UiPath Information Security Exhibit Instructions

UiPath Information Security Exhibit Instructions

Information Security Exhibit

Data security sits at the foundation of product development at UiPath (hereinafter, “UiPath” This Information Security Exhibit (the “Exhibit”) points out the organizational policies and controls in effect at UiPath that are aimed towards maintaining confidentiality, integrity, and availability of Customer Data used with UiPath products or services (hereinafter, the “Software”). Unless defined herein, terms used with capital letters will have the meaning given to them in the applicable Agreement.

Defined Terms.

Terms defined in this Exhibit shall have the meaning assigned to them below:
a. “Agreement” means the agreement validly executed between UiPath and the Customer with respect to access to, and use of, paid Software and/or Services, and incorporates this Exhibit, and the collection of documents and policies made available and amended by UiPath from time to time on the Trust Portal at uipath.com/legal/trustand-security (or successor website).
b. “Cloud Software” means Software provided as a service to the Customer.
c. “Customer” means the entity using paid Software and/or Services under an Agreement.
d. “Customer Data” means any data, information, and proprietary Customer content created prior to or independently from any Customer interaction with the Software and imported into the Software, or accessed by UiPath in connection with, or for the purpose of, provision of any Services. Customer Data may contain Personal Data.
e. “Documentation” means the official guides for Software, as made available on the Trust Portal.
f. “On-Premises Software” means Software deployed on Customer premises.
g. “Personal Data” means (i) information related to an identified or identifiable natural person as defined by, as applicable, Regulation (EU) 2016/679 (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy laws (“PII”), (ii) protected health information, as regulated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (“PHI”), and (iii) cardholder data (“CHD”) and/or sensitive authentication data (“SAD”), as defined by the Payment Card Industry Data Security Standard (“PCI DSS”).
h. “Services” means professional services specified in an Order, excluding Support.
i. “Software” means software products developed by or for UiPath and/or its Affiliates and licensed to Customer as specified in accepted orders, which may be provided, as available as “Cloud Software” or “On-Premise Software”, and excludes Third-Party Services.
j. “Support” means maintenance and service, applicable to the Software during the License Term as provided in the support terms available on the Trust Portal.
k. “Third-Party Services” means the cloud applications, cloud service endpoints, data services, software, application programing interfaces, and content of third parties which may be accessed using the Software or Services.
l. “UiPath Internal Policies” means the collection of policies maintained available by UiPath with respect to confidentiality, information security, and intellectual property protection.

Scope

This Exhibit highlights the security measures maintained by UiPath with respect to its internal infrastructure and its Software, that could have an impact on the confidentiality, integrity, and availability of Customer Data. This Exhibit does not cover any standards maintained by providers of Third- Party Services, and, unless otherwise expressly set out in this Exhibit, UiPath does not make any commitment in respect of Third-Party Services.
Information on the standard security requirements imposed to vendors that have access to Customer Data can be found at https://www.uipath.com/assets/downloads/cybersecurityrequirements:

Security Certifications and Attestations

UiPath recognizes the importance of implementing appropriate technical and organizational security measures and adequate security controls to prevent any unauthorized access, disclosure, alteration, or destruction of Customer Data. UiPath maintains a comprehensive information security management system and engages independent auditors to provide industry standard certifications and attestations. Further information is available on the Trust Portal, or upon Customer request. A list of certifications and attestations is available below, and further information on the Software in scope is available on the Trust Portal, or upon Customer request:
a. ISO/IEC 27001 certification
b. SOC 2 Type 2 and SOC 2 Type 1 attestations
c. Cyber Essentials Plus certification
d. Veracode Verified Continuous attestation
UiPath is constantly working to improve its quality and security standards and is working on an internal roadmap of certifications and standards relevant and adequate for the industry in which UiPath operates. UiPath shall not modify the level of security measures provided in this Exhibit during the term of the Agreement, to decrease the capabilities, functionality, or operation of the Software.
UiPath shall also comply with the controls in, and maintain, an ISO/IEC 27001 certification, providing that certification and a copy of the corresponding statement of applicability (SOA) to Customer upon written request.

Product Security

Product Development Practices
UiPath follows a secure software development lifecycle (SDLC) for developing products. The secure SDLC process is enforced for every release and includes code reviews, threat modeling during service design and security assessments such as static and dynamic code analysis, open-source software assessments, manual penetration testing, and bug bounty programs.
UiPath shall document change control procedures to manage changes to information systems, supporting infrastructure and facilities. Prior to implementing any changes, UiPath shall (1) establish acceptance criteria for production change approval and implementation; and (2) require stakeholder approval prior to change implementation as applicable.
UiPath shall test system and application changes, including relevant security controls as applicable. System and application changes must meet defined acceptance criteria prior to implementation.
Additionally, UiPath shall restrict and track personnel access to program source code and require developers to periodically attend secure system development training.
Cryptographic Controls
An important part of UiPath security strategy is encryption, aimed to prevent information from being accessed unlawfully. Customer Data is encrypted at rest in any data store that is part of the Software. Customer Data is transmitted over protected channels, whether it travels over the Internet or within UiPath’s internal service components. Customer has the flexibility to configure the encryption of certain installed Software, as detailed in the relevant Documentation.
Only industry-standard algorithms for encryption and key strength that are approved by UiPath engineering and IT departments are used to encrypt UiPath data and assets used in production or business use-cases. UiPath uses encryption to protect UiPath and Customer or third-party non-public data in transit across public networks.
Additionally, encryption is used to protect UiPath and Customer or other third-party data at rest over which UiPath has custodianship. UiPath uses known Certificate Authorities for the issuance of public key certificates. Keys have defined activation and deactivation dates so they can only be used for a limited period, and they are protected from modification, loss, destruction, and unauthorized disclosure during their lifecycle (use, storage, and handling).

Network Security and Operations
All the web services offered as part of Software are TLS-enabled (for TLS 1.2+).
Intrusion prevention and detection systems and firewalls are in place to protect UiPath’s network infrastructure supporting the Software. Separation of test, development and production environments is ensured. Regular backups of essential business information are maintained through cloud providers for Cloud Software. An appropriate backup cycle is used and documented. Event logs recording user activities, exceptions, faults, and information security events are produced, kept, and regularly reviewed.
Information about technical vulnerabilities of information systems being used is assessed in a timely fashion, and appropriate measures are taken to address the associated risk in line with and the organization’s exposure to such vulnerabilities.
Software Access Controls
UiPath has built access control features into its Software which the Customer can utilize to provision, de-provision and authorize its own users. Details can be found in the relevant Documentation.
Access to Customer Data
UiPath does not have access to Customer Data used by the Customer with On- Premises Software, unless access is expressly granted by the Customer.
UiPath personnel may have access to Customer Data used by the Customer with Cloud Software solely for the purpose of fulfilling UiPath’s rights and obligations under the Agreement. UiPath leverages privileged identity management (“PIM”) to minimize granting access of UiPath personnel to Customer Data in Cloud Software. UiPath personnel who need to edit system resources, access, or modify Customer Data must use PIM to temporarily raise their access level. PIM requests must be enjoined by an adequate reason for access and are subject to approval by UiPath authorized reviewers. The activity conducted while using PIM is logged and recorded.
Unless otherwise agreed, UiPath shall restrict third party access to Customer Data.
Tenant Data Segregation
Data at rest from each tenant of the Cloud Software is logically segregated. UiPath provides the necessary mechanisms to enable tenants to enforce access and authorization controls for users, as they access data inside the Software.
Customer Data Hosting
As part of the Software, UiPath may use third-party service providers which may have access to Customer Data, as sub-processors of UiPath. UiPath maintains the list of sub-processors on the Trust Portal.
Customer Data and Personal Data uploaded by the Customer in the Software will be hosted in the region(s) evidenced in the Sub-processor list. Where technically implemented in a particular Software component, the Customer may configure the hosting location of the Customer Data used therein, provided however that back-ups may have different configurations.
Customer Data Back-ups
Regular back-ups of Customer Data in Cloud Software are performed automatically by UiPath’s underlying infrastructure as a service/platform as a service (IaaS/PaaS) provider. Each backup is stored in multiple locations to ensure resiliency.
Customer may notify UiPath in writing with sufficient time in advance to obtain the available backup records stored by UiPath to review any record of system activity related to Customer Data

Customer Data Retention
As a rule, Customer Data is kept for the duration of the Agreement. Following termination of the Agreement and upon express written instructions from the Customer, UiPath will ensure that the Customer Data will be, as requested by the Customer in the timeframe specified by the applicable law, deleted, or returned to the Customer either manually or, if technically available, via direct export from the relevant Cloud Software.
Logs Information
Logging capabilities are built into the Software, which the Customer can enable to capture informational events, error, and warning messages relevant to the application as well as audit trails for actions performed. Details can be found in the Documentation.
UiPath enables operational logs and security logs of activity in Cloud Software. Operational logs are used for monitoring uptime and availability of infrastructure and Cloud Software. Security logs are used for identifying security incidents, policy violations, fraudulent activity, auditing, and forensic analysis, supporting investigations, establishing baselines, and identifying trends and potential long-term problems.
UiPath shall generate administrator and event logs for systems and applications that store, allow access to, or process Customer Data. The administrator and event logs shall be archived for a minimum of 180 calendar days;
Personal Data Protection
UiPath takes Personal Data protection very seriously and encourages Customers to minimize the use of Personal Data with Cloud Software, in line with the principles of the applicable legislation. Further rights and obligations between UiPath and Customer with respect to protection of Personal Data as part of Customer Data will be governed by appropriate data protection agreements executed between the Parties in accordance with GDPR and any applicable legislation.
Though UiPath is committed to making its operating environment as compliant as possible, some Software components might not meet all standards required by industry standards such as PCI DSS, or HIPAA. UiPath expressly prohibits Customers from using cardholder data (CHD), sensitive authentication data (SAD), personal health information (PHI), or any other specifically regulated information with Cloud Software, except where UiPath has expressly instructed otherwise in the Documentation, or by updates to this Exhibit or the Trust Portal. Nonetheless, the Customer is ultimately responsible in deciding whether the Software can be used in accordance with the laws, rules, and regulations applicable to Customer’s operations.
UiPath, in its capacity as data controller, makes available a process for data subject access requests, as required by the GDPR, available on the Trust Portal. UiPath will notify the Customer without undue delay of any data subject requests which UiPath in its capacity as data processor may receive but to which the Customer in its capacity as data controller must respond.
As a controller, UiPath processes Personal Data in accordance with its Privacy Policy available on the Trust Portal.
Malware
UiPath performs regular testing of first party and third-party code included in Software.
UiPath deploys, maintains, and updates anti-malware protection within its operating environment and on corporate computing resources.

Vulnerabilities Management
Vulnerabilities identified in the Software are mapped to industry standard Common Vulnerability Scoring System (CVSS) methodology (i.e., critical, high, medium, and low). Identified vulnerabilities shall be remediated in a timely manner within internally defined timeframes.
Regular testing is also performed directly against Software and UiPath has a bug bounty program that aims to leverage the expertise of the ethical hacker community to find vulnerabilities in Software and surrounding ecosystem to keep Customers’ use of the Software safe from malicious activities.
UiPath shall perform annual penetration testing for Cloud Software systems and applications that process Customer Data, including after significant system and application changes. UiPath shall implement a patch and vulnerability management process to identify, report, and remediate application and system vulnerabilities that is approved by the application or system owner and is commensurate with the level of risk by (a) performing code and Cloud Software vulnerability scans on a regular basis and during any major system or application updates; (b) implementing vendor patches or fixes; and (c) developing a risk treatment plan to address identified vulnerabilities.

Internal Security Practices

Access Controls
UiPath employees are granted logical access to business resources that they have been specifically authorized to use in accordance with defined access control policies and processes. The access rights are granted as appropriate for employees to conduct their duties and adjusted upon a change in role and are removed upon termination of employment.
Application owners shall review user access rights for appropriateness on a quarterly basis and shall immediately revoke inappropriate or unauthorized access upon detection.
UiPath employs a strong password policy, along with single sign-on on all enterprise applications and systems. For Customer end user authentication, UiPath shall support authentication as described in applicable public user documentation: https://docs.uipath.com/automation-suite/docs/about-accounts and https://docs.uipath.com/automation-cloud/docs/about-accounts. Users are required by policy to maintain the confidentiality of their passwords and change them periodically.
Users’ logical access to business applications is controlled and logged. UiPath has logging enabled for log-on activities on systems and generates alerts for unusual log-on behavior.
Owners of critical business systems and applications grant, review, and remove users’ logical access to business systems, based on the principles of least privilege and segregation of duties.
With respect to privileged user accounts, UiPath shall (a) restrict access to personnel with clear business needs; (b) provision accounts solely for the duration needed to complete the necessary task, (c) capture and periodically review system logs, and (d) enable access using multi-factor authentication.
Risk Management
UiPath has a risk management process in place designed to reduce the risks to an acceptable level. Risk assessments are conducted at least annually and identified risks are mitigated according to severity and business priorities.
Physical Security
Physical security measures are designed to prevent unauthorized physical access or damage caused by physical and environmental threats to UiPath’s employees, premises, system and network devices and information, or interruptions to the organization’s activities. The level of security measures, policies and procedures implemented commensurate with the legal, regulatory, or contractual requirements associated with each facility. Access to premises is monitored through access controls, such as individual badges and video surveillance, as permitted by the applicable law. Asset movement controls are in place and the buildings are protected for seismic, flood and similar risks.
UiPath has a “no-paper” policy and, unless as required by applicable law, aims to use electronic records and documents. UiPath has a clear desk and clear screen policy

Asset Management
UiPath’s information assets are protected throughout the information lifecycle, including entry into UiPath’s systems, secure data transmission, and appropriate data access, storage, retention, and disposal. UiPath information assets are appropriately classified in terms of value, legal and contractual requirements to enable employees to handle them appropriately.
UiPath requires its employees and contractors to comply with a set of security measures when handling UiPath devices and information. Each UiPath asset holding confidential information has an identified asset owner and is kept in an inventory that covers the entire lifecycle from purchase to disposal. Employees are required to return all equipment upon termination of employment.
UiPath shall implement and document system hardening procedures and baseline configurations and shall not include unsupported software or hardware.
Disposal and Destruction of Data and IT Equipment
UiPath has controls in place to mitigate the risk of improper and unsecure disposal and destruction of data, technology equipment and components owned by UiPath, including over-writing, or physically destroying removable media, erasing, or destroying mobile devices and securely erasing storage space allocated by cloud services, according to the cloud provider’s methodology.
UiPath maintains policies in place restricting the storage of Customer Data locally, on the employees’ devices or on removable media.
Mobile Devices and Teleworking
UiPath maintains adequate policies on teleworking and the access of Customer Data from remote devices. Corporate devices with access to Customer Data are adequately protected. Users are allowed to use their personal devices to access UiPath business resources under a limited policy restricting and controlling users’ responsibilities and access to Customer Data.
UiPath applies security measures on employee devices, including by:
a. requiring a multi-factor authentication access control mechanism to give full access to Customer Data.
b. applying security patches to applications and system software bearing Customer Data in line with vendor recommendations.
c. authorizing business applications before having access to Customer Data.
Human Resources Security
UiPath may perform background checks prior to employment, solely as permitted under applicable law.
UiPath ensures that employees agree to terms and conditions concerning confidentiality and information security appropriate to the nature and extent of access they will have to the organization’s assets and that go beyond the duration of the employment period.
Responsibilities regarding information security are communicated to  UiPath employees and they are informed that disciplinary actions can be taken against them based on violations of policies and procedures.

Vendor Risk Management
UiPath maintains a vendor risk management program through which it assesses and manages the risks assumed by the nature of relationships with vendors and contractors that receive, store, process, or host UiPath data or have access to UiPath network and systems.
UiPath checks the security measures of its critical vendors and has a policy to enter into data protection agreements seeking to ensure that at least the same level of confidentiality and data security is implemented by its subcontractors as the ones applicable to UiPath.
UiPath strives to maintain the right to perform audits to monitor the compliance of its sub-contractors with the agreed technical and organizational measures regarding data confidentiality and security.

Incident Management and Business Continuity

UiPath is committed to comply with contractual and legal obligations for the protection of Customer Data. UiPath has designed processes to provide response to security and operational incidents, with undue delay, to minimize risks and ensure availability of information systems.
To respond to incidents effectively and in a timely manner, UiPath incident management teams are taking necessary actions to contain the threat, eradicate the source of the incident, and restore the affected systems, information, and data.
Incident responders track the incident root causes, the lessons learned in the incident management system and propose continuous improvements to system and data owners.
UiPath utilizes a decentralized office approach and employees, and contractors are not dependent on specific office locations to perform their duties. Data processing environments maintain redundancy to meet availability requirements. Systems are built with failovers within availability zones. Data availability and continuity of service is ensured by using reputable cloud service providers.
UiPath shall implement a formally documented incident management policy that includes (a) a reporting mechanism for suspected incidents and events affecting the security of Customer Data, including the reporting of suspected unauthorized or unlawful access, disclosure, loss, alteration and destruction of Customer Data (b) procedures for notification to relevant authorities as required by applicable law and the Customer; and (c) procedures for forensic investigation of a security incident.
UiPath and its sub-processors shall implement, install and maintain the following environmental controls to protect personnel and equipment used to process or store Customer Data: (a) fire suppression systems; (b) temperature and humidity controls within a data center or server room environment; (c) arrangements with authorities for active response to civil unrest or natural disasters; and (d) backup power technology (e.g., uninterruptible power supply, diesel generator, separate grid connection, etc.)
UiPath shall perform an environmental risk assessment before processing any Customer Data, which shall include an assessment of the threats of natural and man-made disasters. UiPath shall implement appropriate physical protections for facilities storing Customer Data, taking into account the results of the environmental Risk Assessment, the availability of state-of-the-art technology, and the costs of implementing those measures.
UiPath shall perform business continuity risk assessments to determine relevant risks, threats, likelihood of a service outage or security breach, impacts of a service outage or security breach, and required controls and procedures to secure Customer Data. Based on risk assessment results, UiPath shall document, implement, annually test and review business continuity and disaster recovery plans to validate the ability  to timely restore availability and access to Customer Data in the event of a service outage or data breach (a “BCDR Plan”). In its business continuity and disaster recovery plan, UiPath shall include (a) availability requirements for the Customer, specifying critical systems; (b) UiPath internally agreed recovery point objective(RPO) and recovery time objective (RTO); (c) clearly defined roles and responsibilities; (d) provisions for a geographically separate site subject to physical and environmental controls; and (e) backup and restoration procedures that include sanitation, disposal, or destruction of data stored at the alternate site.
Following each Disaster after the Cloud Software have been fully restored, UiPath shall conduct a root cause analysis and provide to Customer a summary report that describes, at a minimum, (i) the cause or causes of the Disaster, (ii) efforts taken to mitigate the consequences and resolve the Disaster, and (iii) the remedial actions to be implemented by UiPath in order to avoid future Disasters.

Awareness and Training

UiPath maintains an annual internal training program to educate its employees with respect to UiPath information security and compliance-related policies. Employees are informed of the requirements for acceptable use of UiPath’s resources, in order mitigate the risk of unauthorized access to UiPath equipment, as well as use and modification of information assets.
UiPath shall train employees on information security upon hire and annually thereafter. UiPath shall update that training to include changes in its organizational policies and procedures and shall address (a) employees’ specific job functions; (b) disciplinary actions when Personnel commit or cause a suspected or actual Data Breach, and (c) specific training for the processing of personal data in accordance with applicable Data Protection Laws.

Policy Monitoring, Testing and Reviewing

UiPath reviews policies at least annually and updates as needed to ensure that policies comply with changes in law, common industry standards, organizational practices, and contractual obligations and that they are appropriate to the risks faced by UiPath.

Customer Assessment

UiPath shall promptly review and complete any justified Customer security questionnaire. UiPath shall make relevant documentation, reports, and evidence available for review upon Customer’s written justified request.
Without the need for confidentiality measures, Customer may share the results of any audit, report, or test under this Section 8 with any Affiliate or any government regulator of any Affiliate. Under appropriate confidentiality measures, Customer may share the results of any audit, report, or test under this Section 8 with actual or prospective clients of any Affiliate. To the extent required, UiPath shall cooperate in good faith with requests from any client or government regulator of any Affiliate that wishes to further investigate UiPath’s security audit attestations and results.

Governance

UiPath reserves the right to make additional changes to this Exhibit and publish them on the Trust Portal, provided that UiPath will not decrease the level of security provided hereunder.

References

• docs.uipath.com/automation-cloud/docs/about-accounts
• docs.uipath.com/automation-suite/docs/about-accounts
• Robotic Process Automation | UiPath

Read User Manual Online (PDF format)

Read User Manual Online (PDF format)  >>

Download This Manual (PDF format)

Download this manual  >>