Description of the Security of the Services

This Description of the Security of the Services ("Security Description") is incorporated into, and forms part of, the Grovity Terms and Conditions accepted by the Client, or any signed master services agreement or similar written agreement between Grovity and the Client (collectively, the "Agreement"). References to "Grovity" refer to Grovity Services LLC, 600 Campana Ave, Miami, FL 33156, United States, and its affiliates. "Customer" or "Client" refers to the contracting Customer and its affiliates.

This Security Description describes the security program applicable to the Grovity Services ("Services") and the safeguards Grovity maintains to protect Customer Data (as defined in the Agreement) from unauthorized use, access, disclosure, theft, or manipulation. Grovity's security program evolves continuously; updates to this Security Description will not materially reduce the overall protections described herein. Capitalized terms not defined here have the meaning given in the Privacy Agreement.

Grovity's security program is designed with reference to recognized industry frameworks, including:

• The AICPA SOC 2 Trust Services Criteria (security, availability, confidentiality, and processing integrity).
• ISO/IEC 27001 and ISO/IEC 27002.
• The NIST Cybersecurity Framework, NIST SP 800-53 (control families), and NIST SP 800-61 (incident handling).
• The AWS Well-Architected Framework, including its Security and Reliability pillars.
• The OWASP Application Security Verification Standard (ASVS), the OWASP API Security Top 10, and the OWASP Top 10 for Large Language Model Applications.

The Services are built entirely on managed services from Amazon Web Services (AWS) and other enterprise-grade providers, under a shared-responsibility model:

• Inherited controls. Physical, environmental, network, and platform-level controls are provided by AWS, which maintains ISO/IEC 27001, 27017 and 27018 certifications, SOC 1, SOC 2 Type II and SOC 3 reports, and PCI DSS Level 1 Service Provider attestation. Clients can verify these independently through AWS Artifact. Grovity's other critical providers maintain their own certifications, listed on Grovity's Subprocessors page.
• Grovity controls. On top of that certified foundation, Grovity implements and operates its own controls for identity and access, application- and field-level encryption, tenant isolation, secure development, AI governance, and monitored operations, as described in this document.

Detailed security documentation, architecture and data-flow diagrams, and responses to standard security questionnaires are available to Clients and prospective Clients under NDA through security@grovity.ai.

This Security Description applies to the controls Grovity implements for the production Services. It does not cover:

• Beta or Alpha offerings (as described in the Terms and Conditions).
• Services provided directly by telecommunications carriers, messaging platforms, third-party AI providers, payment networks, or other independent third parties, which are governed by those providers' own security terms.
• Customer-controlled environments, including the Customer's devices, networks, integrations developed by the Customer, and any system outside Grovity's reasonable control.

Grovity maintains a risk-based information-security program covering administrative, technical, and physical safeguards appropriate to the nature of the Services, the size and complexity of Grovity's operations, and the sensitivity of the data processed. The program covers the following domains:

• Policies and procedures
• Asset management
• Identity and access management
• Cryptography and key management
• Physical and environmental security (provided through certified cloud regions)
• Operations and communications security
• Business continuity and disaster recovery
• Personnel security
• Secure development and application security
• Cloud and network infrastructure security
• Vulnerability and patch management
• Third-party and vendor risk management
• Security monitoring and incident response
• AI governance
• Compliance

Information-security policies are reviewed at least annually. Security is sponsored at the executive level, with the Chief Technology Officer accountable for the security program. Grovity maintains a security roadmap that is shared with enterprise Clients under NDA as part of their vendor-risk review.

Grovity maintains controls to protect the confidentiality of Customer Data in accordance with the Agreement. Grovity personnel and contractors with access to Customer Data are bound by confidentiality obligations that survive the end of their relationship with Grovity.

Grovity's personnel security program covers onboarding, confidentiality, security awareness, and offboarding. Access is granted according to role and revoked promptly upon termination. Where permitted by local law and warranted by the role, Grovity may perform background verification. Personnel receive guidance on Grovity's security policies, secure-development practices, social engineering, and privacy principles.

Grovity uses third-party providers (such as cloud infrastructure, database, AI model, voice, and observability providers) to deliver the Services. Grovity operates a Third-Party Risk Management program under which providers are assessed according to their criticality before engagement, including review of their security certifications and data-protection terms, and are subject to ongoing oversight. Customer Data must be returned or deleted at the end of the relationship with a provider.

The current list of subprocessors is published at https://www.grovity.ai/subprocessors. Telecommunications carriers, messaging platforms, and payment networks selected or contracted by the Client are not subprocessors of Grovity; their services are governed by their own terms.

Grovity enters into written agreements with its subprocessors that include confidentiality, security, and data-protection obligations consistent with applicable law, including commitments that Customer Data is not used to train providers' general-purpose models.

The Grovity platform is hosted on AWS in the United States (us-east-1 region), with additional regions available for specific Clients under a separate commercial agreement. The platform is a multi-tenant, cloud-native architecture defined as Infrastructure-as-Code, which ensures reproducibility, auditable change management, and automatic scalability. Core processing is serverless and asynchronous, using managed queues with dead-letter queues so that messages received during partial degradations are retained and processed.

Production workloads run in logically isolated network environments dedicated to Grovity. Tenant isolation is enforced server-side: every record processed by the Services is bound to a tenant identifier, and every request and query is scoped to that identifier independently of user input or model output. Knowledge-base retrieval for AI agents is likewise scoped to the requesting tenant and agent.

The infrastructure uses multiple availability zones within the AWS region for its managed services.

Grovity follows the principle of least privilege, using role-based access to internal systems. Personnel may access Customer Data only as required by their role and responsibilities. Access rights are reviewed periodically and revoked promptly upon role change or termination.

Administrative access to production infrastructure uses individual, attributable identities through a centralized identity provider (AWS IAM Identity Center) with encrypted sessions. Shared accounts are not used for human access. Administrative actions on cloud infrastructure are recorded in audit logs (AWS CloudTrail).

Client user credentials are managed through Amazon Cognito and stored using strong one-way hashing. Clients can enable multi-factor authentication for their users. Federation with the Client's corporate identity provider (OIDC or SAML 2.0) is available for enterprise Clients. API access uses tokens that are stored as hashes and can be rotated or revoked.

Changes to software and infrastructure are managed through version control and Infrastructure-as-Code, with peer review before deployment to production. Deployments are traceable to the corresponding change, and rollback procedures are available. Agent configurations and prompts are versioned, so that the configuration in effect at any point in time can be identified.

Public endpoints of the platform require TLS 1.2 or higher. Legacy protocols (SSLv3, TLS 1.0 and TLS 1.1) are not supported. Connections to databases and providers are encrypted.

Customer Data at rest is encrypted with AES-256 using AWS Key Management Service (KMS) or the equivalent native encryption of each managed service. The most sensitive data (such as third-party credentials, channel access tokens, and integration keys) receives an additional layer of application-level encryption.

Encryption keys are managed in AWS KMS, which uses FIPS 140-validated hardware security modules. Application secrets are stored in AWS Secrets Manager and AWS Systems Manager Parameter Store, never in source code. Access to keys and secrets is restricted to authorized roles and logged. Customer-managed keys (BYOK) can be offered to enterprise Clients under a separate commercial agreement.

Grovity uses TLS certificates issued by recognized certificate authorities, with automatic renewal.

Public endpoints are fronted by AWS-managed services that include AWS Shield Standard protection against common network- and transport-layer DDoS attacks. Grovity applies request throttling and rate limiting to its APIs, and typed input validation with field allowlists on its endpoints.

Grovity manages vulnerabilities on a risk basis. Dependencies are pinned through lockfiles and kept updated. Because the Services run primarily on managed and serverless services, operating-system patching of that infrastructure is performed by the cloud provider; components Grovity operates directly are patched by rebuilding and redeploying them. Identified vulnerabilities are prioritized and remediated according to severity.

Grovity's security program provides for independent penetration testing of the platform, covering the external perimeter, APIs, tenant isolation, and the AI agent surface (including the OWASP Top 10 for LLM Applications). Enterprise Clients may request information on security testing under NDA as part of their vendor-risk review. Clients may not conduct their own security testing of the Services without a prior written testing agreement with Grovity (see the Acceptable Use Policy).

Grovity maintains incident-management procedures aligned with NIST SP 800-61, covering detection, analysis, containment, eradication, recovery, and post-incident review.

Upon discovery or notification of a security incident affecting Customer Data, Grovity will:

• Promptly investigate the incident and take containment measures.
• Notify the affected Client without undue delay and, in any case, within seventy-two (72) hours after becoming reasonably aware of an incident that affects or may affect Customer Data, unless a shorter period is set in the Agreement or the applicable SLA.
• Provide the information reasonably available about the nature of the incident, the categories of data affected, the measures taken, and the corrective actions planned.
• Cooperate with the Client in regulatory notifications and data-subject communications, to the extent the incident falls within Grovity's reasonable control.

Grovity welcomes reports of security vulnerabilities from researchers and Clients. Reports can be sent 24/7 to security@grovity.ai and should include a description of the issue and the steps to reproduce it. Grovity will acknowledge receipt, keep the reporter informed of progress, and will not pursue legal action against good-faith research that: does not access, modify, or retain data of other users beyond what is strictly necessary to demonstrate the issue; does not degrade the Services; and gives Grovity reasonable time to remediate before any public disclosure. Grovity's machine-readable contact file is published at https://www.grovity.ai/.well-known/security.txt.

The Services use managed, auto-scaling services distributed across multiple availability zones. Asynchronous processing with queues and dead-letter queues prevents message loss during partial degradations, and the Infrastructure-as-Code definition allows the environment to be rebuilt in a controlled way. Monitoring and alerting (Amazon CloudWatch and application error tracking) notify the operations team of anomalies in real time.

Service availability commitments, incident response times, and recovery objectives are set out in the Service Level Agreement published at https://www.grovity.ai/sla or in the Client's Agreement.

Critical data (account information, configuration, conversation history, files, and other operational data) is backed up using the managed backup capabilities of Grovity's database and storage providers. Backups are encrypted, stored redundantly, and retained according to defined retention cycles, after which they are overwritten or deleted.

Grovity's production infrastructure is hosted in the United States. Grovity personnel who provide support may be located in the United States, Colombia, Brazil, Guatemala, and Jamaica, and access the platform only through the controlled channels described in Section 9. International transfers of personal data are governed by the Privacy Agreement and the applicable contractual mechanisms. Deployment in an additional region is available subject to a separate commercial agreement.

Grovity maintains centralized logging, monitoring, and error tracking. Credentials, tokens, and personal data are masked or redacted in operational logs. Logs are accessible only to authorized personnel and retained according to Grovity's retention policy and contractual commitments.

AI agents operate within a controlled orchestration layer: they can only invoke predefined business functions assigned to them, with typed parameters validated server-side; system instructions are kept separate from end-user content; and knowledge retrieval is scoped to the requesting tenant. Payment card data (PAN, CVV) is never included in prompts. Client Content is not used to train third-party models. Further detail is available in Grovity's Responsible AI statement.

The Services can be configured to process sensitive data, including health-related information, subject to the Health Data Addendum and the Client's obligations described in it. Protected Health Information under HIPAA may only be processed under a Business Associate Agreement executed with Grovity.

The Client is responsible for: (i) keeping its credentials and authentication factors secure and enabling multi-factor authentication for its users; (ii) properly configuring its tenant, including access roles, agent instructions, and integration credentials; (iii) ensuring that its End Users comply with the Acceptable Use Policy; (iv) classifying the data it submits and not transmitting categories of data beyond the scope of the contracted Service; and (v) implementing complementary controls in its own environment.

Grovity may update this Security Description from time to time. Updates will not materially reduce the overall protections described herein. Material changes will be communicated in accordance with the Terms and Conditions.