Nested Knowledge's products offers a web-based software-as-a-service application and customer support services, including notices of new releases. This policy ensures that third party services used by Nested Knowledge undergo appropriate risk and data protection assessment.

A list of sub-processsors and third-party service providers is maintained below. The list is updated at least annually.

Developers monitory third party providers for breaches and vulnerabilities, and notify the Technical Lead by email or slack when a breach is detected.

If a security breach is detected, we:

• Evaluate the severity of the incident and determine the urgency of response and resource deployment.
• Identify the classes of data affected by the breach.
• Remove the service provider, or modify use of the service provider.
• Disclose the security incident to users.
• If applicable, we escalate to clients by following the chain on communication described in our service license agreement.

Third party processors are similarly monitored for policy changes, specifically with regard to changes impacting regulatory requirements.

Subprocessors handle user data processing tasks on behalf of the software application.

Infrastructure Providers house the physical hardware used to run the application. These providers do not process user data, although they contain it.

Third-party provider offers services that are integrated into the application in an opt-in manner or without processing user data, and are not necessary for core functionality.

The Policy Privacy describes the data Nested Knowledge shares with third party service providers.

Contracts with third party service providers must incorporate information security requirements, including data protection and notices of security incidents.

We will document roles. responsibilities, and controls between Nested Knowledge and third parties, where applicable. Documentation and risk assessment should be stored in our filesystem drive in the respective directory for the third party provider.

Upon client request, disclosure of all contracts with third party service providers where such third party service providers are involved in the client's deliverables shall be made.

At least annually, we will review third parties vendors to assess compliance with contracts and security standards, and we update the privacy policy accordingly.

When new third party sub-processors are to be added, data supplied to vendors is to change, or the vendor's processing agreement are to change, all affected users will be notified via email with at least 7 days notice.

When Nested Knowledge terminates a contract with a sub-processor, within 60 days we will request deletion of all personal data. Nested Knowledge will review the data deletion/backup retention policies of our sub-processor and inquire about practices if it is not sufficently documented.

Return to Policies