We comply with the provisions of the Digital Millennium Copyright Act applicable to Internet service providers (17 U.S.C. §512, as amended). If you have an intellectual property rights-related complaint about material posted on the Expent Services, you may contact our Designated Agent at the following address: Attn: Copyright Agent Expent Inc; Email: contact@expent.ai. Any notice alleging that materials hosted by or distributed through the Expent Services infringe intellectual property rights must include the following information: 
‍

Repeat Infringers. Expent will promptly terminate the User Accounts of Users that are determined by Expent to be repeat infringers.

Expent will exercise diligence efforts to comply with the data security requirements set forth below (the “Data Security Policy”), during the term of the Agreement. All terms not defined in this schedule shall have the definitions as set forth in the General Terms of Use.

• Customer Data – Protection and Non-Disclosure. Expent shall safeguard Customer Content and any data or information stored on the Expent Services on Customer’s behalf (“Customer Data”) in accordance with this Data Security Policy (and the confidentiality obligations set forth in the Agreement, as applicable), and will not disclose, transfer or use any such information for any purpose other than as permitted in this Agreement or otherwise to perform its obligations under this Agreement.

• System Protection & Recovery. Expent will protect its servers hosting Customer Data against outages using standard SaaS industry methods designed to prevent outages and minimize impacts during any unavoidable service interruptions, including: (i) instituting UPS protection, automatic backups, and fire suppression protection of its computer systems; and (ii) implementing and regularly testing a disaster recovery or business continuity plan for its facilities where Customer Data is stored.

• Data Security. Expent will maintain the following basic security requirements during the term of the Agreement: (i) install and maintain a working network firewall to protect data accessible via the Internet; (ii) encrypt all data sent across open networks; (iii) keep security patches up-to-date; (iv) ensure up-to-date anti-virus software is used on all employee laptops; (v) ensure no manufacturer-supplied defaults for system passwords and other security parameters are used; (vi) mandate the use of “strong passwords'' for all Expent employees accessing Customer Data in production environments; (vii) regularly test security systems and processes; (viii) maintain a policy that addresses information security for Expent employees and suppliers; (ix) restrict physical access to systems containing Customer Data; (x) restrict remote access to the entire network and employ remote access controls to verify the identity of users connecting; and (xi) protect on-site and off-site backups from unauthorized access during transit and storage. 

• Secure Data Transmission. Expent will use the following mechanisms for the protection of Customer Data transmission:

  • (i)

    XML/HTTP over SSL, with certificate-based authentication utilizing a 2048-bit (or larger) RSA public key, and 128-bit (or stronger) symmetric encryption;
  • (ii)

    digitally signed and encrypted S/MIME messages over HTTP or SMTP, using certificates with a 2048-bit (or larger) RSA public key, and 128-bit (or stronger) symmetric encryption;
  • (iii)

    digitally signed and encrypted PGP (Pretty Good Privacy) or GPG (Gnu Privacy Guard) messages over a variety of transports, with 2048-bit (or larger) RSA or DH/DSS public keys, and 128-bit (or stronger) symmetric encryption;
  • (iv)

    for all message-based encryption schemes employing digital signatures (including PGP and S/MIME), Expent will verify the digital signature of the message and reject messages with invalid signatures; and
  • (v)

    For all encryption schemes employing public key cryptography, Expent will maintain the confidentiality of the private component of the public-private key pair, and will promptly notify Customer in the event that the private key is compromised.

• Security Incidents.

  • 5.1.

    Security Incident Notification. Expent will inform Customer within 72 hours of detecting any unauthorized access, collection, acquisition, use, transmission, disclosure, corruption or loss of Customer Data, or breach of any environment: (i) containing Customer Data; or (ii) managed by Expent with controls substantially similar to those protecting Customer Data (each, a “Security Incident”).
    5.2.

    Remediation. Expent will remedy any Security Incident in a timely manner and provide Customer written details regarding Expent’s internal investigation regarding any Security Incident.
    5.3.

    Formal Notification. Other than as required by applicable law, Expent agrees not to notify any regulatory authority, nor any customer, on behalf of Customer unless Customer specifically requests in writing that Expent does so and Customer reserves the right to review and approve the form and content of any notification before it is provided to any party. Expent will cooperate and work together with Customer to formulate and execute a plan to rectify all confirmed Security Incidents.