ºù«ӰҵAPP

Security Policy

This Security Policy describes the technical and organisational measures ºù«ӰҵAPP uses to protect customer data in the hosted ºù«ӰҵAPP platform. It is the description of security measures referenced by ºù«ӰҵAPP's Data Processing Addendum (Annex II of the EU Standard Contractual Clauses).

5.1 Hosting and Data Location

ºù«ӰҵAPP runs on Amazon Web Services ("AWS"), with AI and analytics services hosted on Google Cloud Platform. Customer data is stored in the United States (AWS US East) by default. Hosting in other regions may be supported where contractually agreed.

ºù«ӰҵAPP's integrations platform uses Microsoft Azure to connect ºù«ӰҵAPP with customers' on-premise systems. AWS, Google Cloud and Microsoft each publish SOC 2 Type II and ISO 27001 attestations through their own compliance programs. The current list of ºù«ӰҵAPP's sub-processors and their data locations is maintained at https://trust.mosaicapp.com (see Section 5.12).

5.2 Security Operations and Monitoring

ºù«ӰҵAPP's security team is responsible for the protection of customer data and of the operational systems that support the ºù«ӰҵAPP platform.

Production access, administrative actions, network events and authentication events are logged centrally and monitored continuously. Threat detection across ºù«ӰҵAPP's cloud accounts feeds a central security information and event management (SIEM) platform, and failures of critical security controls raise alerts that are triaged under ºù«ӰҵAPP's Incident Response Plan. Systems are patched on the timelines set out in Section 5.11.

5.3 Backups

ºù«ӰҵAPP performs automatic backups of all customer and system data every day. Backups are encrypted using the same controls applied to live production data and are monitored; a failed backup raises an incident alert. Backups are retained in accordance with ºù«ӰҵAPP's Data Retention Policy and are purged within 180 days after an account's data is removed from the system (see Section 5.10).

5.4 Security Controls

ºù«ӰҵAPP uses multiple layers of technical and procedural controls to protect customer data, including:

Infrastructure

• Network segmentation and VPC firewalls
• Web application firewall
• Managed threat detection across cloud accounts
• Centralized log management and SIEM
• Least-privilege identity and access management; no shared or default accounts on production systems
• Encryption in transit and at rest (Section 5.8)

Application and development

• Every code change is reviewed before release
• Automated dependency and static code scanning on every change
• External vulnerability scanning of internet-facing infrastructure
• Separate development and production environments
• Documented change management for customer-impacting changes

People

• Background checks for all employees, as permitted by law
• Security awareness training within 30 days of hire and annually thereafter
• SSO and/or multi-factor authentication on all internal systems that support it
• Managed, monitored endpoints with endpoint protection
• Regular access reviews with removal of unneeded access

For your users

• Two-factor authentication, single sign-on and role-based permissions (Section 5.7)

5.5 Independent Assurance

ºù«ӰҵAPP completes a SOC 2 Type II examination every year through an independent CPA firm, covering a twelve-month observation period. The current SOC 2 report, ºù«ӰҵAPP's Data Processing Addendum and ºù«ӰҵAPP's security policies are available through https://trust.mosaicapp.com.

ºù«ӰҵAPP processes customer data as a processor under the GDPR. ºù«ӰҵAPP's Data Processing Addendum sets out the processor terms, sub-processor notice period and security incident notification commitments described on this page.

5.6 What You Can Do

Security is a shared responsibility. ºù«ӰҵAPP recommends that every customer:

• Turn on two-factor authentication for all users, and single sign-on where available (Section 5.7).
• Give each person the least-privileged ºù«ӰҵAPP role they need, and remove access promptly when people leave.
• Keep devices patched and protected with up-to-date endpoint security. Security of your devices is the responsibility of you and your IT provider.
• Report anything suspicious to support@mosaicapp.com.

If a device is lost or compromised, your data remains protected on ºù«ӰҵAPP's servers; sign in from a new device and rotate the affected password.

5.7 Signing In

Passwords should include upper- and lower-case letters, a number and a symbol; they are never stored or transmitted in plain text.

Two-factor authentication is available to every customer. A team administrator turns it on in Team Settings → Security and can either require a specific method for all users (an authenticator app, which we recommend, or SMS) or let each user choose. Single sign-on using SAML 2.0 is configured by a team administrator in the same place, including verification of your email domain; when SSO is enabled, authentication (including any multi-factor step) is handled by your identity provider.

5.8 Data Encryption

Data in transit between your browser and ºù«ӰҵAPP, and between ºù«ӰҵAPP services, is protected with Transport Layer Security (TLS) 1.2 or higher. Data at rest is encrypted with AES-256. Encryption keys are held in cloud key-management services (AWS KMS, Google Cloud KMS), and are managed and rotated in accordance with ºù«ӰҵAPP's Encryption Policy.

5.9 Service Availability and Continuity

ºù«ӰҵAPP is designed for high availability and is deployed across multiple AWS Availability Zones by default. Live service status, incident history and 90-day uptime for every component are published at https://status.mosaicapp.com, where you can subscribe to updates by email, Slack or RSS.

ºù«ӰҵAPP maintains Business Continuity and Disaster Recovery plans that define recovery objectives for each system component. The plans are tested at least annually. ºù«ӰҵAPP is not responsible for delays resulting from AWS, Google Cloud or other provider downtime.

5.10 Data Retention and Deletion

Your data remains in ºù«ӰҵAPP while your account is active. When an account is closed in good standing, its data is retained for 180 days and then permanently deleted; you can export your data at any time through the application or the Open API before then. Backups containing deleted data are purged within 180 days of deletion. The full retention terms, including accounts not in good standing, are in Section 1.6.7 of the Terms of Use.

5.11 Vulnerability Management and Responsible Disclosure

ºù«ӰҵAPP scans continuously for vulnerable dependencies and insecure code on every change, and scans its external infrastructure at least quarterly. Findings are tracked to closure against the following timelines:

• Critical: 5 business days
• High: 30 business days
• Medium: 60 business days
• Low: 90 business days

No software is deployed to production with an unresolved Critical or High finding unless a documented, approved exception is in place.

To report a vulnerability, email security@mosaicapp.com. ºù«ӰҵAPP acknowledges reports within 2 business days and, after triage, shares an expected remediation timeline. See ºù«ӰҵAPP's Responsible Disclosure Policy for scope and safe-harbor terms.

5.12 Sub-processors

ºù«ӰҵAPP uses sub-processors to deliver the service. The authoritative list, including data locations, is maintained at https://trust.mosaicapp.com.

ºù«ӰҵAPP gives at least 14 days' notice before a new sub-processor processes customer personal data, and customers may object on reasonable data-protection grounds, as set out in the Data Processing Addendum.

ºù«ӰҵAPP and Your Data Security Responsibilities

6.1 Authorization

If you provide ºù«ӰҵAPP any personal or sensitive data relating to other individuals, either directly, through our websites, through our software, or otherwise, you represent that you have the authority to do so and permit us to use, access, or host that data in accordance with this policy, the Terms of Use and the Privacy Policy.

6.2 Account Access

ºù«ӰҵAPP employs industry-standard security measures to ensure the security of information. However, the security of information transmitted through the Internet can never be guaranteed. ºù«ӰҵAPP is not responsible for any interception or interruption of any communications through the Internet or for changes to or losses of information. Users are responsible for maintaining the security of any password, user ID, or other forms of authentication involved in obtaining access to password protected or secure areas of any ºù«ӰҵAPP websites.

6.3 Security Incident Notification

If ºù«ӰҵAPP confirms a security incident involving your data, ºù«ӰҵAPP will notify your designated contact in writing without undue delay and no later than 24 hours after discovery. The notification will include, to the extent then known: the categories and approximate number of data subjects and records affected; the nature of the incident and its known or estimated time frame; the categories of data involved; the identity and contact details of ºù«ӰҵAPP's incident representative; the likely consequences; and the measures taken or proposed to mitigate the incident, with recommended steps for you. ºù«ӰҵAPP will provide updates as further details are validated.

To protect you and your information, ºù«ӰҵAPP may suspend access to the service, without notice, pending an investigation, if any breach of security is suspected. Unauthorized access to password-protected or secure areas of any ºù«ӰҵAPP website is prohibited and may lead to criminal prosecution.

If you have reason to believe that your account or our service is no longer secure, contact support@mosaicapp.com immediately. To report a suspected vulnerability, contact security@mosaicapp.com (Section 5.11).

6.4 Use of Information

How ºù«ӰҵAPP collects, uses and discloses personal information is described in the ºù«ӰҵAPP Privacy Policy (/privacy-policy).

Last Updated Date: 09/30/2026