LightLeapAI^® Security Exhibit

N2N maintains the following controls for the Services throughout each Subscription Term. N2N may update these controls under MSA Section 1.4, but an update will not materially decrease the protection they provide.

1. Governance

N2N maintains a written information security program aligned with the NIST Cybersecurity Framework and NIST SP 800-171. The program is led by N2N's Chief Information Security Officer, reviewed at least annually, supported by a documented annual risk assessment, and reported to executive leadership at least annually. Where the GLBA Safeguards Rule applies, the CISO serves as the Rule's Qualified Individual.

2. Independent Assessments

N2N maintains a SOC 2 Type II report covering at least the Security trust services criterion, issued annually, and TX-RAMP Level 2 certification. Current reports and certifications are available under MSA Section 11.1.

3. Access Control

Access to Customer Data is granted by role, on a least-privilege and need-to-know basis. Multi-factor authentication is required for all N2N personnel access to production systems and Customer Data. Access rights are reviewed quarterly, and access is revoked within 24 hours of personnel separation. Customer administrators control their own users' access, and the Services support SSO where the subscribed edition includes it.

4. Encryption

Customer Data is encrypted in transit using TLS 1.3, with TLS 1.2 used only where a connecting system does not support 1.3. Customer Data is encrypted at rest using AES-256 or equivalent, with keys managed in the cloud provider's key management service under N2N's access policies.

5. Tenant Isolation

Customer Data is logically separated from other customers' data. Meridian provides each Customer a dedicated, audited database.

6. Vulnerability Management

N2N performs continuous automated vulnerability scanning of its cloud workloads and tracks findings to remediation through a plan of action and milestones. Critical findings are remediated within 15 days of identification, and high findings within 30 days. An independent third party performs a penetration test at least annually; N2N will provide a summary letter on request.

7. Secure Development and Change Management

Code changes require peer review and automated security testing, including dependency scanning, before production deployment. Production changes follow a documented change management process.

8. Logging and Monitoring

Security-relevant events, administrative actions, AI context invocations under ICCP, and write-back activity are logged centrally within N2N's own cloud environment and retained for at least 12 months. Logs are monitored for anomalous activity, with alerting to on-call personnel.

9. AI Security

AI features receive data only through ICCP, scoped by role, time, and resource. N2N applies protections against prompt injection and unauthorized data exposure through AI features. No Customer Data is used to train models except as MSA Section 6.3 permits.

10. Business Continuity and Disaster Recovery

Customer Data is backed up daily, with backups encrypted and stored in a separate availability zone within the hosting region. N2N maintains a disaster recovery plan, tested at least annually, with a recovery point objective of 24 hours and a recovery time objective of 8 hours.

11. Incident Response

N2N maintains a written incident response plan and tests it at least annually. Notification to Customers follows DSA Terms Section 10.

12. Personnel

N2N personnel with access to Customer Data undergo background checks where permitted by law, sign confidentiality agreements, and complete security and privacy training, including FERPA, at onboarding and annually.

13. Subprocessors

N2N assesses the security of each Subprocessor before engagement and periodically after. Identity verification Subprocessors must meet DSA Terms Section 7.4.

14. Physical Security

The Services are hosted in Amazon Web Services data centers. Physical and environmental controls are inherited from AWS and validated through AWS's independent assessments. N2N does not store Customer Data on premises.

Revision history