Security annex to the agreement (template)
A template annex to the main agreement for the use of Verbalu. It gathers in one place the commitments of the provider concerning information security. The fields in square brackets are completed by the parties before signing.
This is a template prepared by Verbalu, not legal advice. Before signing, it should be read by the lawyer of the customer. The values entered in the template correspond to what the service provides as at 12 November 2026. The processing of personal data is governed by a separate data processing agreement.
1. Parties and subject matter
The annex forms an integral part of the main agreement concluded between Octigo sp. z o.o., ul. Redycka 38/1, 51-169 Wrocław, Poland, KRS 0000360836 ("the Provider") and [name, address and registration number of the customer] ("the Customer"). It sets out the security measures that the Provider applies when providing the Verbalu service, and the manner in which the parties cooperate on security matters. The terms "incident", "critical level" and "high level" have the meaning given in the Security incident response procedure of the Provider.
2. Data location
The Provider stores the data of the Customer within the European Union, in Google Cloud infrastructure: the database and backups in the eur3 multi-region, files in the EU multi-region, server functions in the europe-west1 region. A transfer of data outside the European Economic Area may take place only in the cases and on the bases described in the data processing agreement, in particular when users of the Customer use artificial intelligence features. The Provider notifies the Customer of an intention to change the data storage region at least 30 days in advance.
3. Technical and organisational measures
The Provider ensures at least: encryption of transmission using the TLS protocol; encryption of data at rest, including backups; permission control enforced on the server side; separation of the data of the Customer from the data of other customers; the principle of least privilege in staff access; an audit log of organisation events retained for 13 months and protected against alteration; an obligation of confidentiality on staff, which also applies after the cooperation has ended. The Provider may change the measures, provided that this does not lower the level of protection achieved.
4. Authentication and access
The service allows sign-in with a corporate account of the Customer at an external identity provider; multi-factor authentication is then performed by that provider. The Customer requires its trainers and administrators to sign in with [a corporate account with two-step verification enabled]. The Provider declares that the service does not have its own second sign-in factor, and will notify the Customer when it is made available. Administrative access of the staff of the Provider to the production environment takes place exclusively from named accounts [with two-step verification enforced], to the extent necessary to maintain the service or handle a request of the Customer.
5. Backups and business continuity
The Provider makes a backup of the database at least once a week and retains each backup for 60 days within the European Union. The maximum data loss when restoring from a backup (RPO) is 7 days. Target recovery time of the service (RTO): [number of hours]. The Customer may export its data from the application on its own at any time. Contractual availability guarantee of the service (SLA): [none or the level agreed by the parties].
6. Updates and vulnerabilities
The Provider maintains the service on supported software versions and remedies vulnerabilities according to their severity: critical ones within [7] days, high ones within [30] days of confirmation, the remainder as part of ongoing work. The Provider notifies the Customer of a critical vulnerability that concerns the data of the Customer and cannot be remedied within that time limit, together with a description of compensating measures. The Customer may commission a penetration test of the service at its own expense, after agreeing the scope and date at least [30] days in advance; the Provider remedies confirmed findings within the time limits set out in this section.
7. Subcontractors
The current list of subcontractors processing the data of the Customer is contained in the Verbalu security pack and in the data processing agreement. The Provider notifies the Customer by email of an intention to add or replace a subcontractor at least 30 days in advance; the Customer may raise a reasoned objection within that period. The Provider is liable for the acts of subcontractors as for its own.
8. Incidents
The Provider notifies the Customer of an incident concerning its data or materially limiting the availability of the service without undue delay, no later than within 24 hours of establishing it, at the address [email of the security contact of the Customer], and additionally by telephone at the number [telephone]. The Provider provides supplementary information within 72 hours, and a final report within 30 days of closing the incident. The Provider cooperates with the Customer on notifications required by law, including the GDPR and the provisions implementing the NIS2 Directive. The Customer reports incidents and suspected incidents to the Provider at hello@verbalu.com.
9. Information and audit
On request, the Provider makes available to the Customer the information needed to assess the security of the service, including answers to the security questionnaire of the Customer, within [14] days. The Customer or an auditor authorised by it and bound by confidentiality may carry out an audit no more often than once every 12 months, after giving notice at least 30 days in advance, in a manner that does not disrupt the operation of the service and with respect for the data of other customers. The limit on frequency does not apply to an audit following an incident at the high or critical level.
10. End of cooperation
After the main agreement ends, the Customer may export its data within [30] days. After that period, at the written request of the Customer, the Provider permanently deletes the data of the Customer from production systems within [30] days and confirms this by email. Backups containing that data expire no later than 60 days after they were created.
11. Final provisions
In the event of a discrepancy between the annex and the personal data processing agreement, the data processing agreement prevails as regards personal data. Amendments to the annex require documentary form. The annex remains in force for the term of the main agreement.
| Parameter | Value |
|---|---|
| Customer | [name, address, registration number] |
| Main agreement | [number or date of the agreement] |
| Security contact of the Customer | [full name, email, telephone] |
| Security contact of the Provider | Marcin Żmigrodzki, marcin.zmigrodzki@octigo.pl |
| Incident notification | Within 24 hours of establishing the incident |
| Final incident report | Within 30 days of closing the incident |
| Backups | Weekly, retained for 60 days, in the EU |
| Maximum data loss (RPO) | 7 days |
| Recovery time (RTO) | [number of hours] |
| Remediation of vulnerabilities | Critical: [7] days. High: [30] days. |
| Deletion of data after the agreement ends | [30] days from the request |
| Date and signatures of the parties | [date, signature of the Customer, signature of the Provider] |