conducting data protection assessments where required, implement reasonable security measures appropriate to the volume and nature of the Personal Data, and cooperate with compliance audits and assessments.

2.16.4 New York (SHIELD Act)

Empact will maintain reasonable administrative, technical, and physical safeguards to protect the private information of New York residents, as described in Part 1, and will comply with applicable breach notification requirements and assist Client in meeting its statutory obligations.

2.16.5 Other State Laws

Empact monitors emerging state privacy statutes and will implement contractual and operational updates as needed to remain compliant, including universal opt-out mechanisms and applicable sensitive data handling requirements. Where a state statute imposes a requirement on a processor that is more protective than a term of this Addendum, that requirement controls for Personal Data subject to it.

2.17 Liability

Each Party’s liability arising out of or related to this Addendum is subject to the exclusions and limitations of liability set out in the Limitation of Liability Section of this Agreement. This Addendum does not create a separate or additional cap.

2.18 Term and Governing Law

This Addendum takes effect on the Effective Date and continues for as long as Empact processes Personal Data on Client’s behalf. Governing law, venue, and dispute resolution are as set out in the Governing Law and Jurisdiction Section of this Agreement. Provisions that by their nature should survive termination, including Sections 2.5, 2.11, 2.13, and 2.17, will survive.

Annex 1. Details of Processing

Table Annex 1-1. Details of processing for the purposes of Section 2.4.

Annex 2. Approved Subprocessors

The Subprocessors authorized under Section 2.8 are those set out below, as updated from time to time in accordance with Section 2.8. The table reflects the Subprocessors engaged as of the Effective Date; Empact maintains the current list and will provide it on request. Each processes Personal Data within the United States.

Table Annex 2-1. Authorized Subprocessors as of the effective date of this document.

Annex 3. Terms Applicable to AI Processing

Personal Data transmitted to Empact’s AI processing provider (as of the Effective Date, the Azure OpenAI Service) for intelligent document processing and report generation is processed under zero-retention terms. Microsoft does not retain Client content after the processing request completes, and Client content is not used to train, fine-tune, or otherwise improve any model. Documents are transmitted from the Salesforce environment to Empact’s intelligent document processing service, a REST service hosted by Empact in Microsoft Azure. While held by that service, documents reside on encrypted disks and are deleted once processing is complete. Output returned to the Software is stored within the Salesforce environment and is subject to the same encryption, access control, and retention terms as all other Client Data under Part 1. The Software’s AI assistant feature operates entirely within Salesforce using the Salesforce Einstein Trust Layer, and Personal Data processed by that feature does not leave the Salesforce environment.