This Pulse for Meetings Information Security Program ("ISP") is incorporated into and forms part of the Pulse for Meetings Terms of Service (the "Terms") between Pindrop Security, Inc. ("Pindrop") and Company. This ISP describes the administrative, technical, and physical safeguards that Pindrop maintains to protect Company Data and Confidential Information processed through the Pindrop-Controlled Systems in connection with the Product. For additional information regarding Pindrop's security practices, certifications, and compliance posture, please visit the Pindrop Trust Center at https://trust.pindrop.com/. The Trust Center and the content therein are provided for informational purposes only and do not modify or supersede the terms of this ISP or the Terms.
1. Definitions
Capitalized terms used in this document have the meanings given below or, if not defined below, the meanings given in the Terms.
(a) "Company-Controlled Systems" means Information Systems that are within Company's possession or control.
(b) "Pindrop-Controlled Systems" means (i) systems that are within Pindrop's possession or control; and (ii) Amazon Web Services ("AWS") Information Systems or Google Cloud Platform ("GCP") that meet the following criteria: (a) under Pindrop's enterprise account with AWS or GCP, as applicable; (b) used by Pindrop to deliver the Product or Services or used by Pindrop for Pindrop's internal, corporate-level systems; and (c) are AWS systems or GCP systems for which Pindrop solely configures and manages the security controls used by Pindrop to protect the data stored within such AWS systems or GCP systems. The defined term Pindrop-Controlled Information Systems excludes all Company-Controlled Systems.
(c) "Security Breach" means a reasonably suspected or confirmed unauthorized disclosure of Company's Confidential Information within Pindrop's possession or control; or a reasonably suspected or confirmed unauthorized access by a third party to any Pindrop-Controlled Information Systems that process, hold, or provide access to Company's Confidential Information.
2. Information Security Program
Pindrop maintains a comprehensive, written information security program designed to protect the confidentiality, integrity, and availability of the Pindrop-Controlled Systems and Company Data. This program is based on industry standards such as ISO 27001, SOC 2 Type II, and NIST guidelines, and includes physical, administrative, and technical safeguards appropriate to the nature of the data processed.
3. Policies, Access & Training
Pindrop enforces internal security policies covering access control, asset management, vulnerability management, encryption, change management, and incident response. Access to systems containing Company Data is limited to authorized personnel with a business need, and such access is reviewed and revoked upon role change or termination. Employees receive security awareness and privacy training at least annually.
4. Data Protection & Encryption
Company Data in transit over public networks and at rest within Pindrop systems is protected using strong encryption consistent with industry standards (e.g., TLS 1.2+ for data in transit and AES-256 for data at rest). Where encryption is not feasible, compensating controls are used to provide equivalent protection.
5. Certifications and Audits
Pindrop undergoes regular independent third-party audits and maintains certifications or attestations (e.g., SOC 2 Type II, ISO 27001, PCI DSS, as applicable). Upon written request, Pindrop will make available summary audit reports or certificates under confidentiality.
6. Security Incident Response
Pindrop maintains an incident response plan aligned with NIST 800-61 or equivalent standards. In the event of a confirmed Security Breach affecting Company Data, Pindrop will notify Company without undue delay (and in no event later than 48 hours after confirmation), provide available details, and take reasonable steps to contain and remediate the incident. Pindrop is not required to delay an initial notification until its investigation is complete. The initial notice will, to the extent the information is then known, describe: (a) the nature and scope of the breach; (b) the categories and approximate numbers of affected data subjects and records; (c) the likely consequences; (d) the containment, mitigation, and remediation measures taken or proposed; and (e) an appropriate incident contact. Pindrop may provide incomplete information in phases and will provide reasonable supplemental updates as additional material information becomes available.
7. Subprocessors and Vendors
Pindrop uses subprocessors and service providers that are subject to written agreements requiring substantially similar security and privacy safeguards. Pindrop remains responsible for the performance of its subprocessors and service providers. Subject to the terms and conditions in Section 5 (Subprocessors) of the Pulse for Meetings Data Protection Agreement, Company acknowledges Pindrop's use of third-party cloud providers (e.g., AWS, Google) and authorizes Pindrop to share information about Company's use of the Product as required by Pindrop's provider agreements. Such services may be subject to monitoring per the provider's policies and applicable Laws.
8. Physical Security and Availability
Pindrop's production systems are hosted in secure data centers or cloud environments that include physical access controls, environmental safeguards, redundancy, and disaster recovery measures to ensure service availability.
9. Updates to Security Program
Pindrop may update its security program from time to time, provided such updates do not materially reduce the overall level of security. Pindrop reviews its policies and controls at least annually to ensure continued effectiveness and compliance with applicable standards.