Back to Help Center

Security

Security

What and where does Intrro store the data it collects?

Do you fill out security assessments?

Who is the security contact?

Single Sign-On

User Roles

Passwords

Application Infrastructure

Vulnerability Management

Intrusion Detection and Prevention

Logical Separation

Incident Response

Vulnerability Disclosure

Software Development Life Cycle

Data Encryption

Data Subprocessors

New SCCs & the GDPR

California Consumer Privacy Act

High Availability

Business Continuity

Disaster Recovery

Backups

Security Training

Risk Management

Security Policies

Vendor Management

Confidentiality Agreements

Endpoint Security

SOC 2 Type II

1. Definitions

2. Customer Data subject to EU Data Protection Law

3. Purpose and Scope

4. Security

5. Data Subject Rights

6. Customer Personal Data Breach

7. Sub-Processors

8. Audit

9. Impact Assessment

10. Data Deletion

11. Transfer Mechanisms

12. Customer Data subject to CCPA

13. Customer Data subject to LGPD

14. Customer Responsibilities

15. Liability

16. Term and Termination

17. General

Annex 1A

Annex 1B

Annex 1C

Annex 2

Annex 3

Compliance Documentation

Data Subjects Rights

Consent

Data Breach

SOC 2 Type II

6. Customer Personal Data Breach

The Controller acknowledges and agrees that:(a) subsidiaries of the Processor may be used as Sub-Processors; and(b) the Processor and its Subsidiaries respectively may engage Sub Processors in connection with the provision of the Services. As a condition to permitting a Sub-Processor to Process Customer Personal Data, Intrro or will enter into a written agreement with the Sub-Processor containing data protection obligations no less protective than those in this DPA with respect to Customer Personal Data. Subject to this Section 7, Intrro reserves the right to engage and substitute Sub-Processors as it deems appropriate, but shall:(a) remain responsible to Customer for the provision of the Services and (b) be liable for the actions and omissions of its Sub-Processors undertaken in connection with Intrro’s performance of this DPA to the same extent Intrro would be liable if performing the Services directly. Intrro’s current list of Sub-Processors is available at https://Intrro.com/help/data-subprocessors/.During the term of this DPA, the Intrro shall provide the Customer with at least 14 days notification, via email (or in-application notice), of any changes new Sub- Processor(s)who may process Customer Personal Data before authorizing any new or replacementSub-Processor(s) to process Customer Personal Data in connection with the provision of the Services. If the Customer objects to a new or replacement Sub-Processor within14 days of such notice, and Intrro is unable to take corrective steps to exclude suchSub-Processor, then the either party may terminate the Agreement with respect to those Services which cannot be provided by the Intrro without the use of the new or replacement Sub- Processor. Intrro will refund the Customer any prepaid fees covering the remainder of the Term of the Agreement following the effective date of termination with respect to such terminated Services. If the Customer does not provide a timely objection notice with respect to a new Sub-Processor, Customer will be deemed tohave authorized Intrro to use of the Sub-Processor and to have waived its right to object. Intrro may use a new or replacement Sub- Processor while the objection procedures under this Section 7 are in process.