Agmt25 Populus Technologies, Inc.

Browse Search

REV: 01-13-25 LR EXHIBIT H SECURITY POLICY Data Categorization and Security Populus exclusively uses Google Cloud for its data storage and processing services. Google Cloud security has both the ISO 27001 and the ISO 27018 certifications. Google Cloud implements software-level measures such as firewalls, layered DMZs, intrusion detection, DOS protection and access management of end-user data. Google also implements hardware-level measures such as hardware provenance, a secure boot stack, and security premises. The use of a single cloud rather than multiple clouds eliminates security breaches that can occur in the transmission of data. Populus received SOC2 Type 2 certification in March 2024. Populus’s Data Classification Policy categorizes data into four classifications: 1.Sensitive/Restricted Data 2.Confidential Data 3.Internal Use Data 4.Public Data Data Minimization Populus encrypts all city data at rest and in transit with controlled access. All authorized users may access aggregated data at any time in the web-based platform. All disaggregated data are stored using Google Storage and are processed to an aggregate form using Google Compute Engine before leaving Google Cloud to transmit to the web and other clients. Populus ingests only location data from GPS traces. No Personal Information in the form of rider information (i.e. names, contact information) is associated with MDS, CDS, or GBFS, limiting the amount of personal information accessed and stored. All data in Mobility Manager are anonymized and aggregated (five-trip minimum) so that individual trips cannot be identified. Data aggregated by geography includes trip origins, destinations, parking events, vehicle counts (by all available vehicle statuses), and trip routes. In the event an aggregation includes fewer than five (5) events, that aggregation is hidden from users and will not be visible in the dashboard results nor available in the exports or reports. Populus only stores data necessary to fulfill the use case(s) (data minimization), in compliance with the Mobility Data Specification (MDS) and Curb Data Specification (CDS) privacy policies. MDS APIs allow MDS users to collect only that data which is actually needed. Data Sharing and Access Limitations Access to the platform is granted via a permission-based security system to facilitate the protection of potentially sensitive data. Different features of the platform can be made available to users with different levels of access. ATTY/AGR.2025.005/Populus Technologies, INC (SaaS Agreement) (Page 32 of 34)