Security Exhibit

Version 1.0, effective 10/23/2026. Published at https://apisec.ai/security. Incorporated by reference into the APIsec Master Subscription Agreement. On written request APIsec will provide a dated PDF of the version in effect on an Order Form’s Effective Date.

1. Information Security Program

APIsec maintains a written information security program that is reviewed and approved at least annually by APIsec management, is owned by a designated security leader, and is designed to protect the confidentiality, integrity, and availability of Service Data. The program is aligned to [SOC 2 Trust Services Criteria / ISO 27001 / NIST CSF].

2. Certifications, Audits, and Assessments

1. APIsec maintains a SOC 2 Type II attestation covering the Services, refreshed at least annually with no material gap between observation periods.
2. Upon Customer’s written request, no more than once per twelve (12) month period, APIsec will provide its most recent SOC 2 Type II report, subject to the confidentiality obligations in Section 5 of the MSA.
3. APIsec engages a qualified independent third party to conduct a penetration test of the Services at least annually, and will provide an executive summary of the results, together with a statement of remediation status for any critical or high findings, upon Customer’s written request no more than once per twelve (12) month period.
4. APIsec will promptly notify Customer if it loses or fails to renew any certification described in this Section.

3. Security Questionnaires and Diligence

APIsec maintains a completed standard security questionnaire ([CAIQ / SIG Lite / other]) which, together with the SOC 2 Type II report and penetration test summary, will be provided in the first instance in response to Customer diligence requests. APIsec will respond to Customer’s reasonable supplemental security questionnaire not more than once per twelve (12) month period, within thirty (30) days of receipt, and will respond promptly to reasonable ad hoc questions following a Security Incident affecting Customer.

4. Access Control

APIsec (a) grants access to Service Data on a least-privilege, role-based basis; (b) assigns unique credentials to each individual and prohibits shared accounts; (c) requires multi-factor authentication for all administrative access, remote access, and access to production systems; (d) reviews access entitlements at least quarterly; and (e) revokes access within twenty-four (24) hours of an individual’s termination or role change.

5. Encryption

APIsec encrypts Service Data (a) in transit using TLS 1.2 or higher with industry-standard cipher suites, and (b) at rest using AES-256 or an equivalent or stronger algorithm. Encryption keys are managed through a dedicated key management service, rotated in accordance with APIsec’s key management policy, and access to keys is restricted and logged.

6. Network and Infrastructure Security

APIsec (a) hosts the Services with an infrastructure provider that maintains its own SOC 2 Type II or ISO 27001 certification; (b) segments production from non-production environments; (c) enforces firewall and security group rules on a default-deny basis; (d) deploys intrusion detection and DDoS protection; and (e) hardens systems to a documented baseline configuration standard.

7. Vulnerability and Patch Management

APIsec performs automated vulnerability scanning of its infrastructure and application dependencies on a continuous or at least weekly basis, and remediates validated vulnerabilities in production systems according to the following targets, measured from validation:

8. Secure Development

APIsec maintains a secure software development lifecycle that includes peer code review prior to merge, static application security testing (SAST), software composition and dependency analysis, dynamic testing prior to significant releases, and separation of development, test, and production environments. Customer Service Data is not used in non-production environments.

9. Logging and Monitoring

APIsec maintains centralized audit logging of access to and changes affecting production systems and Service Data, retains such logs for at least [three (3) months], protects logs against unauthorized modification, and monitors them with automated alerting for anomalous or unauthorized activity.

10. Personnel Security

APIsec (a) conducts background screening of personnel with access to Service Data, to the extent permitted by applicable law; (b) requires all personnel to execute written confidentiality agreements; (c) delivers security awareness training at hire and at least annually thereafter, including role-specific secure development training for engineers; and (d) maintains a documented disciplinary process for policy violations.

11. Business Continuity and Disaster Recovery

APIsec maintains a documented business continuity and disaster recovery plan, tested at least annually, with a recovery time objective (RTO) of [24 hours] and a recovery point objective (RPO) of [24 hours] for the Services. Backups of Service Data are encrypted, stored in a geographically separate location within the United States, and restoration is tested at least annually.

12. Incident Response

APIsec maintains a documented incident response plan, reviewed and exercised at least annually, that defines roles, severity classification, containment and eradication steps, evidence preservation, and communication procedures. Notification of Security Incidents is governed by Section 6.11 of the MSA.

13. Sub-Processor Security

Before engaging any Sub-Processor with access to Service Data, APIsec performs a documented security and privacy assessment and imposes contractual obligations at least as protective as those in this document and Section 5 of the MSA. APIsec reassesses material Sub-Processors at least annually.

14. Data Segregation

The Services are multi-tenant. APIsec enforces logical separation of each customer’s Service Data through documented access control and tenancy isolation mechanisms designed to prevent one customer from accessing another customer’s Service Data.

15. Asset and Endpoint Management

APIsec maintains an inventory of assets used to process Service Data and requires full-disk encryption, endpoint detection and response, automatic screen lock, and centralized management on all endpoints with access to production systems or Service Data.

16. Evidence Data Handling

The following controls apply to Evidence Data as defined in Section 6.6 of the MSA.

1. Minimization. The Services capture only the portion of an API request or response reasonably necessary to substantiate a finding, and truncate each captured body to [8 KB].
2. Redaction by default. APIsec applies automated pattern-based redaction to Evidence Data before storage, masking values matching common personal and sensitive data patterns, including email addresses, national identification numbers, payment card numbers, bank account numbers, telephone numbers, dates of birth, and authentication tokens, credentials, and secrets.
3. Customer-defined rules. Customer may define additional redaction patterns, and may disable Evidence Data capture entirely, in each case through the configuration settings of the Services. Disabling Evidence Data capture does not affect core scanning functionality other than the inclusion of captured payloads in findings.
4. Retention. Evidence Data is retained for [ninety (90) days] from capture, or such shorter period as Customer configures, after which it is deleted. Findings are retained for the Term independent of the underlying Evidence Data.
5. Segregation and access. Evidence Data is encrypted at rest, logically segregated from other Service Data, and accessible only to APIsec personnel with a documented operational need. Access to Evidence Data is logged and reviewed at least quarterly.
6. Exclusion from model training. Evidence Data is never used to train, fine-tune, or otherwise develop or improve any machine learning or artificial intelligence model, and is excluded from the scope of any Order Form election made under Section 6.4 of the MSA.
7. Support channels. APIsec personnel will not request that Customer transmit Evidence Data or production payloads through email, chat, or ticketing channels, and will direct Customer to the secure evidence viewer within the Services instead.

17. Changes to this Document

APIsec may update this document from time to time to reflect changes in its security program, provided that no update will materially degrade the protection afforded to Service Data. The current version is published at https://apisec.ai/security.