RELAYTO Limited applies the following technical and organizational measures to RELAYTO AI production services. These measures are the Security Documentation for Annex II. They are reviewed at least annually as part of the SOC 2 Type II program. 1. Information security program. Written policies for access control, encryption, incident response, vendor management, change management, and acceptable use. Security ownership sits with RELAYTO Limited operations. Policies are published internally and summarized at https://trust.relayto.com/. 2. Independent attestation. Annual SOC 2 Type II examination of the RELAYTO AI production services. Report delivered to customers under NDA. Findings tracked to closure. 3. Access control. Unique user IDs. MFA on administrative and production access. Role-based access. Access reviewed on hire, role change, and termination. Production access limited to personnel who need it for operations or support. 4. Encryption. TLS in transit for RELAYTO AI connections. Encryption at rest for Stored Data on AWS-hosted data stores. Keys managed through the cloud provider's key management service. 5. Network and edge. Cloudflare and/or AWS edge controls for DDoS and WAF. Segmentation between production and corporate environments. 6. Logging and monitoring. Application, infrastructure, and admin-access logs. Alerts to the operations on-call path. Logs retained for a period sufficient for incident investigation and the SOC 2 Type II audit window. 7. Vulnerability and change management. Patches tested on a staging environment before production. Vulnerability intake and scheduled remediation. Customer-requested pen tests on a dedicated enterprise environment by written agreement. 8. Backup and recovery. Rolling hourly and daily backups as stated in the SLA. Recovery objectives: RPO 30 minutes, RTO 12 hours, as stated in the Business Continuity / Disaster Recovery sections. 9. Incident response. Written plan. Customer notice of a Personal Data incident without undue delay and in any event within 48 hours after RELAYTO Limited becomes aware of it, as stated in the DPA. 10. Vendor oversight. Sub-processors listed in Annex III. DPAs or equivalent terms with Sub-processors. New Sub-processors notified as stated in DPA section 4. 11. People. Background checks where lawful. Confidentiality terms. Security training on hire and periodically. 12. Data minimization and deletion. Stored Data deleted after the post-termination period in section 7(c), subject to legal hold and backup expiry. 13. AI features. AI Content Chat, the AI Agent, and AI-assisted creation workflows send prompts and source snippets to listed model providers (OpenAI and/or Anthropic) only as needed. Customer content is not used to train those providers' foundation models. Customer may disable these features at workspace or asset level. These measures may be updated so long as RELAYTO Limited does not materially decrease the overall security of the Services during a paid Term. The SOC 2 Type II report is the independent evidence package. This Annex is the contractual description. EXPLANATORY NOTE: The technical and organizational measures must be described in specific (and not generic) terms. 37 of 53