Security Addendum (Enterprise SaaS) - Alabama

SECURITY ADDENDUM (ENTERPRISE SAAS)

This Security Addendum is entered into by [CUSTOMER LEGAL NAME] ("Customer") and [PROVIDER LEGAL NAME] ("Provider") as of [EFFECTIVE DATE] and supplements their [MASTER AGREEMENT NAME AND DATE] (the "Agreement"). The parties agree as follows.

1. Scope and definitions

1. Services. This Addendum applies to [DESCRIBE SERVICES AND ENVIRONMENTS] and the Customer Data identified in Schedule A. It does not cover an environment or data set excluded in Schedule A unless the parties amend that schedule in writing.
2. Customer Data means information provided by or for Customer, or generated for Customer through the Services, that Provider processes under the Agreement. Security Incident means confirmed unauthorized access to, acquisition of, disclosure of, or loss of Customer Data or a material compromise of the systems that protect it. A reported event remains under investigation until confirmed or ruled out.
3. Order of precedence. For the covered Services and Customer Data, this Addendum controls a conflict about security controls, incident cooperation, or return and deletion. The Agreement controls all other subjects unless it expressly states otherwise. A separately signed data processing agreement controls its own privacy and transfer terms; the parties shall identify any conflict in Schedule A before signing.
4. Applicable law. Each party remains responsible for duties applicable to its actual role, data, and activities. The parties shall complete the Alabama role and notice map in Schedule E. Contractual labels and notice periods do not change a legal duty or extend a legal deadline.

2. Security program and responsibility

1. Provider shall maintain a documented program of administrative, technical, and physical safeguards for the covered Services. The controls selected in Schedule B are binding commitments. A blank or "not applicable" entry creates no commitment unless another clause expressly supplies one.
2. Provider shall designate [SECURITY OWNER / ROLE] to oversee the program, assess material risks [FREQUENCY / TRIGGER], and document corrective actions. Provider shall review the program when material changes to the Services or threat environment warrant it.
3. The parties shall perform the responsibilities assigned in Schedule A. Customer is responsible for its own user permissions, configuration choices, endpoints, and data it places in the Services to the extent Schedule A assigns those tasks to Customer. Provider remains responsible for its personnel and permitted subprocessors within its assigned scope.
4. Provider shall give personnel access only for authorized work, require confidentiality commitments, provide training appropriate to their access, and promptly remove access when no longer needed.

3. Technical and operational controls

1. Provider shall implement the selected identity, encryption, network, application, vulnerability, logging, and physical controls in Schedule B. The schedule must identify the control owner, coverage, evidence, and any approved exception.
2. Provider shall keep a vulnerability register, prioritize remediation by severity and exposure, and meet the target periods selected in Schedule B. If a target cannot be met, Provider shall document a compensating control, owner, and revised date and notify Customer when the risk is material to Customer Data.
3. Provider shall maintain the backup and recovery arrangements in Schedule D, test restoration as specified there, and record material test failures and corrective actions.
4. Provider may improve a control without consent if the change does not materially reduce the agreed protection. Provider shall give [NOTICE PERIOD] prior notice of a proposed material reduction, except an urgent protective change may be made immediately with prompt notice and a written explanation.

4. Subprocessors and locations

1. Provider may use only the subprocessors and locations listed in Schedule C or added under its change procedure. Provider shall bind each subprocessor to written security and incident-cooperation obligations appropriate to the work it performs and remains responsible to Customer for the subprocessor's performance under this Addendum.
2. Provider shall give [NUMBER] days' notice before adding a subprocessor or moving Customer Data to a new location. Customer may object within [NUMBER] days for a stated security or legal reason. The parties shall seek a practical resolution; if they cannot, [STATE THE AFFECTED-SERVICE TERMINATION OR ALTERNATIVE-HOSTING RIGHT].

5. Security events and notices

1. Provider shall maintain an incident response process, preserve relevant evidence, contain and investigate a suspected Security Incident, and keep a dated incident record. Provider shall notify Customer at [SECURITY CONTACT AND CHANNEL] without undue delay and no later than [CONTRACTUAL PERIOD] after confirming a Security Incident affecting Customer Data. Provider shall send a preliminary notice if material facts remain unknown and update it as facts develop.
2. Notices shall describe, as then known, the affected Services and data, incident period, current containment, potential impact, and contact for follow-up. Provider shall provide information in its possession reasonably needed for Customer's own assessment and notices, subject to lawful limits and preservation of evidence.
3. The parties shall use Schedule E to identify who investigates, decides whether a government or individual notice is required, prepares and sends each notice, and pays agreed response costs. If a legal notice deadline is earlier than the contractual reporting target, the responsible party shall meet the legal deadline. Provider's notice to Customer does not by itself discharge either party's external notice duty.
4. Neither party shall issue a public statement naming the other about an incident without prior consultation when practicable, except when required by applicable law or a regulator. The notifying party shall share a copy as soon as lawful and reasonably possible.

6. Audit and evidence

1. Provider shall give Customer [SOC 2 REPORT / ISO CERTIFICATE / OTHER EVIDENCE] for the covered Services [FREQUENCY], subject to confidentiality safeguards. Provider shall disclose material exceptions affecting Customer Data and its remediation plan.
2. Customer may request a focused review of relevant controls [FREQUENCY / FOLLOWING A MATERIAL INCIDENT] on [NOTICE], during normal business hours and without exposing another customer's confidential information. The parties shall agree on scope, security conditions, and allocation of reasonable audit costs before access.
3. Provider shall retain records sufficient to demonstrate performance of its selected controls for [PERIOD], subject to the retention and deletion terms in Schedule D.

7. Return, deletion, and transition

1. At expiration or termination, Provider shall make Customer Data available for export in [FORMAT] for [PERIOD], then delete or render it unusable under the method and schedule in Schedule D, except for a documented legal hold or retention requirement. Backup copies shall age out under the disclosed backup cycle and remain protected until deleted.
2. Provider shall confirm completion in writing, identifying retained categories, reason, location, access restrictions, and expected deletion date. The parties shall coordinate any transition assistance under [AGREEMENT CLAUSE / RATE].

8. Remedies and general terms

1. The Agreement's liability limits, indemnity, dispute procedure, and payment terms apply to this Addendum unless the parties state a specific change here: [NONE / IDENTIFY CLAUSE AND AGREED CHANGE]. This Addendum does not itself create a late-payment rate, automatic fee award, bond waiver, or guaranteed equitable remedy.
2. This Addendum is governed by Alabama law, subject to any mandatory law applicable to a particular data set or proceeding. Any forum or arbitration selection in the Agreement continues to apply unless expressly changed here: [NONE / IDENTIFY CHANGE].
3. A change to this Addendum or its schedules must be recorded in a writing accepted by both parties. Electronic signing may be used if the parties agree to that method and applicable law permits it. Counterparts together form one agreement.

Schedule A — Services, data, and shared responsibility

Schedule B — Selected security controls

Complete each applicable row with a specific standard, owner, coverage, evidence, and exception. Insert "not applicable" with a reason where a control does not fit the covered Services.

Schedule C — Subprocessors and data locations

Schedule D — Recovery, retention, and deletion

Schedule E — Alabama role and incident notice map

Complete this map for each data set involving Alabama residents. Record any other applicable law separately and have counsel confirm the resulting duties and deadlines before use.

Signatures

Customer: [CUSTOMER LEGAL NAME]
By: [AUTHORIZED SIGNATURE]
Name and title: [NAME / TITLE]
Date: [DATE]

Provider: [PROVIDER LEGAL NAME]
By: [AUTHORIZED SIGNATURE]
Name and title: [NAME / TITLE]
Date: [DATE]