Agmt17 Brainfuse, Inc. - Laserfiche WebLink

Browse Search

standards as referenced in FIPS 140-2, Security Requirements for Cryptographic Modules for all Personal Data. v. At no time shall any data or processes — that either belong to or are intended for the use of a Library or its officers, agents or employees — be copied, disclosed or retained by Brainfuse or any party related to Brainfuse for subsequent use in any transaction that does not include the Library. vi. Brainfuse shall not use any information collected in connection with the services issued from this Agreement for any purpose other than fulfilling the services. Section 8.3 Data Location Brainfuse shall provide its services to the Library and its end users solely from data centers in the U.S. Storage of Library Data at rest shall be located solely in data centers in the U.S. Brainfuse shall not allow its personnel or contractors to store Library Data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. Brainfuse shall permit its personnel and contractors to access Library Data remotely only as required to provide technical support. Brainfuse may provide technical user support on a 24/7 basis using a Follow the Sun model, unless otherwise prohibited in this Agreement. Section 8.4 Securitv Incident or Data Breach Notification Brainfuse shall inform the Library of any Security Incident or Data Breach: Incident Response: Brainfuse may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in this Agreement. Discussing Security Incidents with the Library should be handled on an urgent as - needed basis, as part of Brainfuse communication and mitigation processes as mutually agreed upon, defined by law or contained in this Agreement. ii. Security Incident Reporting Requirements: Brainfuse shall report a Security Incident to the appropriate Library Identified Contact immediately. iii. Breach Reporting Requirements: If Brainfuse has actual knowledge of a confirmed Data Breach that affects the security of any Library content that is subject to applicable Data Breach notification law, Brainfuse shall (1) promptly notify the appropriate Library Identified Contact within 24 hours or sooner, unless shorter time is required by applicable law, and (2) take commercially reasonable measures to address the Data Breach in a timely manner. Section 8.5 Breach Responsibilities This section only applies when a Data Breach occurs with respect to Personal Data of Non -Public Data within the possession or control of Brainfuse. i. Brainfuse, unless stipulated otherwise, shall immediately notify the appropriate Library Identified Contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a Security Incident. ii. Brainfuse, unless stipulated otherwise, shall promptly notify the appropriate Library Identified Contact within 24 hours or sooner by telephone, unless shorter time is required by applicable ATTY/AGR/2017.276/BRAINFUSE, INC. REV: 11-17-1715 Page 4 of 7