Bitsight FAQs to the Main Subscription Terms and Conditions

Bitsight is a Software as a Service (“SaaS”) cyber risk management company. We provide access to our platform via a web browser or Application Programming Interface in order for customers to monitor the cyber security posture of organizations, including their own security performance, via access to rating information. Bitsight ratings are generated from publicly accessible data that include externally observed evidence of system compromises. Ratings and associated data are updated every day within the platform.

We also provide customers the ability to create a security profile about their organization consisting of security artifacts (such as a SOC2) and share such information with third-party organizations. Customers may purchase professional services to assist in making the most of their subscription and such services are subject to Bitsight’s Professional Services Addendum (“Professional Service Terms”). Your assigned account representative can answer questions about our suite of products and services should you have any questions about specific offerings.

Bitsight’s offerings are cloud-based multi-tenancy SaaS solutions. All of our customers access the offerings via a shared architecture, code base, and infrastructure. Although Bitsight may assist customers with utilizing the service via professional services, Bitsight does not create custom intellectual property (“IP”) or deliverables, or works made for hire for customers; there is no transfer of IP ownership between the parties. No installation or implementation services are required to use Bitsight’s offerings and no Bitsight software will be installed on your network or devices.

Alongside the Bitsight Terms referred to above, Bitsight’s quotation (referred to as the “Order” in the Bitsight Terms) describes the commercial details of your subscription to the Bitsight products and services. This includes your legal entity name, product name, product number, product SKU, subscription term, price, and quantity of subscription.

As a SaaS one-to-many solution, all Bitsight customers who subscribe to a Bitsight service receive the same offering. For this reason, Bitsight’s subscription terms are standardized across its entire customer base. Because our terms reflect the specifics of our service, our experience is that using Bitsight’s subscription terms is the quickest, most efficient way to agree to an appropriate contract demonstrating an industry-standard position.

Various third-party services are available through integrations, including partner services purchased through Bitsight. You may be required to agree to additional terms and conditions before accessing such integrated third-party services.

In general, the Bitsight services are intended to be used for your internal business purposes in order to manage the security risk of your organization and the organizations you monitor. You are also able to share Bitsight rating information externally with third-party organizations, subject to the specific requirements in Section 1 of the Bitsight Terms. Please refer to Section 1 of the Bitsight Terms for additional information about customer use rights and restrictions.

As a cyber risk management company, Bitsight takes confidentiality and data security very seriously. Bitsight treats non-public information shared by you with Bitsight as confidential and does not disclose it to third parties without your consent. You retain sole ownership of your confidential information.

In some instances, when using the Bitsight platform, you will want Bitsight to share some of your confidential information with third parties on your behalf. The Bitsight platform contains the following tools that allow you to do so automatically with just a few clicks:

Annotations

When using Bitsight’s SPM platform, you can choose to add annotations to your rating, such as corrections or comments to update or explain a rating or IP addresses. In the platform, you can choose whether to make annotations visible to other Bitsight users. Annotations are considered your confidential information unless you choose to make them visible to other Bitsight users, in which case they will no longer be considered confidential and they will be visible to any Bitsight user that is monitoring your rating. Customers often choose to make their annotations visible to other Bitsight users since doing so allows them to provide context with respect to specific rating details and communicate directly with Bitsight users who are monitoring their rating.

Trust Management Hub

Trust Management Hub allows you to upload and share non-public content regarding your cybersecurity risk profile, including questionnaires and security and/or compliance documents (referred to in the Bitsight Terms as “Customer Content”), with your current and prospective customers. This information is treated as your confidential information and is only shared with third parties as directed by you in the Trust Management Hub platform. Your Customer Content is not otherwise incorporated into Bitsight’s underlying service or shared broadly among Bitsight’s customer base.

Feedback

We encourage you to share any feedback you may have about how to improve Bitsight’s products and services. Providing such feedback is voluntary. While we will not identify you as the source of feedback without your prior consent, the feedback itself will not be considered your confidential information, as it may eventually be incorporated into Bitsight’s services and available to other customers.

What personal data is stored in or accessed by the Bitsight platform?

The Bitsight platform accesses or stores full names and business emails. Bitsight’s Vendor Risk Management or Trust Management Hub services require the names and emails of your vendors in order to make connections. Otherwise, personal data comprising the username and email address of your users is required for log-in purposes, although for security and data protection reasons we always recommend that customers use an alias (such as Security Officer - [email protected]). Section 7.15 of the Bitsight Terms specifies how we will use the personal information provided and incorporates Bitsight’s Data Sharing Agreement, which provides additional details on processing as it relates to applicable data privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively the “CCPA”) and General Data Protection Regulation (“GDPR”).

Is Bitsight considered a “data controller” or a “data processor” under the GDPR?

Bitsight is generally considered a data controller for purposes of the GDPR and Standard Contractual Clauses as our customers only provide us with very limited personal data that we use to verify the identity of the users or to understand how users use our services and to improve them (as more fully described in Bitsight’s Privacy Policy). In some circumstances, we are the data processor as well and incorporate the appropriate modules of the Standard Contractual Clauses to address that processing (e.g. where a customer provides vendor contact information to create a connection with respect to use of the Vendor Risk Management and/or Trust Management Hub services). We protect the personal data under our confidentiality section and through our robust security program.

Where does Bitsight store my data?

Bitsight uses AWS to host and store all data used in the services.

Does Bitsight use subprocessors?

Yes, Bitsight uses subprocessors. A list of Bitsight’s current subprocessors can be found at Bitsight’s Subprocessor Page (“Subprocessor Page”). Bitsight’s relationships with these subprocessors are subject to Bitsight’s vendor management program, which requires that each subprocessor meets Bitsight’s security and privacy standards. Bitsight further enters into appropriate, protective data processing agreements with its subprocessors prior to their processing any customer personal data.

How can I subscribe for updates to Bitsight’s subprocessor list?

If you would like to subscribe to receive notifications of any future changes to the Subprocessor Page, please use the form at the bottom of that page or email [email protected] with your company name and email address for Bitsight to record your subscription. You will then be automatically notified every time this subprocessor list is updated. Additionally, you can have multiple employees at your organization sign up for these updates.

Bitsight is committed to helping our customers utilize our products and services and to that end we support our customers with any service issues they experience. This support is included in the subscription. For more information on our service level availability and associated up-time percentage, please review Bitsight's Service Level Agreement.

Bitsight utilizes technical and organizational security measures to protect your confidential information. For more information on those practices, please review Bitsight's Security Information Standards.

Bitsight upholds the highest standards of business conduct and maintains an associated Code of Conduct and Ethics policy that all Bitsight employees must follow.

Bitsight provides users the ability to access additional optional features within the Bitsight service in order to enhance their security risk management experience. Such additional optional features are subject to Bitsight's Embedded Service Terms and Conditions for Additional Functionality and are currently available to users at no additional cost. Each feature is governed by its associated set of embedded terms.