Platform Security

This Security Policy sets forth the technical and organizational security measures, standards, controls, and obligations that RestfulSync, Inc. ("RestfulSync," "we," "us," or "our") employs to protect the confidentiality, integrity, and availability of user data, evidence materials, platform infrastructure, and related assets. This Policy applies to: all users of the RestfulSync mobile application and web platform; all RestfulSync employees, contractors, and authorized personnel; all third-party vendors and service providers who process data on behalf of RestfulSync; and the unified LawYeti platform infrastructure shared with RestfulSync.

This Security Policy is a legally binding component of the RestfulSync Terms of Use and should be read in conjunction with the RestfulSync Privacy Policy, the LawYeti Terms of Use, and the LawYeti Privacy Policy. By using RestfulSync's Services, you agree to the security practices and user security obligations described in this document.

RestfulSync's security program is designed with reference to industry-recognized frameworks including the NIST Cybersecurity Framework (CSF), NIST Special Publications 800-53 and 800-61, the OWASP Application Security Verification Standard (ASVS), ISO/IEC 27001 principles, and SOC 2 Type II criteria. While RestfulSync is not currently certified under all of these frameworks, they inform the design, implementation, and ongoing improvement of our security controls.

Security-First Design Principles

RestfulSync is built on four core security principles:

1. Privacy by Design — security and privacy controls are built into features from inception, not added as afterthoughts.

2. Minimum Necessary Access — personnel, systems, and third parties receive access only to the data they need.

3. Defense in Depth — multiple overlapping security controls protect against single points of failure.

4. Assume Breach — systems are designed to minimize impact assuming a determined attacker could gain partial access.

1.1 Master Controls Reference.

The following table provides a high-level overview of RestfulSync's security control domains, the framework standards they reference, the specific mechanisms deployed, and the scope of each control. Detailed treatment of each control domain follows in subsequent Sections of this Policy.

Control Domain Framework Ref. Control / Mechanism Scope

Encryption at Rest NIST CSF / SOC2 AES-256 for all stored data Evidence Vault, databases, backups

Encryption in Transit NIST CSF / OWASP TLS 1.2+ for all API traffic All client-server communication

End-to-End Encryption Privacy-by-Design Device-side AES-256 before upload Evidence Wizard third-party data

Key Management NIST SP 800-57 Managed key lifecycle with RBAC Encryption key custody and rotation

Access Control SOC2 / ISO 27001 Role-based access control (RBAC) All platform data and infrastructure

MFA / Authentication NIST 800-63B MFA enforced for privileged accounts Internal engineering and admin access

Audit Logging SOC2 / ISO 27001 Immutable access and change logs Evidence Vault, sensitive data access

Long-Term Evidence Integrity FTO / Legal Hold Immutable DigitalOcean storage 7-Year Legal Vault evidence

Integrity Checksum Records FTO Compliance Per-chunk integrity hashing All Evidence Vault media chunks

Vulnerability Scanning OWASP / NIST Regular automated and manual scans Web, mobile, API surfaces

Penetration Testing SOC2 / ISO 27001 Annual third-party pen tests Full application stack

Intrusion Detection NIST CSF IDS/IPS across all infrastructure Network and application layers

DDoS Mitigation Infrastructure CDN-layer and rate-limiting controls All public-facing endpoints

Fraud Detection Platform Integrity Device fingerprint + IP pattern analysis Account creation, billing, SOS usage

Incident Response NIST SP 800-61 Documented IR Plan with defined SLAs All security events

Data Minimization Privacy-by-Design Collect only what is necessary All data collection touchpoints

Secure SDLC OWASP SAMM Security review in development pipeline All code and infrastructure changes

Third-Party Vendor Review SOC2 Security review of all vendors API integrations and data processors

1.2 Scope of Coverage.

The security controls described in this Policy apply to all systems and environments that process, store, or transmit RestfulSync user data. This includes: the RestfulSync and LawYeti mobile applications (iOS and Android); the RestfulSync and LawYeti web platform; the unified backend API and application servers; the Evidence Vault storage infrastructure hosted on DigitalOcean; the Stripe payment processing integration; the emergency support service integration; the third-party telematics and location SDK integration; and all SMS delivery infrastructure. Internal engineering tools, CI/CD pipelines, and developer workstations are subject to RestfulSync's internal security policies, which are enforced through technical controls and employment/contractor agreements.

1.3 Policy Review and Updates.

This Security Policy is reviewed at minimum annually and following any material security incident, significant change to the platform architecture, or change in applicable legal or regulatory requirements. Updates to this Policy are published with a revised effective date. Material changes are communicated to users via the same channels described in the Privacy Policy. RestfulSync's security team maintains an internal version history of this Policy and all changes are tracked.

2.1 Encryption at Rest.

All user data stored within RestfulSync's infrastructure is encrypted at rest using the Advanced Encryption Standard with 256-bit keys (AES-256). This encryption applies to: all data stored in the Evidence Vault, including video media, audio recordings, document scans, and metadata; all user account data stored in application databases; all backup copies of production data; all fraud detection and audit logs; and all chat and consultation metadata. AES-256 is currently the industry standard for symmetric encryption and is approved for protection of classified information by the U.S. National Security Agency. RestfulSync does not store any user data in unencrypted form at rest.

2.2 Encryption in Transit.

All data transmitted between user devices and RestfulSync servers, between RestfulSync servers and third-party vendor systems, and between internal infrastructure components is encrypted in transit using Transport Layer Security (TLS) version 1.2 or higher. RestfulSync enforces a minimum TLS version of 1.2 and supports TLS 1.3 where available. Older, deprecated protocols (SSL 3.0, TLS 1.0, TLS 1.1) are disabled and not supported. Certificate management is conducted through automated certificate authority integrations with short-lived certificate rotation to minimize exposure from potential certificate compromise.

2.3 End-to-End Encryption for Evidence Wizard Third-Party Data.

Witness information, scanned identification documents, and other third-party Sensitive Information submitted through the Post-Incident Evidence Wizard is encrypted on the user's device using AES-256 before transmission. This means the data is encrypted before it leaves the device and remains encrypted in transit and at rest. The encryption key is derived from the user's account credentials and is not accessible to RestfulSync personnel in its raw form. This end-to-end design minimizes the risk of third-party Sensitive Information being exposed even in the event of a server-side breach.

Encryption Key Custody Limitation

For standard Evidence Vault media (videos, photos, voice memos), encryption keys are managed by RestfulSync, Inc. under strict key management procedures. RestfulSync personnel with appropriate authorization can decrypt this content for legal compliance, security investigation, or user support purposes. Only third-party Sensitive Information entered via the Evidence Wizard benefits from user-controlled end-to-end encryption where RestfulSync cannot decrypt the content without user cooperation. Users should be aware of this distinction when determining what information to store in the Evidence Vault.

2.4 Key Management.

RestfulSync employs a documented key management lifecycle consistent with NIST Special Publication 800-57 guidance. Key management controls include: generation of encryption keys using cryptographically secure random number generators; secure storage of master keys in hardware security modules (HSMs) or equivalent hardened key management services; defined key rotation schedules (at minimum annual rotation for data encryption keys and immediate rotation upon any suspected compromise); strict access controls limiting key access to authorized systems and personnel on a documented need-to-know basis; secure key destruction procedures at end-of-life; and audit logging of all key management operations.

RestfulSync does not store encryption keys alongside the data they protect. Key storage is logically and where feasible physically separate from encrypted data storage.

2.5 Restricted-Access Long-Term Storage Integrity.

Evidence stored in the 7-Year Legal Vault for Premium and Family tier users is written to restricted-access evidence preservation (long-term evidence preservation) immutable storage hosted on DigitalOcean. restricted-access long-term storage is enforced at the infrastructure level — neither RestfulSync software, RestfulSync personnel, nor any user interface command can modify or delete long-term retention-committed data during the 7-year retention period. The long-term evidence preservation architecture provides a hardware-enforced integrity guarantee that is independent of application-layer security controls, providing defense-in-depth for evidentiary materials.

2.6 Per-Chunk integrity checksum Evidence Hashing.

All evidence media is segmented into 5–10 second chunks before upload. Each chunk is individually hashed using the integrity checksum algorithm, and the hash value is stored alongside the chunk's metadata (timestamp, GPS coordinates, device identifier, and upload receipt timestamp). integrity checksum is a cryptographic hash function in the SHA-2 family, producing a 256-bit digest that is computationally infeasible to reverse or to find a collision for. This per-chunk hashing provides a mathematical proof of integrity for each segment of evidence. RestfulSync does not employ hash chaining, Merkle trees, blockchain anchoring, or distributed ledger technology, consistent with the platform's FTO compliance design requirements.

3.1 Role-Based Access Control (RBAC).

Access to all RestfulSync systems, data, and infrastructure is governed by a formal Role-Based Access Control (RBAC) framework. Under this framework: every internal user (employee, contractor, or automated system) is assigned one or more roles; each role has a defined set of permissions that grant access only to the specific data and systems required to perform the associated job function; no role grants broader access than necessary (principle of least privilege); access grants are reviewed and approved by designated personnel before provisioning; and access is immediately revoked upon termination of employment or contract.

Defined access roles include, without limitation: Read-Only User Support (access to account metadata for support ticket resolution, no access to Evidence Vault contents); Evidence Vault Security Auditor (read-only access to Evidence Vault access logs, no access to vault contents); Engineering — Application (access to application code and non-production environments; no production data access without explicit approval); Engineering — Infrastructure (access to server configuration; no user data access without explicit approval); Security Lead (access to audit logs, fraud logs, and incident response tools); Legal / Compliance (access to data subject to valid legal process, with logging); and Super Administrator (full platform access, limited to authorized executive and security personnel, with mandatory dual-approval for sensitive operations).

3.2 Multi-Factor Authentication (MFA).

Multi-factor authentication is enforced for all internal RestfulSync personnel accessing production systems, administrative panels, cloud infrastructure consoles, code repositories, and any system that handles user data. MFA is not optional for privileged access. RestfulSync employs phishing-resistant MFA methods (hardware security keys or TOTP authenticator applications) for privileged accounts. SMS-based MFA is not permitted for administrative access to production systems due to SIM-swapping attack risk.

For user-facing accounts, RestfulSync strongly recommends enabling MFA in account settings. While MFA is not currently mandatory for all end-user accounts, it is required for any account flagged for elevated risk (e.g., accounts with large Evidence Vault stores or accounts with Family plan administrative roles). RestfulSync's roadmap includes expansion of mandatory MFA to all user accounts with Legal Vault access.

3.3 Privileged Access Management.

Access to production databases, encryption key systems, restricted-access long-term storage administration interfaces, and payment processing configurations is classified as privileged access and is subject to the following enhanced controls: just-in-time access provisioning (access is granted only for the duration of an approved task and automatically expires); dual-approval requirements for sensitive operations (a second authorized personnel must approve before execution); full session recording of privileged access sessions; mandatory post-access review and logging; and prohibition on direct production database queries from developer workstations without explicit security team approval.

3.4 Authentication Standards for User Accounts.

3.5 Access Log Review and Anomaly Detection.

All access to RestfulSync systems, Evidence Vault contents, user account data, and administrative interfaces is logged. Access logs are: written to an append-only, tamper-evident log store; reviewed by the security team for anomalous access patterns on a regular schedule; and retained for a minimum of 12 months in active storage and for the duration of the applicable data retention period in archival storage. Automated anomaly detection rules alert the security team to patterns that may indicate unauthorized access, including unusual access times, access from unexpected geographic locations, and bulk data access queries.

4.1 Secure Software Development Lifecycle (SSDLC).

RestfulSync integrates security practices throughout the software development lifecycle. Security is not a final-stage gate but is embedded in every phase of development:

4.2 Vulnerability Management.

4.3 Mobile Application Security.

The RestfulSync mobile application (iOS and Android) is developed and maintained in accordance with the OWASP Mobile Application Security Verification Standard (MASVS). Specific mobile security controls include: certificate pinning to prevent man-in-the-middle attacks against TLS connections; secure local storage practices (no sensitive data stored in unprotected device storage or clipboard); protection against reverse engineering through code obfuscation and tamper detection; runtime integrity checks that detect jailbroken or rooted device environments; and secure deep link handling to prevent exploitation of app deep links.

RestfulSync's device-local architecture for Safe Walk and Safe Trip timers — in which all timer logic executes on the device without server-side state — was designed in part for FTO compliance but also provides a security benefit: compromising the server does not enable an attacker to spoof or suppress safety timer events. The attack surface for the most safety-critical features is limited to the user's own device.

4.4 API Security.

4.5 HEVC Transcoding Security.

When a user uploads media in a non-HEVC format that triggers server-side transcoding (as described in the Terms of Use, Article XI), the transcoding process runs in an isolated sandboxed environment. Input media is validated for format compliance before processing begins. The sandbox is designed to prevent maliciously crafted media files from exploiting vulnerabilities in the transcoding library. Transcoding sandbox instances are ephemeral — they are created for a single job and destroyed immediately upon completion. Transcoded output is integrity-checked before admission to the Evidence Vault.

4.6 SOS Workflow Security Considerations.

The SOS and Panic workflow is the most safety-critical user-facing feature on the platform. RestfulSync applies the following specific security protections to the SOS pathway: the SOS activation endpoint is protected against replay attacks through request signing and timestamp validation; SOS activation is idempotent within a short window to prevent duplicate alerts from network retries; the 60-second exception window logic is implemented server-side and cannot be manipulated by client-side tampering; SMS alert dispatch uses authenticated, signed API calls to the SMS delivery provider; and the third-party emergency support workflow integration uses mutual authentication to verify that SOS events originate from legitimate RestfulSync platform activity.

5.1 Vault Architecture Overview.

The Evidence Vault is the highest-security data environment within the RestfulSync platform. It stores the most sensitive user data — video evidence, audio recordings, document scans, witness information, and associated metadata — and is subject to the most restrictive access, encryption, and integrity controls on the platform. The Vault is logically and where feasible physically isolated from other platform components. Access to Vault contents requires separate, additional authorization beyond standard platform authentication.

5.2 Isolation and Network Segmentation.

The Evidence Vault storage infrastructure is deployed in a network segment that is isolated from the public internet and from other platform components by enforced network access control lists (ACLs). No direct inbound internet traffic is permitted to Vault storage nodes. All Vault access is proxied through an authenticated API gateway that enforces RBAC, rate limiting, and full request logging. Internal platform services that require Vault access must authenticate via service account tokens with the minimum required permissions. Vault storage nodes do not communicate outbound to any service other than the designated backup and replication infrastructure.

5.3 Upload Integrity Verification.

5.4 Access Logging and Audit Trail.

All access to Evidence Vault contents — reads, writes, and metadata queries — is logged to an append-only, tamper-evident audit log. Each log entry records: the timestamp of the access; the account identifier of the accessor; the specific resource (vault entry, chunk, or metadata record) accessed; the access type (read, write, delete attempt, export); the accessor's role at the time of access; the originating IP address and device identifier; and the outcome (success or denial). Vault access logs are reviewed weekly by the security team and are retained for the full duration of the applicable evidence retention period plus three years.

5.5 Export and Sharing Controls.

Evidence Vault contents may be exported or shared only through explicit, logged user actions. Users may download their own vault contents through the authenticated user interface. No bulk export of vault contents by any party other than the owning user is permitted without a valid court order or equivalent legal process. Any evidence export requested through legal process is: reviewed by RestfulSync's legal team before execution; logged with the legal basis for disclosure; limited to the minimum scope specified in the legal process; and, where legally permissible, reported to the affected user with advance notice.

5.6 Backup and Disaster Recovery.

Evidence Vault data is replicated to geographically separate backup infrastructure to protect against regional data loss events. Backup replication is conducted using encrypted channels and backup copies are stored with the same AES-256 encryption as primary storage. Backup integrity is verified through automated restoration tests conducted on a quarterly basis. Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets are defined in RestfulSync's Business Continuity Plan. restricted-access long-term storage immutability is preserved in backup infrastructure — backup copies of long-term retention-committed evidence cannot be altered or deleted during the retention period.

6.1 Network Architecture.

RestfulSync's infrastructure is deployed across cloud environments with network segmentation enforced through virtual private clouds (VPCs), security groups, and network ACLs. The architecture follows a defense-in-depth model with distinct zones: a Public DMZ zone that handles all internet-facing traffic (load balancers, CDN, API gateways); an Application zone that hosts application servers with no direct internet exposure; a Data zone that houses databases and the Evidence Vault with the strictest access controls; and a Management zone for administrative access with the most restrictive network policy. Traffic between zones is permitted only on explicitly defined ports and protocols through enforced firewall rules.

6.2 DDoS Mitigation.

RestfulSync deploys multi-layer distributed denial-of-service (DDoS) protection to ensure platform availability. At the network layer, volumetric attack mitigation is handled through CDN-level absorb-and-filter capabilities that can absorb large traffic floods before they reach application infrastructure. At the application layer, rate limiting, request throttling, and behavioral analysis rules detect and block application-layer DDoS attacks (HTTP floods, slow POST attacks, API abuse). The SOS and Panic endpoint receives special DDoS protection treatment — it is designed to remain available even under attack conditions by virtue of rate-limited, authenticated request processing and fallback capacity.

6.3 Intrusion Detection and Prevention.

RestfulSync deploys both network-based and host-based intrusion detection and prevention systems (IDS/IPS) across all infrastructure tiers. These systems: monitor network traffic for known attack signatures and anomalous behavioral patterns; alert the security team in real time to potential intrusion attempts; automatically block identified attack traffic at the network layer where confidence is high; and generate detailed logs of all detected events for forensic analysis. IDS/IPS signatures are updated on a continuous basis and are tuned to minimize false positives while maintaining high detection fidelity.

6.4 Security Information and Event Management (SIEM).

All security-relevant events from across the RestfulSync infrastructure — including authentication events, access control decisions, network anomalies, application errors, and IDS/IPS alerts — are aggregated into a centralized SIEM platform. The SIEM enables: real-time correlation of events across multiple systems to detect multi-stage attacks; automated alerting on high-priority security events with defined SLAs for security team response; historical analysis and forensic investigation of past events; and compliance reporting against security monitoring requirements.

6.5 Cloud Security Configuration Management.

All cloud infrastructure configurations are managed as code and subject to automated compliance checking against a defined security baseline (hardened configuration standard). Configuration drift — any change to infrastructure configuration that deviates from the approved baseline — is detected automatically and triggers an alert for review. Infrastructure changes are deployed through a controlled change management process that requires approval, testing, and documentation before production deployment. Public access to cloud storage buckets, databases, and internal services is prohibited by default and requires explicit exception approval with documented justification.

6.6 Third-Party Connectivity and Integration Security.

All integration points between RestfulSync and third-party services — including the emergency support service, telematics SDK, Stripe, DigitalOcean, and SMS delivery providers — are secured through: mutual authentication (where supported by the provider) or API key authentication with secret rotation schedules; encrypted channels (TLS 1.2+ minimum); IP allowlisting where supported; minimum-scope permissions (API keys are scoped to only the operations required); and monitoring of integration-specific traffic for anomalous volume or error patterns.

7.1 Incident Response Program Overview.

RestfulSync maintains a documented Incident Response Plan (IRP) that defines procedures for detecting, containing, investigating, remediating, and recovering from security incidents. The IRP is reviewed and tested at least annually through tabletop exercises and, where feasible, simulated incident scenarios. The IRP is maintained by the RestfulSync security team and is available to authorized personnel. All personnel with system access receive training on their responsibilities under the IRP.

7.2 Incident Severity Classification and Response SLAs.

Security incidents are classified into four severity levels based on the nature, scope, and potential impact of the event. The following table defines severity levels, criteria, initial response SLAs, and escalation paths:

Severity Definition Initial Response SLA Escalation Path

P0 — Critical Active breach, evidence tampering, or data exfiltration in progress ≤ 1 hour CISO → CEO → Legal → Regulatory notification

P1 — High Confirmed vulnerability with active exploitation potential; significant data exposure ≤ 4 hours Security Lead → Engineering VP → CISO

P2 — Medium Vulnerability without confirmed exploitation; limited-scope data anomaly ≤ 24 hours Security Engineer → Security Lead

P3 — Low Non-critical finding, configuration issue, or informational report ≤ 72 hours Security Engineer; tracked in backlog

7.3 Incident Response Phases.

The RestfulSync incident response process follows the NIST SP 800-61 lifecycle:

Phase 1 — Preparation: Maintaining the IRP, training personnel, deploying detection tooling, and establishing communication channels and escalation contacts before incidents occur.

Phase 2 — Detection and Analysis: Identifying potential incidents through automated monitoring, user reports, security researcher submissions, or third-party notification. Triaging events to determine if they constitute a genuine security incident and classifying severity.

Phase 3 — Containment: Isolating affected systems, revoking compromised credentials, blocking malicious traffic, and taking other immediate steps to limit the spread or impact of the incident. Short-term containment (stop the bleeding) is prioritized before longer-term remediation to preserve evidence and limit damage.

Phase 4 — Eradication: Identifying and eliminating the root cause of the incident, including removing malware, patching vulnerabilities, correcting misconfigurations, and removing unauthorized access.

Phase 5 — Recovery: Restoring affected systems and services to normal operation, verifying that systems are clean and functioning correctly, and monitoring for signs of recurrence.

Phase 6 — Post-Incident Review: Conducting a documented post-incident review (blameless postmortem) to identify root causes, assess the effectiveness of the response, and develop and track remediation actions to prevent recurrence.

7.4 Evidence Preservation During Incidents.

During any security incident investigation, RestfulSync follows digital forensics best practices to preserve evidence of the incident: affected systems are imaged or logged before remediation steps that would destroy evidence; chain of custody documentation is maintained for any forensic artifacts collected; long-term retention-stored user evidence is not accessible to incident responders except through the normal authenticated access path, which is itself fully logged — incident response does not provide a bypass to Evidence Vault access controls; and evidence preservation obligations under any active legal holds are maintained throughout the incident response process.

7.5 User and Regulatory Notification.

In the event of a security incident that affects user personal information or Evidence Vault contents, RestfulSync will notify affected users and applicable regulatory authorities as required by applicable law. All 50 U.S. states have data breach notification laws. Notification procedures are designed to meet the most stringent applicable requirements. Notifications will include: a description of what happened and when RestfulSync became aware; what categories of information were affected; the measures RestfulSync is taking in response; recommended steps for affected users; and contact information for follow-up questions.

RestfulSync will not delay notification to users in order to avoid reputational impact. Where law enforcement requests a brief delay to avoid compromising an investigation, RestfulSync will comply with such requests only to the minimum extent required by law and will notify users as soon as that constraint is lifted.

7.6 Responsible Disclosure and Bug Bounty.

RestfulSync operates a responsible disclosure program for security researchers. If you discover a potential security vulnerability in any RestfulSync platform component, we encourage you to report it to security@restfulsync.com. Reports should include: a description of the vulnerability and its potential impact; the steps required to reproduce the issue; any proof-of-concept code or screenshots (please do not exfiltrate user data as part of your research); and your contact information for follow-up.

What Responsible Disclosure Is NOT

8.1 Background Checks.

All RestfulSync employees and contractors who have access to user data, production systems, or the Evidence Vault are subject to pre-employment or pre-engagement background screening consistent with applicable law. Background screening may include criminal history checks, identity verification, and professional reference checks. The scope and depth of screening is commensurate with the level of data access associated with the role.

8.2 Security Training.

All RestfulSync personnel receive mandatory security and privacy training at onboarding and on at least an annual basis thereafter. Training covers: the RestfulSync Security Policy and Privacy Policy; data classification and handling requirements; phishing and social engineering awareness; secure coding practices (for engineering personnel); incident reporting procedures; and acceptable use of RestfulSync systems and data. Personnel in roles with elevated system access (engineering, security, legal) receive role-specific additional training appropriate to their responsibilities.

8.3 Confidentiality Obligations.

All employees, contractors, and authorized third parties with access to RestfulSync user data or platform systems are required to execute confidentiality agreements before receiving any data access. Confidentiality obligations extend beyond the period of employment or engagement and cover: all user personal information; Evidence Vault contents; proprietary platform architecture; security vulnerability information; and any other non-public information related to RestfulSync's operations.

8.4 Access Revocation.

Upon termination of employment or end of a contractor engagement for any reason, access to all RestfulSync systems, data, and infrastructure is revoked within the timeframes defined in the access management policy. For voluntary terminations with advance notice, access revocation planning begins before the final day. For involuntary or unexpected terminations, access is revoked within 24 hours of separation notification, or immediately where security considerations warrant (e.g., termination for cause involving a security incident).

8.5 Insider Threat Management.

RestfulSync recognizes that insider threats — whether malicious, negligent, or inadvertent — represent a real risk to user data security. Controls designed to mitigate insider threat risk include: principle of least privilege limiting the scope of any single actor's access; segregation of duties requiring multiple approvals for sensitive operations; mandatory vacation policies for roles with high data access that enable anomaly detection during periods of absence; monitoring of privileged access sessions; and a clear, non-retaliatory channel for employees to report suspected policy violations by colleagues.

9.1 Vendor Security Assessment Program.

RestfulSync maintains a formal vendor security assessment program that evaluates the security practices of all third-party vendors and service providers before engagement and on an ongoing basis. The program uses a tiered risk classification to calibrate the depth of assessment to the level of risk associated with each vendor relationship.

Vendor Tier Criteria Security Requirements Review Frequency

Tier 1 — Critical Direct access to Evidence Vault, PII, or payment data SOC 2 Type II or ISO 27001 required; annual security review; DPA required Annual + on contract renewal

Tier 2 — Significant Indirect data access; core platform functionality Security questionnaire; privacy review; DPA required Biennial

Tier 3 — Standard No personal data access; commodity services Basic vendor review; standard contractual protections On onboarding; renewed every 3 years

9.2 Data Processing Agreements.

All Tier 1 and Tier 2 vendors that process personal data on behalf of RestfulSync are required to execute a Data Processing Agreement (DPA) before data access is granted. DPAs contractually require vendors to: process personal data only as instructed by RestfulSync; maintain security standards at least equivalent to those described in this Security Policy; notify RestfulSync of any security incident affecting RestfulSync data within 72 hours of discovery; support RestfulSync in fulfilling data subject rights requests; not share RestfulSync data with additional subprocessors without RestfulSync's prior approval; and cooperate with RestfulSync security audits or assessments.

9.3 Current Critical Vendors and Security Commitments.

The following Tier 1 vendors are currently engaged by RestfulSync, along with their primary security commitments:

9.4 Open-Source Software Security.

RestfulSync's platform incorporates open-source software libraries and components. All open-source dependencies are: tracked in a software bill of materials (SBOM) that is maintained as part of the codebase; scanned daily for known vulnerabilities using automated CVE matching tools; updated promptly when security patches are released (Critical/High CVEs within the timeframes defined in Section 4.2); and reviewed for license compliance to ensure no conflicts with RestfulSync's proprietary codebase. RestfulSync's responsible disclosure policy extends to vulnerabilities discovered in open-source components that RestfulSync uses — we report such findings to the relevant maintainer communities.

9.5 Supply Chain Attack Mitigations.

Software supply chain attacks — in which an attacker compromises a dependency or build pipeline to inject malicious code — represent an evolving threat. RestfulSync's supply chain security mitigations include: dependency pinning (locking third-party libraries to specific verified versions rather than floating references); integrity verification of dependency downloads (verifying checksums before installation); use of private dependency mirrors to prevent dependency confusion attacks; code signing for internal artifacts; and periodic review of third-party library maintainer access and security practices.

10.1 Applicable Legal and Regulatory Framework.

RestfulSync's security program is designed to support compliance with the following legal and regulatory requirements, among others:

All applicable U.S. state data breach notification laws (all 50 states and Washington, D.C.)

California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) security provisions

Children's Online Privacy Protection Act (COPPA) — security requirements for data collected from and about children

Electronic Communications Privacy Act (ECPA) and applicable state wiretapping statutes — governing audio recording and electronic communications

Federal Trade Commission (FTC) Act Section 5 — unfair or deceptive practices standards applicable to data security representations

NIST Cybersecurity Framework (CSF) — voluntary framework used as a design reference for RestfulSync's security program

Payment Card Industry Data Security Standard (PCI-DSS) — through RestfulSync's use of PCI-DSS Level 1 certified payment processors

State recording consent laws across all 50 jurisdictions — enforced through the Compliance Decision Engine described in the Terms of Use

10.2 Security Audits and Assessments.

RestfulSync does not currently publish external audit certifications (such as a SOC 2 Type II report or ISO 27001 certificate) but maintains internal compliance evidence consistent with those frameworks and is evaluating formal certification as the platform scales. Users who require formal third-party assurance for enterprise or legal purposes should contact legal@restfulsync.com to discuss available options.

10.3 Regulatory Cooperation.

RestfulSync cooperates with regulatory authorities and law enforcement agencies in accordance with applicable law. All government requests for user data or Evidence Vault contents are reviewed by RestfulSync's legal team before any response is provided. RestfulSync will: challenge overbroad or legally deficient requests through appropriate legal channels; notify affected users of government data requests to the extent legally permissible; comply with valid legal process while limiting disclosure to the minimum scope specified; and maintain a record of all government data requests received and RestfulSync's response.

10.4 Relationship Between This Policy and the Privacy Policy.

This Security Policy addresses the technical and organizational controls that protect personal information and platform security. The RestfulSync Privacy Policy addresses the collection, use, retention, and sharing of personal information and users' privacy rights. Both documents operate together as part of RestfulSync's overall data governance framework. In the event of any inconsistency between this Security Policy and the Privacy Policy regarding the treatment of personal information, the Privacy Policy governs with respect to the rights and obligations of users; this Security Policy governs with respect to the technical implementation standards.

11.1 Account Security Obligations.

While RestfulSync implements extensive platform-side security controls, users share responsibility for the security of their accounts and the data they store. By using RestfulSync, you agree to the following account security obligations:

11.2 Reporting Security Concerns.

If you discover or suspect a security vulnerability, unauthorized access to your account, or any other security concern related to the RestfulSync platform, please report it promptly to security@restfulsync.com. For account compromises, also contact support@restfulsync.com for immediate account security assistance. RestfulSync's security team reviews all reports and will follow up with you within the SLA timeframes defined in Section 7.2.

11.3 Prohibited Activities That Compromise Platform Security.

In addition to the prohibited conduct described in the Terms of Use, the following activities specifically threaten platform security and are prohibited:

Attempting to probe, scan, or test the vulnerability of any RestfulSync system without prior written authorization from RestfulSync's security team;

Attempting to breach or circumvent any authentication, authorization, or encryption mechanism;

Uploading or transmitting malware, viruses, or other malicious code through any RestfulSync interface;

Attempting to access another user's account, Evidence Vault, or any other data not associated with your own account;

Attempting to disrupt or degrade RestfulSync's services through denial-of-service attacks or any other means;

Exploiting any vulnerability in RestfulSync's platform for any purpose other than good-faith responsible disclosure as described in Section 7.6;

Attempting to intercept, monitor, or capture traffic between other users and RestfulSync's platform.

Violations of these prohibitions may result in immediate account termination, civil liability, and referral to law enforcement.

12.1 Cloud-Based Infrastructure.

RestfulSync's production infrastructure is hosted entirely in cloud environments operated by established cloud service providers with SOC 2 Type II and ISO 27001 certifications covering physical data center security. RestfulSync does not operate its own physical data centers. Physical access to the servers and storage systems that process and store RestfulSync user data is controlled by the cloud provider's physical security program, which includes: biometric and badge-based access controls limiting data center entry to authorized personnel only; 24/7/365 security monitoring and video surveillance of all data center facilities; environmental controls protecting against fire, flood, power failure, and other physical threats; and regular physical security audits by accredited third parties.

12.2 Employee Workstation Security.

All RestfulSync employee and contractor workstations used to access production systems or user data are subject to endpoint security requirements, including: full disk encryption; endpoint detection and response (EDR) software; enforced screen lock policies; approved VPN requirement for all production system access; and remote wipe capability in the event of device loss or theft. Lost or stolen devices must be reported to the security team immediately for remote wipe execution.

13.1 Security Disclaimers.

DESPITE RESTFULSYNC'S EXTENSIVE SECURITY CONTROLS, NO SECURITY SYSTEM IS IMPENETRABLE. RESTFULSYNC CANNOT GUARANTEE THAT UNAUTHORIZED THIRD PARTIES WILL NEVER BE ABLE TO DEFEAT OUR SECURITY MEASURES OR ACCESS USER DATA IN AN UNAUTHORIZED MANNER. BY USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU PROVIDE PERSONAL INFORMATION AND EVIDENCE AT YOUR OWN RISK.

13.2 Limitation of Liability for Security Incidents.

RestfulSync's liability for security incidents is governed by the limitation of liability provisions in the Terms of Use (Article XVII). In no event will RestfulSync's aggregate liability for any security incident or data breach exceed the amounts paid by you to RestfulSync in the twelve months preceding the event, subject to applicable law. RestfulSync is not liable for security compromises caused by your failure to maintain account security, use of compromised devices, or disclosure of credentials to third parties.

13.3 Force Majeure.

RestfulSync shall not be liable for security failures caused by conditions beyond its reasonable control, including nation-state cyberattacks, zero-day vulnerabilities for which no patch exists, failures of third-party security infrastructure, or other force majeure events as defined in the Terms of Use (Article XX, Section 20.6).

14.1 Security Contact Information.

All security-related communications, vulnerability reports, incident notifications, and security inquiries should be directed to:

14.2 Enforcement.

This Security Policy is enforceable as part of the RestfulSync Terms of Use. Violations of user security obligations described in this Policy — including prohibited activities (Section 11.3), unauthorized access attempts, and deliberate circumvention of security controls — constitute a material breach of the Terms of Use and may result in immediate account termination, civil liability, and, where warranted, referral to law enforcement. RestfulSync cooperates fully with law enforcement investigations of security incidents and cyberattacks affecting the platform or its users.

14.3 Updates to This Policy.

This Security Policy is reviewed at minimum annually. Material updates are communicated to users via the channels described in the Privacy Policy with at least 14 days' advance notice before the effective date of changes. The current version of this Policy is always available at restfulsync.com/security-policy.

RestfulSync is formerly known as SafeZone. RestfulSync and LawYeti are products of LawYeti, Inc. and its affiliates.