PDF processing. Data stores. Document and account data sit in the RELAYTO AI document database (MongoDB Atlas on AWS). Product analytics sit in a separate analytics database. Primary hosting region is AWS Ireland unless the Order Form specifies another region (US, EU, UK, or UAE). AI features. RELAYTO AI content chat and generation send the minimum prompt and source snippets needed for a response to the listed model provider (currently OpenAI). Source documents stay on RELAYTO Limited systems. Customer content is not used to train foundation models. Customer connectors (not subprocessors of production Stored Data by default). Users may import files from Box, Google Drive, Dropbox, OneDrive, SharePoint, or FTP, and may pull articles through a URL-widget service. Those systems process data only if the Customer chooses to connect them. Operations tools. Source code is hosted on GitHub. Edge security and DDoS mitigation use Cloudflare. Embeds use an allow-list (including Embedly). Support, CRM, analytics, email, payments, and e-signature vendors are listed in Annex III. How do you mitigate security vulnerabilities? Systems are managed such that security vulnerabilities can be mitigated via centrally managed patch repositories and configuration compliance mechanisms. Routine vulnerability scans and internal/external penetration tests are performed to expose any lapses in preventative application access controls. Security patches are prioritized and applied within 24 hours when possible. We allow our enterprise customers to engage third parties to conduct pen tests on their dedicated RELAYTO environment. How does your patching test and deployment work? Patches (e.g. hotfixes) go through a very similar process as the rest of our product releases. The fixes are reviewed by another developer and functionally tested by QA. Depending upon the fix, we will then test the fix on our stage environment. If that all passes, then we deploy to production. Can RELAYTO be affected by DDOS attacks? RELAYTO has partnered with Cloudflare, the leader in Web Performance and Security on the Web in order to protect ourselves from DDOS attacks. We benefit from the Cloudflare network and experience of mitigating DDOS attacks. Technical excerpt from Cloudflare website: Cloudflare’s advanced DDoS protection, provisioned as a service at the network edge, matches the sophistication and scale of such threats, and can be used to mitigate DDoS attacks of all forms and sizes including those that target the UDP and ICMP protocols, as well as SYN/ACK, DNS amplification and Layer 7 attacks. Cloudflare is one of the largest DDoS protection networks in the world. It offers flat-rate DDoS protection based on Anycast technology and has successfully mitigated attacks bigger than 400Gbps. 41 of 53