Security Policy

Document owner: Wiggli - Data Protection Office (dpo@wiggli.io)

Version: 1.0

Effective date: October 1st 2026

Last reviewed: [ • ]

Review cycle: At least annually, or upon a material change to the Product or to Applicable Data Protection Laws

1. Purpose and Status

1.1 This Security Policy (the "Policy") sets out the audit and reporting rights and the minimum technical and organisational security measures that Provider maintains in respect of Customer Personal Data, and Content (but excluding Inputs and Outputs, as defined in the AI & Data Terms) (together, “Customer Data”) .

1.2 Provider may amend or update this Policy from time to time, provided that any such amendment will not materially reduce the overall level of security afforded to Customer Data. The measures in force from time to time will remain consistent with, and no less protective than, those required under Article 32 of the GDPR and the DPA. The version in effect is the most recent version published or provided by Provider.

1.4 In the event of any conflict between this Policy and any agreement, the agreement controls to the extent of the inconsistency.

2. Security Reports

2.1 Security Reports. Provider regularly reviews its security standards against the standards defined in this Policy. Upon written request (no more than once annually), Provider will give Customer, on a confidential basis, a summary copy of its then-current report so that Customer can verify Provider's compliance with the standards defined in this Policy.

2.2 Security Due Diligence. In addition to its commitments under this Policy, Provider will respond to reasonable requests for information made by Customer to confirm Provider's compliance with the DPA, including responses to information security, due diligence, and audit questionnaires, or by giving additional information about its information security program. All such requests must be in writing and made to Provider by emailing dpo@wiggli.io and may only be made once a year.

3. Technical and Organisational Measures

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons, Provider implements and maintains appropriate technical and organisational measures in accordance with Article 32 of the GDPR to ensure a level of security appropriate to the risk, including, as appropriate:

• User authentication mechanisms
• Role-based access controls
• Automatic session timeouts and account lockouts
• Data encryption in transit
• Data encryption at rest
• Key management practices
• Firewalls and network segmentation
• Secure configuration of network devices
• Surveillance and monitoring
• Patch management and vulnerability management processes
• A secure software development life cycle
• Incident response and disaster recovery plans
• Background checks and security awareness training for personnel
• Confidentiality agreements and data handling policies
• Audit logging and log management processes
• Security event monitoring and incident response procedures
• Due diligence and security assessments of vendors and Subprocessors
• Contractual security obligations and requirements for third parties
• Training of all Wiggli personnel on data processing and handling practices, as relevant to their role.

4. Change Log