From Schedule 4 of the Data Processing Addendum.
SCHEDULE 4
TECHNICAL AND ORGANIZATIONAL MEASURES
| Measure | Description |
|---|---|
| Encryption of Credentials | Credentials are encrypted at rest using AES-256-GCM with encryption keys maintained on a per-tenant basis, and are never disclosed to ISVs. |
| Encryption in transit | All connections to the Service, the API and Connected Systems use TLS. |
| Tenant isolation | Structural tenant isolation: at authorization time, another organization's tenant is indistinguishable from a non-existent one. Machine (API key) access and human console sessions are never merged. |
| Access control and least privilege | ISVs receive scoped, revocable Grants rather than possession of Credentials; each permission is tested before a Grant goes live; the MSP may narrow or revoke at any time. Bitlync support access is read-only. |
| Logging and audit | Append-only Audit Log of API calls, writes, logins, acceptances and Grant changes, visible to the MSP in the MSP Portal. |
| Write safety | Preview (dry_run) then commit; idempotency keys where supported; deletion of records in a Connected System and synchronization or disclosure of documentation passwords or credential objects refused by policy; close-with-resolution disabled by default; updating of companies and agreements, creation or updating of contacts, projects and custom fields, and device and documentation changes, disabled unless enabled by the MSP; billing writes limited to updating the quantity on a billing record which the MSP has matched to the ISV. The Service currently does not create companies or customers, agreements or contracts, or billing records in the MSP's professional services automation system. Any additional write types will be available only with the MSP's explicit authorization. |
| Data minimization | Documentation passwords and credential objects held in Connected Systems are never synchronized. Only objects within an approved Grant are served to an ISV. |
| Rate governance | Bitlync paces its calls to each Connected System to a fraction of the vendor's published per-tenant limit to avoid service disruption to the MSP. |
| AI Assistant | Where enabled: structurally read-only (no write tool), tenant-pinned, grounded-or-escalate, spend-capped; MSP Data is not used to train generally available models. |
| Personnel | Confidentiality obligations and data protection training for all personnel with access to MSP Personal Data. |
| Vulnerability management | Regular patching and vulnerability assessment of the Service. |
| Business continuity | Encrypted backups rotated within thirty-five (35) days; connection health and incident reporting published in the MSP Portal. |
| Assurance | SOC 2 examination in progress; no completed report is claimed until confirmed in writing. Report to be made available under paragraph 10.2 when issued. |
| Deletion | Secure deletion of Credentials and MSP Personal Data within ninety (90) days of termination, deletion or revocation, subject to backup rotation. |