Data Processing Addendum

Effective date: 2024-08-1

Data Processing Addendum

This Cloud Data Processing Addendum (including its appendices, the “Addendum”) is incorporated into the Agreement(s) (as defined below) between Salesken and Customer. 

1. Overview

This Addendum describes the parties’ obligations, including under applicable privacy, data security, and data protection lAzure, with respect to the processing and security of Customer Data (as defined below). This Addendum will be effective on the Addendum Effective Date (as defined below), and supersedes any previously applicable terms regarding the processing and security of Customer Data.

2. Definitions

2.1 In this Addendum:

    • “Addendum Effective Date” means the date on which the Customer accepted, or the parties otherwise agreed to, this Addendum. 
    • “Additional Security Controls” means security resources, features, functionality, and controls that Customer may use at its option and as it determines, including the Admin Console, encryption, logging and monitoring, identity and access management, security scanning, and firewalls.
    • “Agreement” means the contract under which Salesken has agreed to provide the applicable Services to Customer.
    • “Applicable Privacy Law” means, as applicable to the processing of Customer Personal Data, any national, federal, European Union, state, provincial or other privacy, data security, or data protection law or regulation. 
    • “Audited Services” means the then-current Services indicated as being in-scope for the relevant certification. Salesken may not remove any services  unless they have been discontinued in accordance with the applicable Agreement.
    • “Customer Data”, if not defined in the Agreement, has the meaning given in Appendix 4 (Specific Products).
    • “Customer Personal Data” means the personal data contained within the Customer Data, including any special categories of personal data or sensitive data defined under Applicable Privacy Law.
    • “Data Incident” means a breach of Salesken’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data on systems managed by or otherwise controlled by Salesken.
    • “EMEA” means Europe, the Middle East and Africa.
    • “EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
    • “European Data Protection Law” means, as applicable: (a) the GDPR; or (b) the Swiss FADP.
    • “European Law” means, as applicable: (a) EU or EU Member State law (if the EU GDPR applies to the processing of Customer Personal Data); (b) the law of the UK or a part of the UK (if the UK GDPR applies to the processing of Customer Personal Data); or (c) the law of Switzerland (if the Swiss FADP applies to the processing of Customer Personal Data).
    • “GDPR” means, as applicable: (a) the EU GDPR; or (b) the UK GDPR.
    • “Salesken’s Third-Party Auditor” means a Salesken-appointed, qualified and independent third-party auditor, whose then-current identity Salesken will disclose to Customer.
    • “Notification Email Address” means the email address(es) designated by Customer in the Admin Console or Order Form to receive certain notifications from Salesken. 
    • “Security Documentation” means the Compliance Certifications and the SOC Reports.
    • 'Security Measures” has the meaning given in Section 7.1.1 (Salesken’s Security Measures).
    • “Services” means the applicable services described in Appendix 4 (Specific Products).
    • “SOC Reports” has the meaning given in Section 7.4 (Compliance Certifications and SOC Reports).
    • “Supervisory Authority” means, as applicable: (a) a “supervisory authority” as defined in the EU GDPR; or (b) the “Commissioner” as defined in the UK GDPR or the Swiss FADP.
    • “Term” means the period from the Addendum Effective Date until the end of Salesken’s provision of the Services, including, if applicable, any period during which provision of the Services may be suspended and any post-termination period during which Salesken may continue providing the Services for transitional purpose
    • "UK GDPR" means the EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018, and applicable secondary legislation made under that Act.

2.2 The terms “personal data,” “data subject,” “processing,” “controller,” and “processor” will have the meanings given by Applicable Privacy Law or, if absent, by the EU GDPR.

2.3 The terms “data subject”, “controller” and “processor” include “consumer”, “business”, and “service provider”, respectively, as required by Applicable Privacy Law.

‍

3. ASSISTANCE

Salesken will reasonably assist Customer by implementing appropriate technical and organizational measures for fulfilling Customer’s obligations under Applicable Privacy Law, including responding to requests for exercising data subject rights (e.g., access, rectification, deletion, restriction of processing, data portability, objection to processing, and automated decision-making). Salesken will also assist with compliance obligations concerning processing security, notification of personal data breaches, data protection impact assessments, and consultations with supervisory authorities. Customer will promptly reimburse Salesken for reasonable costs and expenses incurred in providing such assistance, except for negligible costs.

4. SALESKEN PERSONNEL‍‍

4.1.   Limitation of Access: Salesken will ensure that Salesken’s access to Personal Data is limited to those Personnel who require such access to perform the Agreement.
4.2.   Confidentiality: alesken will impose appropriate contractual obligations upon its Personnel engaged in the Processing of Personal Data, including relevant obligations regarding confidentiality, data protection, and data security. Salesken will ensure that its Personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training in their responsibilities, and have executed written confidentiality agreements. Salesken will ensure that such confidentiality agreements survive the termination of the employment or engagement of its Personnel‍

5. DATA PROCESSING‍

Customer Obligations: Customer will comply with Applicable Privacy Law when processing Customer Personal Data and will provide Salesken with instructions in accordance with such laws. Customer is responsible for ensuring compliance with data protection laws regarding the collection and transfer of Customer Personal Data to Salesken. Customer agrees not to provide Salesken with any sensitive personal data, as defined under Article 9 of the GDPR.

Salesken shall comply with all applicable Data Protection LAzure in the Processing of Customer Personal Data and Salesken shall:‍

1. Process the Customer Personal Data for the purposes of the Agreement and for the specific purposes in each case as set out in Annex 1 to this Addendum and otherwise solely on the documented instructions of Customer, for the purposes of providing the Services and as otherwise necessary to perform its obligations under the Agreement. The Agreement, this Addendum, and Customer’s use of the Services’ features and functionality are Customer’s written instructions to Salesken in relation to Processing Customer Personal Data, including as follows:

1.1. Salesken shall use, retain, disclose, or otherwise Process Customer Personal Data only on behalf of Customer and for the specific business purpose of providing the Services and in accordance with Customer’s instructions, including as described in the Agreement. Salesken shall not Sell or Share Customer Personal Data, nor use, retain, disclose, or otherwise Process Customer Personal Data outside of its business relationship with Customer or for any other purpose (including Salesken’s commercial purpose) except as required or permitted by law. Salesken shall immediately inform Customer (a) if Salesken determines that it is no longer able to meet its obligations under Data Protection LAzure or (b) if, in Salesken's opinion, an instruction infringes applicable Data Protection LAzure. Customer reserves the right to take reasonable and appropriate steps to ensure Graphite’s Processing of Customer Personal Data is consistent with Customer’s obligations under Data Protection Law and discontinue and remediate unauthorized use of Customer Personal Data;

1.2. Salesken shall have rights to process Customer Personal Data solely (i) to the extent necessary to (a) perform the Business Purposes and its obligations under the Agreement; (b) operate, manage, test, maintain and enhance the Services including as part of its business operations; (c) to disclose aggregate statistics about the Services in a manner that prevents individual identification or re-identification of Customer Personal Data, including without limitation any individual device or individual person; and/or (d) protect the Services from a threat to the Services or Customer Personal Data; or (ii) if required by court order of a court or authorized governmental agency, provided that prior notice first be given to Customer; (iii) as otherwise expressly authorized by Customer;

1.3. Salesken will not combine Customer Personal Data which Salesken Processes on Customer’s behalf, with Personal Data which it receives from or on behalf of another person or persons, or collects from its own interaction with individual, provided that Graphite may combine personal information to perform any Business Purpose permitted or required under the Agreement to perform the Services;

2. Implement and maintain measures designed to ensure that Salesken personnel authorized to process the Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality unless disclosure is required by law or professional regulations;

3. Implement and maintain the technical and organizational measures set out in the Agreement, and, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, implement and maintain any further commercially reasonable and appropriate administrative, technical, and organizational measures designed to ensure a level of security appropriate to the risk of the Processing of Customer Personal Data in accordance with Article 32 of the GDPR, and specifically:

a) pseudonymization and encryption of Customer Personal Data;

b) ensuring ongoing confidentiality, integrity, availability and resilience of Salesken’s processing systems and services that process Customer Personal Data;

c) restoring availability and access to Customer Personal Data in a timely manner in the event of a physical or technical incident; and

d) regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing of the Customer Personal Data.

4. Customer hereby agrees that Salesken is generally authorised to engage and appoint Sub-processors, and specifically the Sub-processors listed hereto, subject to Salesken's:

a). notifying Customer at least thirty (30) calendar days in advance of any intended changes or additions to its Sub-processors listed in Annex 2 by emailing notice of the intended change to Customer;

b). including data protection obligations in its contract with each Sub-processor that are materially the same as those set out in this Addendum; and

c). remaining liable to Customer for any failure by each Sub-processor to fulfil its obligations in relation to the Processing of the Customer Personal Data.

5. to the extent legally permissible, promptly notify Customer in case of any legally binding requests (i.e., disclosures required by law, court order, or subpoena) for disclosure of Customer Personal Data by Salesken. In case if it is not legally binding then Customer Personal Data would not be disclosed and Salesken will notify the Customer of such request rejection. A record of all legally binding disclosure requests relating to Customer Personal Data shall be maintained.

6. to the extent legally permissible, promptly notify Customer of any communication from a Data Subject regarding the Processing of Customer Personal Data, or any other communication (including from a Supervisory Authority) relating to any obligation under the applicable Data Protection LAzure in respect of the Customer Personal Data. Salesken will not respond to any such request or complaint unless expressly authorized to do so by Customer or is otherwise required to respond under applicable Data Protection LAzure. Taking into account the nature of the Processing, Salesken will reasonably assist Customer (or the relevant Controller) by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Customer's, Customer's Affiliates' or the relevant Controller(s)' obligation to respond to requests for exercising the data subject's rights laid down in Chapter Ill GDPR. Customer agrees to pay Salesken for time and for out of pocket expenses incurred by Salesken in connection with the performance of its obligations under this Section 4.2(e);

7. upon Salesken's becoming aware of a Personal Data Breach involving Customer Personal Data, notify Customer without undue delay, of any Personal Data Breach involving Customer Personal Data, such notice to include, to the extent reasonably available to Salesken, all timely information reasonably required by Customer (or the relevant Controller) to comply with its data breach reporting obligations under the applicable Data Protection LAzure. Salesken shall further take all such measures and actions as are necessary to remedy or mitigate the effects of such Security Incident and shall keep Customer reasonably informed of developments concerning Customer Personal Data;

8. to the extent required by the applicable Data Protection LAzure, provide reasonable assistance to Customer, Customer's Affiliates' or the relevant Controller(s)' with its obligations pursuant to Articles 32 to 36 of the GDPR taking into account the nature of the Processing and information available to Salesken; Customer agrees to pay Salesken for time and for out of pocket expenses incurred by Salesken in connection with any assistance provided in connection with Articles 35 and 36 of the GDPR;

9. cease Processing the Customer Personal Data upon the termination or expiry of the Agreement, and at option of Customer, Customer's Affiliates or the relevant Controller(s) either return or delete (including by ensuring such data is in non-readable format) all copies of the Customer Personal Data Processed by Salesken, unless (and solely to the extent and for such period as) applicable law requires Salesken to retain some or all of the Customer Personal Data. Any such Customer Personal Data retained shall remain subject to the obligations of confidentiality set forth in the Agreement; and

10. Salesken shall maintain the necessary records in support of demonstrating compliance with its obligations (as specified in the applicable contract) for the processing of Customer Personal Data carried out on behalf of the Customer.

11. make available to Customer all information reasonably necessary to demonstrate compliance with this Addendum and allow for and contribute to audits, including inspections, by Customer, or an independent third party auditor mandated by Customer, provided that Customer gives Salesken reasonable prior notice of its intention to audit, conducts its audit during Salesken’s normal business hours, and takes all reasonable measures to prevent unnecessary disruption to Salesken’s operations. For the purposes of demonstrating compliance with this Addendum under this Section 4.2(i), the Parties agree that in the first instance, once per year during the term of the Agreement (except if and when required by instruction of a competent Supervisory Authority or where Customer believes a further audit is necessary due to a Personal Data Breach concerning Customer Personal Data suffered by Salesken), Salesken will provide to Customer responses to cybersecurity and other assessments and only where Customer cannot establish Salesken’s compliance with this Addendum from Salesken’s responses shall Customer request to inspect Salesken’s processing operations. Customer agrees to pay Salesken for time and for out of pocket expenses incurred by Salesken in connection with assistance provided in connection with such audits, responses to cybersecurity and other assessments.

6. RETURN OR DELETION OF CUSTOMER DATA

Upon 30 days following termination or expiration of the agreement(unless otherwise explicitly obtained consent from the customer for a hold on period) , Salesken shall delete all Customer Data in its possession or control. This requirement shall not apply to the extent Salesken is required by applicable law to retain some or all of the Customer Data, or to Customer Data it has archived on back-up systems (e.g., in the form of audit logs), which Customer Data Salesken shall securely isolate and protect from any further Processing, except to the extent required by applicable law. 

7. DATA SECURITY

7.1 Controls -: 

 Salesken will implement and maintain administrative, physical and technical safeguards designed for the protection of the security, confidentiality and integrity of Customer’s Personal Data, pursuant to the Salesken Information Security Standards. Salesken regularly monitors its compliance with these safeguards. Salesken will not materially decrease the overall security of the Services during the term of the Agreement.

7.2.   Policies, Certifications and Audit Reports-: 

Salesken uses external auditors to verify the adequacy of its security measures. The internal controls of the Services are subject to periodic testing by such auditors and are based on the Service Organisation Control (SOC2) report. Upon Customer’s written request at reasonable intervals and subject to confidentiality limitations, Salesken will make available to Customer that is not a Salesken competitor (or to a third party auditor on Customer’s behalf, that is not a Salesken competitor and subject to the auditor’s execution of Salesken’s non-disclosure agreement), the most recent version of third-party security audit or certification reports commonly made available to Salesken Customers.

8. ACCESS; DATA SUBJECT RIGHTS; DATA EXPORT

Access; Rectification; Restricted Processing; Portability -:  During the Term, Salesken will enable Customer, in a manner consistent with the functionality of the Services, to access, rectify and restrict processing of Customer Data, including via the deletion functionality provided by Salesken and to export Customer Data. If Customer becomes aware that any Customer Personal Data is inaccurate or outdated, Customer will be responsible for using such functionality to rectify or delete that data if required by Applicable Privacy Law. 

9. AUTHORISED AFFILIATES

9.1. Contractual Relationship. The parties acknowledge and agree that, by executing the DPA, the Customer enters into the DPA on behalf of itself and, as applicable, in the name and on behalf of its Authorised Affiliates, in which case each Authorised Affiliate agrees to be bound by the Customer’s obligations under this DPA, if and to the extent that Customer Processes Personal Data on the behalf of such Authorised Affiliates, thus qualifying them as the “Controller”. All access to and use of the Services by Authorised Affiliates must comply with the terms and conditions of the Agreement and this DPA and any violation of the terms and conditions therein by an Authorised Affiliate shall be deemed a violation by Customer.

9.2. Communication. The Customer shall remain responsible for coordinating all communication with Salesken under the Agreement and this DPA and shall be entitled to make and receive any communication in relation to this DPA on behalf of its Authorised Affiliates.

10.   CONFLICT

10.1.  In the event of any conflict or inconsistency between certain provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail over the conflicting provisions of the Agreement solely with respect to the Processing of Personal Data.

10.2. In the event of any conflict between certain provisions of this DPA and any of its Schedules and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

INDEMNITY

  1. Indemnification By Company. Company will defend Customer against any claim, demand, suit, or proceeding made or brought against Customer by a third party alleging that Customer’s use of the Software in accordance with this Agreement infringes or misappropriates such third party’s intellectual property rights (a “Claim Against Customer”), and Company will indemnify Customer from any damages, reasonable attorneys’ fees and costs finally awarded against Customer as a result of, or for amounts paid by Customer under a settlement approved by Company in writing in respect of, a Claim Against Customer, provided that Customer (a) promptly gives Company written notice of the Claim Against Customer, (b) gives Company sole control of the defense and settlement of the Claim Against Customer, and (c) gives Company all reasonable assistance, at Company’s cost. Subject to the foregoing, Customer may participate in the defense and/or settlement of any Claim Against Customer with counsel of its choosing at its own cost. The foregoing defense and indemnification obligations will not apply if

(i) the allegation does not state with specificity that the Services are the basis of the Claim Against Customer; 

(ii) a Claim Against Customer arises from the use or combination of the Software or any part thereof with any other products, software, hardware, data, processes, or services not provided by Company; (iii) Customer’s use of the Software other than in accordance with this Agreement;

(iv) any modification of the Software not made or authorized in writing by Company; 

Annexure to DPA

1. Data Importer

Name: Salesken
Address: Malleshwaram
Contact person's name, position and contact details: Vaishnavi Thotieam
vaishnavi@salesken.ai
Activities relevant to the data transferred under these Clauses: Provision of the Services to the Customer in accordance with the Agreement.
Signature and date: Signature and date are set out in the Agreement.
Role (controller/processor): Processor

2. Processing Information
Categories of data subjects whose personal data is transferred Customer's authorized users of the Services
Categories of personal data transferred Processed automatically by the Services:
  • Names
  • Email IDs
Processed where and to the extent provided by Customer or its authorized users in connection with audit services provided by Salesken:
  • Address
  • Date of birth
  • Past employment details
Sensitive personal data transferred None
Frequency of the transfer Continuous
Nature of the processing The nature of processing is more fully described in the Agreement and accompanying order forms but will include the basic processing activies: The provision of Services to Customer.
Purpose of the data transfer and further processing In order to provide people data, Salesken receives identifying Customer Personal Data to permit Salesken to query, cleanse, standardize, enrich, (when required) send additional data to feed providers, and to store the query information. The purpose of the transfer is to facilitate the performance of the Services more fully described in the Agreement and accompanying order forms.
For processing involving California consumers, please select the Business Purposes(s) for Processing Personal Data
    ☐ N/A
    ☐ Auditing related to ad impressions, verifying positioning, and auditing compliance with standards
    ☒ Helping to ensure security and integrity to the extent the use of the consumer's personal information is reasonably necessary and proportionate for these purposes
    ☒ Debugging to identify and repair errors that impair existing intended functionality
    ☐ Short-term, transient use, including, but not limited to, non personalized advertising shown as part of a consumer's current interaction with the business, provided that the consumer's personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer's experience outside the current interaction with the business
    ☒ Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
    ☐ Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
    ☒ Undertaking internal research for technological development
    ☒ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
    ☒ To retain and employ another service provider or contractor as a subcontractor where the subcontractor meets the requirements for a service provider or contractor under CCPA.
    ☒ To build or improve the quality of the services it is providing to the business even if this Business Purpose is not specified in the written contract required by CCPA provided that Service Provider does not use the Customer Personal Data to perform Services on behalf of another person.
    ☒ To prevent, detect, or investigate data security incidents or protect against malicious, deceptive, fraudulent, or illegal activity, even if this Business Purpose is not specified in the written contract.
Period for which the personal data will be retained or criteria used to determine that period The period for which the Customer Personal Data will be retained is more fully described in the Agreement, Addendum, and accompanying order forms.
Subprocessor transfers – subject matter, nature, and duration of processing The subject matter, nature, and duration of the processing are described in the Agreement, Addendum, and accompanying order forms.

3. Technical and Organisational Security Measures

Description of the technical and organisational security measures implemented by Salesken as the data processor/data importer to ensure an appropriate level of security, taking into account the nature, scope, context, and purpose of the processing, and the risks for the rights and freedoms of natural persons.

Security

  • Organization. Salesken designates qualified security personnel whose responsibilities include development, implementation, and ongoing maintenance of the Information Security Program.
  • Policies. Management reviews and supports all security related policies to ensure the security, availability, integrity and confidentiality of Customer Personal Data.  These policies are updated at least once annually.
  • Assessments. Salesken engages a reputable independent third-party to perform risk assessments of all systems containing Customer Personal Data at least once annually.
  • Risk Treatment. Salesken maintains a formal and effective risk treatment program that includes penetration testing, vulnerability management and patch management to identify and protect against potential threats to the security, integrity or confidentiality of Customer Personal Data.
  • Vendor Management. Salesken maintains an effective vendor management program
  • Incident Management. Salesken reviews security incidents regularly, including effective determination of root cause and corrective action.
  • Standards. Salesken operates an information security management system that complies with the requirements of ISO/IEC 27001:2013 standard.

Personnel Security.

  • Salesken personnel are required to conduct themselves in a manner consistent with the company’s guidelines regarding confidentiality, business ethics, appropriate usage, and professional standards. Salesken conducts reasonably appropriate background checks on any employees who will have access to client data under this Agreement, including in relation to employment history and criminal records, to the extent legally permissible and in accordance with applicable local labor law, customary practice and statutory regulations.
  • Personnel are required to execute a confidentiality agreement in writing at the time of hire and to protect Customer Personal Data at all times. Personnel must acknowledge receipt of, and compliance with, Salesken’s confidentiality, privacy and security policies. Personnel are provided with privacy and security training on how to implement and comply with the Information Security Program. Personnel handling Customer Personal Data are required to complete additional requirements appropriate to their role (e.g., certifications). Salesken’s personnel will not process Customer Personal Data without authorization.

Access Controls

  • Access Management. Salesken maintains a formal access management process for the request, review, approval and provisioning of all personnel with access to Customer Personal Data to limit access to Customer Personal Data and systems storing, accessing or transmitting Customer Personal Data to properly authorized persons having a need for such access. Access reviews are conducted periodically to ensure that only those personnel with access to Customer Personal Data still require it.
  • Infrastructure Security Personnel. Salesken has, and maintains, a security policy for its personnel, and requires security training as part of the training package for its personnel. Salesken’s infrastructure security personnel are responsible for the ongoing monitoring of Salesken’s security infrastructure, the review of the Services, and for responding to security incidents.
  • Access Control and Privilege Management. Salesken’s and Customer’s administrators and end users must authenticate themselves via a Multi-Factor authentication system or via a single sign on system in order to use the Services
  • Internal Data Access Processes and Policies – Access Policy. Salesken’s internal data access processes and policies are designed to protect against unauthorized access, use, disclosure, alteration or destruction of Customer Personal Data. Salesken designs its systems to only allow authorized persons to access data they are authorized to access based on principles of “least privileged” and “need to know”, and to prevent others who should not have access from obtaining access.  Salesken requires the use of unique user IDs, strong passwords, two factor authentication and carefully monitored access lists to minimize the potential for unauthorized account use. The granting or modification of access rights is based on: the authorized personnel’s job responsibilities; job duty requirements necessary to perform authorized tasks; a need to know basis; and must be in accordance with Salesken’s internal data access policies and training. Approvals are managed by workflow tools that maintain audit records of all changes. Access to systems is logged to create an audit trail for accountability. Where passwords are employed for authentication (e.g., login to workstations), password policies follow industry standard practices. These standards include password complexity, password expiry, password lockout, restrictions on password reuse and re-prompt for password after a period of inactivity

Data Center and Network Security

  • Data Centers
    • Infrastructure. Salesken has Azure as its data center.
    • Resiliency. Multi Availability Zones are enabled on Azure and Salesken conducts Backup Restoration Testing on regular basis to ensure resiliency.
    • Server Operating Systems. Salesken’s servers are customised for the application environment and the servers have been hardened for the security of the Services. Salesken employs a code review process to increase the security of the code used to provide the Services and enhance the security products in production environments.
    • Disaster Recovery. Salesken replicates data over multiple systems to help to protect against accidental destruction or loss. Salesken has designed and regularly plans and tests its disaster recovery programs.
    • Security Logs. Salesken’s systems have logging enabled to their respective system log facility in order to support the security audits, and monitor and detect actual and attempted attacks on, or intrusions into, Salesken’s systems.
    • Vulnerability Management. Salesken performs regular vulnerability scans on all infrastructure components of its production and development environment.  Vulnerabilities are remediated on a risk basis, with Critical, High and Medium security patches for all components installed as soon as commercially possible.

Networks and Transmission

  • Data Transmission. Transmissions on production environment are transmitted via Internet standard protocols.
  • External Attack Surface. Azure Security Group which is equivalent to virtual firewall is in place for Production environment on Azure.
  • Incident Response. Salesken maintains incident management policies and procedures, including detailed security incident escalation procedures. Salesken monitors a variety of communication channels for security incidents, and Salesken’s security personnel will react promptly to suspected or known incidents, mitigate harmful effects of such security incidents, and document such security incidents and their outcomes.
  • Encryption Technologies. Salesken makes HTTPS encryption (also referred to as SSL or TLS) available for data in transit.

Data Storage, Isolation, Authentication, and Destruction. Salesken stores data in a multi-tenant environment on Azure servers. Data, the Services database and file system architecture are replicated between multiple availability zones on Azure. Salesken logically isolates the data of different customers. A central authentication system is used across all Services to increase uniform security of data. Salesken ensures secure disposal of Client Data through the use of a series of data destruction processes.

Salesken’s Sub Processors

Name of Sub-processor Description of Processing Location of Sub-processor
Azure Running the Production environment including the Application and Databases USA, India
Google Workspace Email services USA
Auth0 Encryption USA
ZOHO Invoicing solutions India
Atlassian Project management USA
Razorpay Payment Gateway India
Github Code version control (Internal) USA, India
Slack Messaging USA
Hubspot CRM solution USA
Deepgram Transcription USA
Confluent Kafka Message Broker USA, India
Open AI Generative LLM's USA
Twilio Telephony USA
NxtGen Telephony Infrastructure India

‍