Security

Application Security

Does Templafy conduct penetration testing of its network, infrastructure, and services?

Penetration testing is conducted to measure the security posture of Templafy Services and Infrastructure. Templafy has an external penetration test performed at least once per calendar year.

The objective of those penetration tests is to identify design or functionality issues in Templafy Services that could expose Data or Customers to risks from malicious activities.

Each external penetration test is performed by an internationally recognized, independent third-party software security testing company.

Each penetration test: 

(i) encompasses both the internal and external network and authenticated application layer,

(ii) includes at least 80 hours of manual effort by the testing company,

(iii) probes for weaknesses in network perimeters or other infrastructure elements and any weaknesses in process or technical countermeasures relating to Templafy’s Services that could be exploited by a malicious party, and

(iv) identifies (at a minimum) the following security vulnerabilities: invalidated or unsanitized input; broken access control; broken authentication and session management; cross‐site scripting (XSS) flaws; buffer overflows; injection flaws; improper error handling; insecure storage; denial of service; insecure configuration management; proper use of SSL/TLS; proper use of encryption; and anti‐virus reliability and testing.

Can customers conduct their own penetration tests?

Customer-led penetration testing can be conducted upon request at security@templafy.com and is subject to conditions prior to carrying out the tests.

Does Templafy conduct vulnerability scanning of its network, infrastructure, and services?

Vulnerability scanning is performed on a continuous basis by Templafy in accordance with the vulnerability management policy. Technologies used are:

• WhiteHat Security scanning for 24/7 web application dynamic application security testing (DAST),
• SonarCloud for static application security testing (SATS) before each release,
• Software Composition Analysis 24/7. We scan the libraries and dependencies used in our products to identify vulnerabilities and ensure the vulnerabilities are managed.
• Renovate for ensuring that open-source dependencies always are the latest available version.
• Azure Security Center and Azure Monitor for daily infrastructures, network, and application vulnerability scanning. Retests and on-demand scans are performed on an as-needed basis.

Is there a formal Software Development Life Cycle (SDLC) process?

Templafy’s software development practices across each of the engineering teams are aligned with the Secure Development Lifecycle (SDLC) methodology and follow Scrum and Agile approaches.

Detailed policies and processes for the development of the Templafy Services have been designed with optimal security and quality in mind.

The principles of security by design and default are implemented and rooted in training, coaching, pair programming, code review comments, coding tools, and branch policies in Azure DevOps.

Templafy has implemented segregated environments for development, testing, and production as a means to support the segregation of duties and prevent unauthorized changes to production.

In addition, production data is not used or copied to non-production environments. Test scripts and synthetic data are created for use in the development and stage environments.

How Does Templafy manage changes in the platform?

All application code changes are tested, peer-reviewed, and approved prior to implementation into production. The production and non-production environments are deployed in their own Azure Active Directory and their own Azure Subscriptions, thus completely separated, and changes are tested according to the nature of the change in an environment separate from production prior to deployment into a production release.

Tests include functionality unit testing, integration testing, smoke tests, manual regression testing, and load testing. Extensive security testing is conducted (see vulnerability management section).

All change requests are logged, whether approved or rejected, on a standardized central system. The approval of all change requests and the results thereof are documented. Access to migrate change to production requires formal approval and is restricted to authorized personnel. Code management tools enforce branch protection policies to help ensure users cannot bypass standard change controls.

Backup

What is the backup strategy in place?

For Templafy Services, tenant configuration data and binary data are backed up daily in SQL. In Templafy Hive, a 90-day Long-Term backup retention geo-redundant backup of SQL is available.

Data in storage accounts are written to three disks for redundancy per site and replicated across multiple sites.

The backup system automatically generates a backup log. A point-in-time restoration option is also enabled for up to 7 days, in which all changes can be restored with at most 10 minutes of data loss.

Access to backup data is restricted only to authorized personnel using Azure AD with multi-factor authentication.

Furthermore, all backups are encrypted using AES 256 encryption.

How long is the retention for backups?

Backups are retained for 90 days in SQL. For blob storage, we have enabled soft-delete, so data will be removed 30 days after deletion.

Does Templafy maintain offsite backups?

The Templafy solution is hosted using Microsoft Azure PaaS.

Templafy uses multi-site data centers with availability commitments to permit the resumption of Templafy Services in the event of a disaster or partial outage at its primary data center location.

Business Continuity and Disaster Recovery

How do you ensure the continuity of the Templafy platform?

The Templafy platform is deployed redundantly in primary and secondary Azure data centers in respective Azure data regions.

Templafy has created Disaster Recovery plans to cover all three general scenarios: malicious incidents (third-party or insider threat), accidental incidents (human error), and unavailability incidents (Azure outages that affect our product). Templafy’s business continuity plans are reviewed annually and updated, if necessary.

Do you perform disaster recovery tests?

Templafy conducts testing of the business continuity and disaster recovery plans annually. Any issues identified during testing are resolved, and plans are updated accordingly. Testing of plans includes failing over a server and restoring backups.

What are the Recovery Time Objective and the Recovery Point Objective?

• The Recovery Time Objective (RTO) for the Templafy Platform is 24 hours.
• The Recovery Point Objective (RPO) for the Templafy Platform is 24 hours.

Data Security

Is data encrypted at rest?

Data is encrypted at rest using AES 256.

Is data encrypted in transit?

Data is encrypted in transit using minimum TLS 1.2.

How are encryption keys managed?

The key management of Service-Managed keys for data at rest encryption is performed by Azure. The certificates used for data in transit encryption are managed using Azure Key Vault by Templafy and are subject to Templafy’s cryptography policy.

Where is data stored?

Templafy does not store any data onsite. Microsoft Azure data centers are used to host the services provided to customers. Storage is clustered into regions to provide enhanced availability (a primary data center and a secondary data center for failover). Customers can selection region for data storage. Once selected, the data storage cannot be moved.   

Templafy Service	Applicability	Locations
Templafy One	All customers on One (original platform)	North Europe (primary) and West Europe (secondary)
Templafy Hive	All customers on Hive (second iteration of the platform)	One of the below options:  – West Europe (primary) and North Europe (secondary)  – East US (primary) and West US (secondary)  – Australia East (primary) and Australia Southeast (secondary)  – Central Canada
Data Analytics Platform	All customers	West Europe (primary) and North Europe (secondary)
AI Assistant and AI Data Transformation	All customers on Hive using these services	Based on Hive storage selection:  – Sweden Central (for customers who opt for storage in Europe)  – East US (for customers who opt for storage in the US)  – Australia East (for customers who opt for storage in Australia)  – Canada East (for customers who opt for storage in Canada)

In addition to Microsoft, other sub-processors store data in locations as listed here.  

Data may be processed and stored in sub-processing locations as listed here.  

While Templafy does not host data on our premises, data may also be remotely processed outside the locations of Templafy offices for the purpose of provisioning the services to our customers.  

To do so in a secure manner, we have implemented a strict remote work policy, governed by the information security department, and subject to applicable contractual and regulatory requirements. 

What is the data retention for the data stored in the platform?

Customer data is deleted from the platform 90 days after contract termination.

Identity and Access Management

How do users and administrators gain access to the application?

Templafy supports just-in-time user-provisioning and SSO on-boarding against Azure AD, ADFS, SAML2, WS federation, Google Authentication (OAuth 2.0), and Azure AD (OpenID Connect).

Does Templafy Support SCIM?

Yes, please refer to this article on our Knowledge Base.

Does Templafy use Role Based Access Control?

Yes, please refer to this article on our Knowledge Base.

Is access logged?

Templafy offers activity logs to all customers. These logs include:

• User management activity log
• Space members’ activity log (if spaces are used)
• Library admin activity log
• Email signature activity log

These logs are available in the admin center of the customer’s tenant. To learn more about logs see here.

Incident Management

Does Templafy have a defined cybersecurity incident management process?

In the event of such a Security Incident, Templafy shall provide you with a detailed description of the Security Incident and the type of Personal Information concerned, unless otherwise prohibited by law or otherwise instructed by a law enforcement or supervisory authority.

Templafy shall without undue delay (and in any event within thirty-six (36) hours) inform the affected customer in writing, whenever Templafy reasonably believes that there has been an Information Security Incident.

Templafy shall inform the customer with as many details as known at that time (and regularly update the customer thereafter in writing or by email followed by a written notification) setting out in reasonable detail, without limitation, the nature of the information compromised, threatened, or potentially compromised, the specific information compromised or potentially compromised and of all events which may adversely affect the Vendor’s ability to provide the Service.

Following such notification, Templafy will take reasonable steps to mitigate the effects of the Security Incident and to minimize any damage resulting from the Security Incident.

Templafy will assist and cooperate with affected customers with any necessary or appropriate disclosures and other investigative, remedial, and monitoring measures as a result of the security incident.

Does Templafy have external reporting procedures in place for cybersecurity or privacy incidents?

Incident report is handled as part of our incident management process, whereby incidents impacting customers are reported to respective customers.

For privacy-specific incidents, the process is governed by the DPA customers, and authorities are informed as required by the law.

How can incidents be reported?

Incidents can be reported through our Incident Reporting form or through our security@templafy.com email.

What SLA is offered for the solution?

SLA: 99,5%

Please see here to monitor our uptime.

Organizational Security

Does Templafy have a cybersecurity awareness training program in place?

Mandatory general security training is provided at onboarding to all employees and contractors. Mandatory training on a specific security topic is also provided annually.

Does Templafy have a department with oversight of information security?

The Information Security department at Templafy is managed by a CISO. The department includes members dedicated to the areas of Privacy, Governance, Risk, Compliance, and Technical Operations.

Does Templafy perform background checks and screening prior to employment?

All employees undergo a background check prior to employment.

How are responsibilities allocated between Templafy, the customer, and Microsoft Azure?

Please refer to this article on our Knowledge Base.

Physical Security

How do you manage data center security?

Templafy’s service data is hosted in Microsoft Azure data centers. MS Azure adheres to security controls for ISO 27001, ISO 27018, SOC 1, SOC 2, SOC 3, FedRAMP, HITRUST, MTCS, IRAP, and ENS. Please refer to this link for more details.

The data center’s physical infrastructure is operated by Azure and we rely on their data center security controls.

Access controls are implemented, including biometric controls, CCTV is active across the data center perimeters and access points are staffed with security officers.

Please refer to this link for more details on the physical security measures implemented in Microsoft Azure data centers. We monitor the compliance of these controls through independent security attestations and reports.

Have you implemented physical security controls at your offices?

Templafy maintains a physical and environmental policy for its offices to ensure the security and integrity of Templafy’s facilities and the assets located within.

Templafy offices have industry-standard physical security protection with secure access, burglary alarm, motion detectors, etc.

Further visitors to secure areas are required to sign in and out with arrival and departure times, are required to wear an identification badge, and are always escorted while in secure areas.

Artificial Intelligence

Does the Templafy platform leverage any AI?

Templafy utilizes AI in various aspects of the product. Additional details regarding the functionalities that incorporate AI can be found in the links provided below.

• AI Tagging – built on Azure AI Vision
• AI Data Transformation – built on Azure Open AI
• AI Assistant
  • Universal AI Assistant – built on Templafy’s instance of Azure OpenAI
  • Custom AI Assistant – built on the customer’s instance of Azure OpenAI

Tenant administrators and owners have the option to disable any of these AI functionalities in the Admin Center. All of Templafy’s AI capabilities are built on standard Microsoft services.

What types of data are processed by Templafy’s AI functionalities?

Templafy Service	Input	Output
AI Tagging	All images in the Templafy Library (jpg, jpeg, png, svg)	Tags
AI Data Transformation	Prompts configured by the administrator Selected external data source schema definition Selected data sample from the selected data source The data transformation rule	JMESPath query expression
AI Assistant	Free text e.g. a section of a document Tone of voice configuration Prompt configuration	text e.g. rephrased section of a document

Is the model utilized by Templafy’s AI features trained on the Customer’s data?

No, customer data is not used to train any of the AI models leveraged by Templafy’s AI features.

How long is the data retained in Templafy’s AI features?

AI Tagging

Data type	Templafy platform	Microsoft OpenAI Model
Images in the Templafy library	Stored for the duration of the contract or until manually deleted from the library + 90 days	Only processed in real time, not stored

AI Data Transformation

Data type	Templafy platform	Microsoft OpenAI Model
Prompts configured by the administrator Selected external data source schema definition Selected data sample from the selected data source Data transformation rule JMESPath query expression	Stored for the duration of the contract or until manually deleted from the tenant + 90 days	The input and output of data is processed in real time. However, the input and output data may be temporarily stored by the Microsoft Azure OpenAI Service in the same region which Templafy deploys its Azure OpenAI Service for up to 30 days for debugging purposes in the event of a failure and/or investigating patterns of abuse and misuse to determine if the service is being used in a manner that violates the applicable product terms. Human reviewers assessing potential abuse can access this repository of prompts and completions data only when that data has been flagged by the abuse monitoring system.

AI Assistant

Data type	Templafy platform	Microsoft OpenAI Model
Tone of voice configuration Prompt configuration	Stored for the duration of the contract or until manually deleted from the AI Assistant + 90 days	Only processed in real time, not stored
Selected text	Only processed in real time, not stored	The input and output of data is processed in real time. However, the input and output data may be temporarily stored by the Microsoft Azure OpenAI Service in the same region which Templafy deploys its Azure OpenAI Service for up to 30 days for debugging purposes in the event of a failure and/or investigating patterns of abuse and misuse to determine if the service is being used in a manner that violates the applicable product terms. Human reviewers assessing potential abuse can access this repository of prompts and completions data only when that data has been flagged by the abuse monitoring system.

Who has access to the data, and how is access control managed?

Only Templafy and Microsoft Azure are involved in the processing of data.

For the AI Assistant, Templafy employees may have access to prompts and tone of voice storedin the tenant. No one at Templafy has access to the selected text and the output. 

Templafy employees may have access to the input and output data of AI tagging and AI data transformation stored on the Templafy platform when they provide customer support and success services offered in the best interest of the customer, or when a forensic investigation needs to be carried out following a security incident.

The data that is stored in the customer’s tenant is secured by various means. Access to program production data is restricted and limited to authorized personnel. Templafy has role-based access control. Access to production information systems is enforced via Azure AD multi-factor authentication. Appropriate identification and authentication are required to perform actions on the production environment and cannot be circumvented. Read access to system databases is provided to Senior Site Reliability Engineers. No one in Templafy has write access to production system databases.

As mentioned above, Microsoft has limited access to the input and output data. Microsoft ensures the security of specific reviewers through various means, read more here.

Is the data shared with third parties, and if so, what safeguards are in place to protect it?

Only Templafy and Microsoft Azure are involved in the processing, with no additional third parties included.

Microsoft serves as a reliable sub-processor in providing our services to customers. The privacy and security measures of Microsoft undergo extensive evaluations by Templafy’s Information Security team, ensuring they meet the data protection standards outlined in the Templafy Data Processing Agreement with our clients. Both Templafy and Microsoft hold certifications under the Data Privacy Framework, the sub-processing agreement with Microsoft includes the Standard Contractual Clauses, and Transfer Impact Assessments for international transfers are conducted.

The security of Azure OpenAI and Azure AI Vision is primarily managed by Microsoft, which implements a range of security measures to protect customer data. These include data encryption both in transit and at rest, strong access controls through Azure Active Directory (Azure AD) with multi-factor authentication and role-based access control, and strict data privacy policies ensuring customer data is isolated and protected. Microsoft also ensures compliance with key industry standards, such as ISO 27001 and SOC 2, and provides ongoing monitoring, logging, and patching to mitigate security risks.

AI Tagging

For more information please refer to Microsoft’s safeguards around image analyses.

AI Data Transformation, AI Assistant

All inputs and outputs for this service are passed directly through Microsoft OpenAI Service via secured APIs. These APIs employ various security measures such as encryption, authentication, and authorization to safeguard sensitive information from unauthorized access or tampering during transfer. For more information please refer to Data, privacy, and security for Azure OpenAI Service.

How transparent is the AI model’s decision-making process, and can users understand how their data influences outcomes?

Please refer to Microsoft’s Transparency Note for Azure OpenAI Service for more information on the transparency of the models used for of AI features.

How are updates to the AI model managed, and what controls are in place to ensure that updates do not introduce new vulnerabilities?

Templafy does not control the Azure OpenAI model for any of the AI features that we leverage. For information about how Microsoft updates their AI models, refer to their website here.

How is the model protected against adversarial attacks or attempts to manipulate input data?

Templafy does not have control over the underlying model, but Azure OpenAI Service has implemented several measures that raised the security level of this model to high standards. These measures include guardrails that prevent the model from generating harmful or malicious content. These guardrails include filtering out toxic or offensive content, flagging content that may be harmful and limiting the model’s ability to generate certain types of content. To see more information, follow here:

• Content Filtering
• Abuse Monitoring

This latter point is also relevant for our AI Assistant. In fact, while most Gen AI tools allow for free prompts, our AI Assistant limits the prompts to just the ones that were deemed acceptable by the tenant administrator. Prompt engineering can be a difficult and risky task, but with our AI Assistant you can rest assured that only pre-approved and accurate prompts are run. Any updates and patches to the AI Assistant are deployed in accordance with our Secure Software Development Lifecycle. We secure API keys and integrations using Azure Key Vault and in accordance with best practices.

For more information, please refer to Data, privacy, and security for Azure OpenAI Service and Data and privacy for Image Analysis.

What logging mechanisms are in place to track access and usage of the AI functionality?

AI Tagging

Templafy does not collect any usage logs for its AI tagging functionality.

AI Data Transformation, AI Assistant

Templafy will improve and enhance our service offering by tracking the use of our product. Please note that user provided input will not be tracked or logged. The usage data is pseudonymized and includes the character length of the selected text by users and the character length of prompts configured for actions. The activation or deactivation of the AI functionality is recorded.

AI Data Transformation

Additionally, we track all successful and unsuccessful transformation attempts.

Is the EU AI Act applicable to Templafy?

Yes, the EU AI act is applicable to all providers and users of AI systems within the EU.

Templafy’s AI features can be classified in the “Limited Risk” category. The security requirements for limited risk systems include transparency and information provision. Templafy’s AI features fulfil both of these requirements by being clearly marked as “AI” within the platform’ UI and through the multiple articles available in our Templafy Help center and courses available in our Templafy Academy.

Templafy continuously re-evaluates its AI features in light of evolving laws and regulations, and adjusts its security measures to ensure that its product remains fully compliant with all applicable requirements.

Privacy

Personal Data Types

What types of personal data Does Templafy process on behalf of customers?

• User profile information, such as name, email address, phone numbers, job title, and other elements as configured by customer admins. Can be read from customer ADs.
• Any personal data in customer digital assets uploaded to the services, such as company pictures, contact information e.g. in contracts or slide decks, and any other elements in digital assets that customer admins choose to upload to Templafy
• Any personal data inputted into response forms or relevant data sources, configured by customer admins.
• System information such as IP address and usage behavior as users navigate through the Templafy services.

Does Templafy process sensitive data?

Templafy is typically used for standard, generic content such as contract templates and brand-compliant slide decks that users generate and further build on.

We mainly see user personal data in the form of work-related information and basic contact details, such as what an email signature would contain.

Templafy services can be used in many ways to optimize business contents, however from a privacy perspective, it is possible to restrict and govern the processing; the control is with appropriate customer admins.

Data subjects

Whose personal data does Templafy process?

Templafy primarily processes customer employee data, who are users of the services. However customer admins may choose to give access to partners or involve other data subjects should they wish (e.g. through the available integrations).

About the Processing

How Does Templafy process customer personal data?

Customer admins configure the authentication method by which customer end-users access Templafy with the use of their user profiles. Templafy processes end-users’ personal data set up in their user profile, any personal data included in the customer’s digital assets (e.g. company pictures), and if otherwise inputted in the services (e.g. data sources and response forms).

The authentication method may be just-in-time (JIT) user provisioning and single-sign-on onboarding against the customer’s active directory (AD), which can be configured to communicate to Templafy certain personal data elements (name, work email address, job title). End-users are able to view their user profile, and modify or delete to a degree controlled by the customer admin.

Is the data collected by AI personally identifiable information? How is it handled to protect user privacy?

AI Tagging

Images processed by this AI feature may contain Personally Identifiable Information.

AI Data Transformation

Data transformation input and output may contain Personally Identifiable Information if configured by the customer administrator, however, it is not essential for optimal usage.

AI Assistant

The AI Assistant input and output may contain Personally Identifiable Information as part of the input selected by the customer.

All processing of customer personal data is governed by the entered into Data Processing Agreement. In line with all processing activities related to personal data within Templafy services, the data flow of the AI Assistant adheres to fundamental data protection principles, ensuring that data is processed solely for the approved purposes and duration, which are clearly communicated. Templafy’s Privacy team has conducted a formal evaluation of the personal data processing by Templafy’s AI functionalities, confirming its alignment with the initial purpose of data collection and affirming that the risk to the rights and freedoms of data subjects has not increased. Customers remain controllers of the data used for Templafy’s AI functionalities, and Templafy does not use the data for its own purposes or in any capacity other than as a data processor fulfilling a contract with the customer.

Data Processing Agreement

Is there a data processing agreement with customers?

Yes. The Templafy data processing agreement (DPA) governs the processing of personal data that Templafy takes on as data processor, on behalf of customers as data controllers, unless otherwise agreed.

The Templafy DPA is compliant with applicable data protection legislation, including the General Data Protection Regulation (GDPR) and includes the necessary details about the processing of personal data specific to our services.

Sub-Processors

Which sub-processors are in use for the services?

Templafy may use sub-processors, including affiliates of Templafy, as well as third-party companies, to provide, secure, or improve the services, and such sub-processors may have access to customer data.

Our list of sub-processors provides an up-to-date list of the names and locations of all sub-processors.

Processors or Controller

Is Templafy a data processor or a data controller?

For the purpose of provisioning the Templafy services to our customers on the basis of performing the contracts we have with them, Templafy acts as a data processor.

For other purposes, Templafy may act as a data controller. These processing activities are described in the applicable privacy policies:

• General privacy notice
• Engage privacy notice
• Templafy recruitment privacy notice
• Website cookie notice

International Data Transfers

Is Templafy certified with the Data Privacy Framework (DFP)?

Yes. Please see our up-to-date status here.

How does Templafy respond to regulatory restrictions on third country transfers?

Templafy Privacy keeps updated with regulatory restrictions and any changes to these. Once the Schrems II judgement required that the personal data protection in the European Economic Area (EEA) travelled with the data wherever it goes, Templafy verified that all third country transfers had legal basis for such transfer, including the use of the Standard Contractual Clauses (SSCs) and the performance of Transfer Impact Assessments (TIAs) on applicable jurisdictions to ensure appropriate supplementary safety measures were in place with the Templafy affiliates and third-party service providers.

As a result of the European Commission’s adoption of the adequacy decision for the EU-US Data Privacy Framework, Templafy certified under the framework to demonstrate reliable mechanisms for safe personal data transfer from the EU to the US.

Contact

How can customers contact Templafy’s DPO?

Attn: Margrét Due
Head of Privacy
Wilders Plads 15A
1403 Copenhagen K
Denmark;
privacy@templafy.com

Law Enforcement Request

Does Templafy have a transparency report

Templafy can provide updated information relating to law enforcement requests for customer information upon request. As of 15/07/2024, we have received the following requests:

Type of Request	Number of Requests	Content Data Disclosed	Non-Consent Data Disclosed
Subpoena	0	0	0
Court Order	0	0	0
Search Warrant	0	0	0
Emergency Requests	0	0	0