Videosync Security Statement

We are committed to protecting the integrity, availability and confidentiality of our information systems and our customers' data.

In the following we provide you with an overview of the measures we take to keep your data secure.

1. Provider

Videosync is developed and maintained by Inderes Oyj, a Finnish company listed on the Nasdaq First North Stock Exchange in Helsinki, Finland (FI22776002).

2. Cloud security

Certification

Inderes Oyj holds an ISO 27001 certification for its Information Security Management System, covering the development and operation of the Videosync service.

Data centre physical security

Videosync uses infrastructure from Amazon AWS for data centre hosting. Our provider's data centres are certified as ISO 27001, PCI DSS Service Provider Level 1, and/or SOC 1 and SOC 2 compliant.

Amazon AWS employs robust controls to secure the availability and security of its systems. This includes measures such as backup power, fire detection and suppression equipment, and secure device destruction, amongst others. You can read more about data centre controls at AWS and about AWS physical security measures.

Encryption

Communication with Videosync is encrypted with TLS 1.2 or higher over public networks. All Videosync data is encrypted at rest with AES-256: for the database we use MongoDB Atlas, which stores data on encrypted storage volumes, and for video and asset storage we use Amazon S3 buckets with encryption enabled.

Vulnerability scanning

We perform regular internal checks for potential system vulnerabilities using GitHub Dependabot. Dependabot is a crucial tool in our security measures, as it continuously monitors the third-party libraries and Docker images that we use. If Dependabot discovers any potential security vulnerabilities, it alerts our developers promptly. Our team is also dedicated to keeping our product dependencies up to date to ensure improved security.

Environment segregation

Our development, staging and production environments are logically separated from each other. Customer data is never used in the development or staging environments.

Access control

Access to our services is kept minimal for our staff — only as much as they need to perform their duties. To ensure secure access and availability, we employ practices such as two-factor authentication and personal credentials. We use password managers for storing shared secrets and passwords.

3. Availability and continuity

Videosync is deployed on public cloud infrastructure. Services are deployed to multiple AWS availability zones.

Scheduled maintenance, service incidents and security incidents are communicated to Videosync admin users via email and in the admin user interface. Major solution updates are also communicated via email to all registered admin users.

Backups and snapshots

We have deployed several mechanisms to make sure that our customer data stays safe in case of accidental deletion or malfunction.

When a user or a scheduled automation deletes an event, the event is first marked as "soft deleted". Soft-deleted events are hard-deleted after one month. During this one-month period the events can be quickly recovered by support.

In addition to soft deletion, we have enabled the following processes to protect customer data:

• Point-in-time database restore
• Hourly database snapshots
• Daily database backups
• Asset storage versioning (S3)
• Daily asset storage backups to another AWS region

Uptime and monitoring

We use Datadog to monitor our servers and for external uptime monitoring. All abnormal behaviour is reported to the development team with Slack, email and SMS alerts.

4. Data location and EU-related requirements

As mentioned in "Availability and continuity", availability in different geographical areas is secured with multiple availability zones. In practice, events or video streams originating in the US are handled with ingest servers based in the US, whereas streams originating in Europe are handled with ingest servers in Europe.

However, we have multiple clients who request that their data is kept in the EU region, and our infrastructure is built to respond to this demand. Should a client require that their data is not stored outside the EU, we accommodate this request. By default, the data of our clients residing in the EU is stored and handled solely in the EU region.

Certain features use a subprocessor that can transfer data to the USA. See the vendor listing at the end of this document for details.

5. Personal security

Admin access control

Root-level accounts are used only by the developers responsible for the infrastructure, and the accounts are used only when needed. Access to a customer's account is restricted to the users defined in the account settings. User access of Videosync staff is revoked upon termination of employment or a change of job role.

Audience access to customer content can be controlled using IP, password or referrer protections, or by enabling OAuth 2.0 login with Azure (Microsoft 365) or Google.

Audit trail

All logins and access to a customer's account are logged in a detailed audit trail. If there is a suspicion of unauthorized access to the account, it is discoverable which account was used and access can be blocked temporarily.

Confidentiality and code of conduct

All employees with access to the Videosync environment are required to sign non-disclosure and confidentiality agreements.

6. Data privacy

Videosync maintains compliance with the European Union's General Data Protection Regulation (GDPR). We use the EU Commission approved standard contractual clauses for data transfer from the EEA to the United States, if data transfer is necessary. As mentioned in "Data location and EU-related requirements", Videosync can be operated without moving any data to the United States.

7. Third-party security

Complying with our security standards is priority one when evaluating new vendors. Only vendors meeting our criteria for security are accepted to move forward with. Selected vendors are monitored on an ongoing basis to ensure that they do not cause potential security issues.

Subprocessors

Optional Videosync applications and features, and their subprocessors