Security Addendum

What is a security addendum?

A security addendum is the part of a contract that lists the security controls a vendor promises to keep in place. It may be called a security exhibit, security schedule, security measures or technical and organizational measures (TOMs).

It often covers access control, encryption, logging, testing, incident response, backups and staff background checks. Atlassian's Security Measures page, for example, has sections on access control, audit logging, penetration testing, incident response, encryption and personnel security.

A real change we caught

Venpo flagged a change in which Splunk took background checks out of two security exhibits. A single deleted control in a security exhibit can change what you can tell your own customers about the people who handle their data.

Why it matters to you

The difference that matters is binding versus marketing. A security addendum that is part of your contract is a promise. A security marketing page is a description.

• Binding. Atlassian's agreement says Atlassian implements a security program "as described in its Security Measures," and lists Security Measures among the Policies that make up the Agreement (sections 4.2 and 21). Its DPA also points to the same page (Atlassian DPA, section 3.1).
• Not binding by itself. HubSpot's public security page describes encryption, hosting and compliance reports, but it does not say it is part of the customer agreement. It points to the terms of service and DPA for the binding terms (HubSpot security page).
• It can still change. A linked security page can be updated. Atlassian's agreement lets it modify its Policies, which include Security Measures (section 20.9). Salesforce warrants it will not materially decrease the overall security of its services during a subscription term (section 8.2), which sets a floor.
• Your promises. When you answer a security questionnaire for your own customers, you rely on what your vendors promise. If a control is removed, your answers may need to change.

What to check

• Find out whether the vendor's security measures are in the contract, the DPA or only on a marketing page.
• Save a dated copy of the security addendum when you sign.
• Look for a promise not to reduce overall security during your term.
• Check the incident response section: how fast the vendor will tell you about a security incident and what it will share.
• Compare the listed controls with the vendor's SOC 2 report and ask about any gaps.

How Venpo helps

Security addenda and security measures pages are often linked documents that can change. Venpo monitors those public pages along with vendors' DPAs and terms, and emails you a plain-English alert when a control is added or removed, as with Splunk's background checks.