5 unchanged sentences
We have adopted physical, technological, and administrative controls on data security and have a defined procedure for incident detection, containment, response, and remediation .
−Removed: Our information security team is primarily responsible for managing our cybersecurity and data privacy risk management processes.
+Added: Our information security team is primarily responsible for managing our cybersecurity processes and partners with our legal team on data privacy risk management processes.
We conduct regular test exercises to ensure all relevant teams are aware of their responsibilities during a cybersecurity event or incident, and we use these exercises to promote a culture of continuous improvement.
−Removed: We also have implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.
+Added: We also have implemented controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.
Our platform is designed to help ensure the security of our data and systems, protect our customers’ personal information, and meet the rigorous privacy and security requirements of our Enterprise clients.
−Removed: To that end, we have obtained, and we maintain through regular audits where relevant, the following security and privacy certifications:
−Removed: ISO 27001 and 27018, SOC 2 Type 2 certification, SOC 3 certification, PCI-DSS Level 1 certification, and U.S.-EU and U.S.-Swiss Privacy Shield certifications.
−Removed: We are also TrustArc certified.
−Removed: In addition, we leverage the National Institute of Standards and Technology security framework to drive strategic direction and maturity improvement to protect against new and evolving cybersecurity risks over time.
+Added: To that end, we have obtained and maintain the following security and privacy certifications:
+Added: ISO 27001 and 27018, SOC 2 Type 2 certification, SOC 3 certification, PCI-DSS Level 1 certification, U.S.
+Added: Department of Commerce Data Privacy Framework certifications, and TRUSTe Enterprise Privacy & Data Governance Practices certification from TrustArc.
Our information security controls operate at multiple levels and are designed to detect, prevent, and mitigate cybersecurity threats that could impact the privacy and security of our data and our customers’ data.
6 unchanged sentences
These third parties provide security services, including regular reviews of our security environment to provide an independent, industry-recognized risk rating and internal audits of our technology and security controls.
−Removed: We have also developed a program and engaged with a bug bounty service for ongoing identification of exploitable
−Removed: vulnerabilities in the environment.
+Added: We have also developed a program and engaged with a bug bounty service for ongoing identification of exploitable vulnerabilities in the environment.
Separately, our information security team also conducts regular scans of the environment to identify known vulnerabilities for remediation.
We also have processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.
−Removed: To that end, we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.
+Added: To that end, we maintain a risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors and service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.
In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture.
2 unchanged sentences
All access to our platform is encrypted using industry-standard transport layer security technology.
−Removed: When customers enter sensitive information on our site, such as tax identification numbers, we encrypt the transmission of that information using secure socket layer technology.
+Added: When customers
+Added: enter sensitive information on our site, such as tax identification numbers, we encrypt the transmission of that information using secure socket layer technology.
We also use the HSTS (HTTP strict transport security) to ensure visitors connect to the website over HTTPS which adds an additional layer of protection for our customers.
2 unchanged sentences
In order to make secure payments through our platform, we are Payment Card Industry Data Security Standard certified, which means we have demonstrated compliance with the Payment Card Industry security standards required for businesses that complete credit card or debit card transactions.
−Removed: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition.
+Added: To date, cybersecurity threats, including any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition.
If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition.
5 unchanged sentences
One member of our audit committee earned the NACD’s CERT Certificate in Cybersecurity Oversight in 2023.
−Removed: Our audit committee receives quarterly cybersecurity-related updates from our Chief Information Security Officer, which we refer to as our CISO, including in the form of written reports and presentations.
+Added: Our audit committee receives quarterly cybersecurity-related updates from our Chief Information Security Officer , who we refer to as our CISO, including in the form of written reports and presentations.
Our CISO and audit committee also provide cybersecurity-related updates to the full board of directors three times per year, including regarding recent developments, evolving standards, metrics about cyber threat response preparedness, program maturity milestones, material cybersecurity risks and risk mitigation status, and the current and emerging threat landscape.
4 unchanged sentences
The CISO’s leadership team members are all seasoned information security professionals who have worked at some of the largest well-known brand names and are experts in their fields.
−Removed: Our CISO monitors, and participates in, our various cybersecurity policies and procedures, and our cybersecurity team regularly updates our CISO on the current status
−Removed: of the cybersecurity environment, and cybersecurity incidents and actual or potential risks.
+Added: Our CISO monitors, and participates in, our various cybersecurity policies and procedures, and our cybersecurity team regularly updates our CISO on the current status of the cybersecurity environment, and cybersecurity incidents and actual or potential risks.
Our CISO and his team provide regular updates to the management team and escalate events that require leadership’s attention.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.