We have a formal Business Continuity and Disaster Recovery plan, which is exercised, reviewed and approved annually. Anvilogic also conducts regular testing of critical services, backup systems and operational infrastructure to ensure business continuity requirements are met. Our risk assessment program and business impact analysis are scoped across the organization, reflecting our commitment to preparedness across business areas.

Anvilogic's infrastructure is hosted by AWS.

At Anvilogic, the production, staging, and development environments are maintained as distinct entities to safeguard operational integrity and data confidentiality. In these separate environments, customer data is strictly prohibited from use in non-production settings, thus ensuring that developmental and testing activities do not compromise data security.

Are you using third-party services to manage or support your customers?

Are you hosted on one of the major cloud providers or do you have any on-premise systems?

Necessary, performance, and targeting cookies may be used to support our services.

In the event of a data breach involving customer data, notifications will be sent in accordance with the terms in the MSA.

Personnel perform security and privacy awareness training on an annual basis. Topics covered includes: Passwords, Mobile Devices, Social Engineering, Physical Security, Phishing, etc.

Personal data transfers to the United States from the European Union, United Kingdom, and Switzerland while ensuring data protection that is consistent with EU, UK, and Swiss law.

MFA is enabled for all users to increase the security levels.

The primary objective of multi-factor authentication is to reduce the risk of account takeovers and provide additional security for users and their accounts. Since over 80% of cyber breaches happen due to weak or stolen passwords, MFA can provide added layers of security necessary to protect users and their data

Anvilogic is committed to building trust in our organization and platform by protecting our customer data, models, and products.

Both role based and user based access controls are available for the Anvilogic product suite.

Anvilogic captures backups on a regular basis to ensure internal and customer data is protected from loss according to our Business Continuity and Disaster Recovery procedures.

All customer data is encrypted at-rest. Anvilogic is committed to following encryption best practices per industry guidelines and continually reviews the rigor of current encryption standards.

All customer data is encrypted in-transit .Anvilogic is committed to following encryption best practices per industry guidelines and continually reviews the rigor of current encryption standards.

Anvilogic adheres to a formal vulnerability management process and applies patches based on a documented SLA.

Anvilogic utilizes peer review, automated testing, and static code analysis to proactively identify issues in our code and third party dependencies.

Safeguarding customer privacy is a core commitment of Anvilogic's Service.

Additional information on our privacy practices can be found at

https://www.anvilogic.com/legal/privacy-policy

The use of Anvilogic including rights, restrictions, and applicable privacy safeguards is governed by our business terms.

Additional information can be found at

https://www.anvilogic.com/legal/msa

Anvilogic internal systems access is restricted by stringent access control measures monitored and updated according to industry best practices on a regular basis. Access to internal systems is adherent to the principles of least privilege and separation of duties, subject to regular review by administrators, documented with clear rationales for provisioning and changes, and revoked according to strict termination policies.

We have a strong internal password policy that includes a requirement for MFA for accounts that do not support SSO.

Anvilogic centrally manages and secures all employee endpoints through a Mobile Device Management (MDM) solution. This systematic management allows us to enforce security policies, distribute software and updates, and monitor endpoint integrity.

Anvilogic's Security, Operations, and Data Team actively monitors the environment for known attacker tactics, techniques, and procedures (TTPs), as well as known malicious binaries and other suspicious activities. These regular activities are complemented by periodic reviews and investigations into anomalous activities to discover unknown threats occurring on a regular cadence.

To safeguard our infrastructure, Anvilogic utilizes a combination of traditional firewalls.

These tools allow us to monitor and control the flow of network traffic, preventing unauthorized access and ensuring data integrity and security.

Our network activity is logged with specialized detection logic in place to identify potential security threats such as unauthorized access or anomalous behavior. These systems are critical for the early detection of attacks, allowing us to identify attackers and other anomalous behavior and generate alerts for further investigation.

Anvilogic engages in third-party penetration testing annually and upon the release of new products to proactively identify and address security vulnerabilities within our systems. The outcomes of these tests are meticulously documented, and any findings are prioritized for remediation according to their severity.

Anvilogic maintains a rigorously documented Incident Response Plan that serves as our predefined procedure for handling potential security incidents. This plan is systematically reviewed, tested, and approved by appropriate stakeholders on an annual basis to ensure readiness and effectiveness in responding to security incidents.

Anvilogic is committed to maintaining a high level of security and privacy awareness among its personnel through comprehensive annual training programs. This training covers critical topics such as password management, mobile device security, social engineering tactics, physical security, phishing attacks.

AWS Compliance, aws-security@amazon.com, 844.902.4700  

Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorized):  IaaS

Information Security Team, security@openai.com

Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorized): Insights and CoPilot.

John LaBarre, VP, Deputy General Counsel, john.labarre@snowflake.com

Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorized): Alert Services.