Inscendo: Security Measures

Effective Date: This Version 1.0 is effective on the date it is posted at https://inscendoiq.com/legal/security-measures. Version: 1.0 (October 19, 2026 — first published as its own document. It sets out the safeguards that Data Processing Addendum § 8.1 listed through DPA version 1.10, and the tenant-separation detail in Master Subscription Agreement § 10.1 through MSA version 1.16, unchanged in substance. The telemetry and backup periods are stated in the Retention Schedule (Privacy Policy § 5), as they already were. From DPA version 1.11 and MSA version 1.17, both incorporate this document by reference.) Provider: Inscendo Automation Inc., a Texas corporation ("Inscendo")

This document describes the administrative, technical, and physical safeguards Inscendo maintains to protect Customer Data and Customer Personal Information in the Inscendo Service. It is incorporated by reference into the Data Processing Addendum ("DPA") § 8.1 and the Master Subscription Agreement ("MSA") § 10.1, and is a Referenced Document under MSA § 15.7. Capitalized terms not defined here have the meanings given in the DPA and the MSA. The commitments and limits in DPA § 8 and MSA § 10, including that Inscendo does not warrant that tenant isolation is absolute and promises no recovery-time or recovery-point objective, apply to everything described here.

---

1. Encryption

Encryption of Customer Personal Information at rest and in transit (TLS 1.2+).

2. Tenant separation

Logical separation of tenants, including a separate database per tenant, a per-tenant storage container for tenant files, and integration credentials held in a managed secrets vault under per-tenant secret naming with access controls enforced at the application layer. Certain working files (such as capsule source the agent authors) may reside on shared platform storage that is partitioned and access-controlled per tenant rather than on physically separate storage. Inscendo continues to invest in strengthening tenant isolation; however, as with any multi-tenant service, logical separation reduces but does not eliminate the risk of cross-tenant access, and Inscendo does not warrant that isolation is absolute.

3. Identity and access

Identity and access management, applying least privilege where implemented.

4. Operational telemetry

Automated secret-redaction in operational/diagnostic telemetry logs (Inscendo does not redact other personal information from such logs). Telemetry logs are kept for the period stated in the Retention Schedule (Privacy Policy § 5), with rolling deletion; Customer's conversation history and session records are Customer Data and are not on that schedule.

5. Network and edge

Network controls and DDoS protection at the edge, and edge-based geographic access controls that Inscendo uses and/or reserves the right to use.

6. Backup and restoration

Encrypted backup copies of Customer Data and Customer Configurations, which may include an off-site, immutable (write-once) copy held with the Sub-Processor named for that purpose in the Sub-Processor List. Each copy is retained for the period stated in the Retention Schedule. What a restoration returns, and what Inscendo tells Customer when it restores Customer's tenant, are stated in DPA § 8.1.

7. Maintenance

Regular platform and dependency updates.

8. Personnel

Confidentiality agreements and security-awareness practices for personnel with access to Customer Personal Information.

9. Incident response

Incident-response procedures. Notice of a Security Incident is given as DPA § 9 states.

10. How this document changes

Inscendo may update this document as the Service and the threats to it change. No update will materially decrease the overall protection of Customer Data or Customer Personal Information during Customer's Subscription Term. An update takes effect when posted, and is recorded in this document's version history and in the change log described in MSA § 15.

[End of Security Measures]