Effective October 19, 2026
HYLAND CUSTOMER DATA SECURITY ATTACHMENT
1. DEFINITIONS
All capitalized terms used in this Customer Data Security Attachment (“Attachment”) shall have the meaning ascribed to them in this Attachment or, if not defined in this Attachment, elsewhere in the Agreement. In the event a term is defined in two (2) or more places in the Agreement, the term shall be given the meaning defined in each part of the Agreement with respect to that part of the Agreement.
“Security Incident” means an actual event of disclosure of unencrypted Customer Data to an unauthorized person or entity that compromises the confidentiality, integrity, or availability of Customer Data.
“Security Inquiry” means any Customer initiated request to review, assess, or obtain information relating to Hyland’s security controls applicable to the Cloud Services, including without limitation security assessments, audits, questionnaires, guided reviews, or similar requests made for the purpose of verifying Hyland’s security posture. Security Inquiries do not include requests related to any actual or suspected Security Incident, which are addressed separately under this Attachment.
2. SCOPE OF THIS ATTACHMENT
This Attachment describes the administrative, technical, and organizational security controls applicable to each of the Cloud Services, as further defined by the applicable underlying service model (Software as a Service, Platform as a Service or otherwise). This Attachment is solely applicable to Customer Data and does not apply to Service Data (defined as any content that both (a) originates from, or is intended for storage or processing in, Customer’s Product and (b) is provided to Hyland by or on behalf of Customer in connection with the services, including data provided for migration, error reproduction, troubleshooting, or other support purposes) or any information or data contained in or included at Customer’s location or on Customer managed servers or hosted on servers owned and controlled by a third party on behalf of the Customer.
3. SCOPE OF RESPONSIBILITY
3.1 Hyland’s responsibilities under this Attachment are limited to the systems, software, services components, and processes that it provides to process Customer Data.
3.2 Hyland is not responsible for any systems, software, services or components not provided by Hyland. In particular, the Customer is responsible for any Customer owned, operated or supplied network devices, network connectivity, workstations, servers, software, or systems, including those supplied or operated by third parties for the Customer.
3.3 Hyland is not responsible for the Customer’s own use of the Cloud Services, including Customer managed in-application configurations, role and permission assignments, and third-party integration or external systems that are enabled, configured, or controlled by Customer. Accordingly, Hyland is only responsible for processes or those parts of processes performed as part of the Cloud Services to the extent executed by Hyland employees or Hyland authorized third parties.
4. SECURITY GOVERNANCE AND RISK MANAGEMENT
4.1 Organization of Information Security. Hyland maintains a formal information security program aligned with industry-recognized frameworks, such as ISO 27001. This program establishes defined roles, responsibilities, and oversight mechanisms for the protection of Hyland’s information assets. Security responsibilities are assigned to qualified personnel and cross-functional teams, including information security, legal, compliance, and IT, to support policy lifecycle management, risk oversight, and the consistent implementation of security controls across administrative, technical, and physical domains.
Hyland maintains documented information security policies, standards, and procedures that are periodically reviewed and updated to reflect evolving business and regulatory requirements and threat landscapes. Governance activities include management oversight and reporting structures designed to support accountability and continuous improvement. Where applicable, Hyland’s control framework is subject to independent assessment and certification activities, such as ISO 27001 or SOC 2 Type II, and is designed to support compliance with applicable legal and regulatory requirements, such as data protection and privacy obligations (e.g., GDPR, HIPAA, as applicable), while being limited to areas within Hyland’s sole and reasonable control.
4.2 Risk Management. Hyland maintains a formal risk management program aligned with recognized standards. Hyland performs risk assessments at least annually, and upon significant changes, to identify and evaluate threats and vulnerabilities affecting administrative, physical, technical, legal, and regulatory safeguards relevant to Hyland’s internal operations and service delivery.
Identified risks are documented within a centralized risk register and evaluated using a defined risk methodology that considers likelihood and impact of such identified risks. Through such methodology, Hyland applies a structured risk treatment process which assigns ownership to identified risks and addresses mitigation, acceptance, transfer, or avoidance strategies, with defined remediation timelines.
Progress of the risk treatment process is monitored through established governance processes and subject to periodic review. As applicable, Hyland’s risk management program is subject to internal oversight and independent assessment, such as ISO 27001 or SOC 2 Type II, and is designed to support ongoing compliance with applicable security and privacy requirements.
5. PERSONNEL AND ORGANIZATIONAL SECURITY
5.1 Human Resources Security. Hyland maintains personnel security practices aligned to industry standards, such as ISO 27001 and SOC 2 Type II, and is designed to support the protection of its internal corporate systems and activities. Where applicable, and in limited circumstances such as authorized support or Professional Services engagements, these practices also apply to Hyland personnel handling Customer Data. Such practices include pre-employment screening, which may include background checks or employment or reference validation, as permitted by applicable law and commensurate with the role and level of access assigned.
5.2 Confidentiality Obligations. Hyland ensures that its personnel with access to Customer Data are subject to confidentiality and nondisclosure obligations prior to being granted such access.
5.3 Security Awareness and Role Based Training. Hyland employees receive security awareness training upon hire and at least annually thereafter, aligned with industry standards, such as ISO 27001 and SOC 2 Type II, designed to provide employees with suitable information security knowledge with regard to the processing of Customer Data. Supplemental training may be provided throughout the year to Hyland employees, as appropriate to their role, risk, or as a result of changes to security requirements or practices. Hyland tracks completion of required training and administers assessments with results recorded, to measure training effectiveness.
5.4 Offboarding and Access Revocation.Hyland maintains documented policies, aligned with industry standards, such as ISO 27001, to manage Hyland personnel access to Hyland systems supporting the Cloud Services offerings, including timely onboarding, role-based access changes, and offboarding. These procedures, amongst other matters, address defined inactivity thresholds that may result in account suspension or removal, ensure timely revocation of access upon role change or termination, and provide for the recovery of applicable Hyland issued assets.
6. ASSET, ACCESS AND SYSTEM PROTECTION CONTROLS
6.1 Access Controls. Hyland maintains logical access controls, aligned with industry standards such as ISO 27001, designed to restrict access to systems supporting the Cloud Services to authorized individuals. Such controls include user provisioning based on authorization, periodic access reviews, timely removal of access upon role change or termination, use of unique user credentials, strong password requirements, and multifactor authentication. Unused ports, protocols, and services are restricted where applicable. Customers are responsible for controlling their own end-user access and permissions.
6.2 System Hardening. Hyland applies secure configuration and system hardening aligned with industry standards, such as CIS benchmarks, designed to reduce the attack surface of systems supporting Cloud Services. Such practices include maintaining documented configuration standards, disabling or removing unnecessary services and accounts, applying least-privilege principles, and managing configuration changes through established change management processes.
6.3 Network Security. Hyland implements network security controls designed to detect and prevent unauthorized access to systems that store or process Customer Data, including the use of network segmentation, firewalls, and intrusion detection or prevention mechanisms.
6.4 Malware Protection. Hyland utilizes malware protection technologies, which are configured to meet industry standards and are designed to protect Cloud Services infrastructure and equipment from virus infections or other malicious code or payloads.
7. SECURITY OPERATIONS, VULNERABILITY, AND PATCH MANAGEMENT
7.1 Operational Procedures. Hyland maintains documented Cloud Services operating procedures designed to support the ongoing operation, availability, and reliable performance of the Cloud Services, including activities related to service delivery, system operations, maintenance, and uptime management.
7.2 Change Management. Hyland maintains and follows documented formal change management processes aligned with industry standards, such as ISO 27001. These processes are integrated within the Hyland software development lifecycle (SDLC) and are designed to facilitate that changes are reviewed, tested in controlled environments and approved prior to release. Changes expected to impact Customer access to Cloud Services are communicated to customers through standard release and update channels. Customer is responsible for testing all configuration changes, authentication changes and upgrades implemented by Customer or Hyland. If the Customer requests that Hyland implement changes on its behalf, such request must be in writing and submitted by Customer’s designated Customer Security Administrators (“CSAs”) or other suitably authorized individual, as applicable.
7.3 Planned Changes and Maintenance. Hyland may, where practical and appropriate, make configuration changes that impact Customer access to Cloud Services during a planned maintenance window. Hyland may, in any event, make configuration changes that do not impact Customer access outside of a planned maintenance window. Notwithstanding the foregoing, Hyland may perform emergency maintenance outside of planned maintenance windows as reasonably necessary to address security vulnerabilities, system failures, or other conditions that pose an imminent risk to the availability, integrity, or security of the Cloud Services, and will provide Customer with as much prior notice as is reasonably practicable under the circumstances. This may include implementation of updates, upgrades, patches, or modifications to the Cloud Services and any systems and components supporting the Cloud Services (including, but not limited, to, any applications, services, supporting software, or platforms), (collectively “Security Updates”). Customer shall cooperate with Hyland in connection with the implementation of all Security Updates, including by (a) installing or permitting installation of any required client-side components within the timeframe reasonably specified by Hyland, (b) providing reasonable access to Customer's systems and environments as necessary for Hyland to implement the Security Update, and (c) promptly responding to Hyland's requests for information or action related to such Security Updates.
7.4 Logging and Monitoring. Hyland maintains logging and monitoring controls for systems supporting the Cloud Services that capture security-relevant events. Logs are centralized in a security information and event management (SIEM) system and analyzed as part of Hyland’s security operations to identify potential threats. Logs are retained for a period of one (1) year and are reviewed periodically.
7.5 Vulnerability and Patch Management. Hyland maintains a security vulnerability management program for systems, infrastructure, and other components of the Cloud Services that are within Hyland's operational control. Vulnerability identification is performed continuously through automated scanning, code analysis, and other methodologies appropriate to the applicable service and deployment model. Identified vulnerabilities are evaluated and prioritized using a risk-based severity assessment consistent with industry standards and Hyland's security practices.
Identified vulnerabilities are reviewed and prioritized based on factors including but not limited to: (a) the reachability, exploitability, and potential impact of the vulnerability; and (b) the availability of remediation measures, including patches, updates, configurations, or other corrective actions provided by Hyland or applicable third-party vendors. For vulnerabilities affecting components within Hyland's direct operational control, Hyland shall undertake remediation on a commercially reasonable basis, taking into account the assessed risk and the availability of appropriate remediation measures. For vulnerabilities affecting third-party software, services, infrastructure, or other external dependencies, Hyland shall work with the applicable vendor or service provider to obtain available remediation and may implement commercially reasonable workarounds or compensating controls, where appropriate, until such remediation becomes available.
The responsibility for applying vulnerability patches and updates for Software varies depending on the applicable deployment model. Where Hyland makes official patches or updates available for Software that is hosted within a Hyland-managed environment (including, but not limited to OnBase, Alfresco, Perceptive Content, Brainware and/or Nuxeo Products), Customer shall be responsible for applying such patches or updates to its Software instance following notification by Hyland of their availability. Such notification can be provided through a secure Hyland website (currently, https://community.Hyland.com). For Hyland-managed cloud-native services (including Content Innovation Cloud (CIC)), Hyland shall be responsible for applying such patches or updates to such services. Subject to Section 7.3, Hyland shall provide Customer with reasonable notice and supporting documentation regarding available patches, including any known impacts or dependencies associated with their application.
For clarity, this vulnerability management process applies only to the components of the Cloud Services that are within Hyland's operational control and does not expand Hyland's obligations with respect to customer-managed systems, environments, or software deployment activities.
7.6 Penetration Testing. Hyland conducts penetration testing for systems supporting the Cloud Services that are within Hyland’s operational control. Such testing is performed at least annually in accordance with Hyland’s internal security practices and is intended to identify and assess potential security weaknesses. Identified findings are evaluated and addressed in accordance with Hyland’s vulnerability management and remediation processes. Testing is performed against supported current versions of the Cloud Services; Hyland’s standard practice is to include the latest version within twelve (12) months of its release, and testing may not extend to prior or legacy versions.
8. ENCRYPTION
8.1 Encryption in Transit. Customer Data transmitted across public networks is encrypted using industry standard transport encryption protocols, such as TLS 1.2 or greater.
8.2 Encryption at Rest. Customer Data stored by Hyland is encrypted at rest using industry standard encryption algorithms (AES-256 at a minimum).
8.3 Key Management. Encryption keys are stored securely and managed in accordance with Hyland’s internal key management practice. These controls include: (a) secure generation, storage, and protection of keys using centralized key management systems; (b) restricted access based on least privilege, with role-based controls, segregation of duties, and audit logging; and (c) periodic key rotation aligned to industry practices and risk considerations to reduce the impact of potential key compromise.
9. DATA HANDLING AND PROTECTION
9.1 Processing of Customer Data. Hyland processes Customer Data solely in accordance with the Agreement or as otherwise agreed upon by the parties in writing, unless otherwise required by applicable law.
9.2 Personal Data Protection Obligations. Hyland implements administrative, technical, and organizational measures designed to protect Personal Data against unauthorized or unlawful access, disclosure, alteration, loss, or destruction, consistent with applicable data protection and privacy laws and as agreed between the parties in the Global Data Processing Schedule.
9.3 Retention and Deletion. The Customer is responsible for managing its own retention of Customer Data through the use of Cloud Services. Hyland will, in any event, itself only retain Customer Data for the duration necessary to perform the Cloud Services in accordance with the Agreement and applicable service specifications and, where applicable, to comply with statutory law and regulations applicable directly to Hyland. Upon termination or expiration of the Cloud Services, and subject to applicable service specifications, Hyland will securely return or delete Customer Data in accordance with Hyland’s internal data handling practices, unless retention is required by law.
10. PHYSICAL AND OPERATIONAL SECURITY
10.1 Physical Security Controls. Hyland implements and maintains physical security controls designed to protect systems and infrastructure supporting Cloud Services, where such infrastructure is operated by or on behalf of Hyland. In providing Cloud Services, Hyland utilizes data centers and third-party service providers that have demonstrated compliance with one or more of the following standards, or a reasonable equivalent: ISO 27001 and/or SOC 2 Type II.
11. CONTINUITY, BACKUP AND RESILIENCE
11.1 Business Continuity and Disaster Recovery. Hyland maintains documented business continuity and disaster recovery practices designed to (a) support the availability and resilience of the Cloud Services and (b) help protect Customer Data from loss or destruction due to disruptive events. Such practices are designed to support the continuity of Hyland's internal business functions and are maintained, reviewed and tested in alignment with industry recognized standards, including ISO 27001 and SOC 2 Type II, and Hyland's internal governance processes. A summary of Hyland’s Corporate Business Continuity Plan is available to customers via Hyland’s Trust Center.
11.2 Backup and Recovery. Hyland maintains backup and recovery controls for systems supporting the Cloud Services that are within Hyland’s operational control. Backup and recovery practices are designed to support service restoration in the event of disruption and are implemented in accordance with applicable service specifications.
11.3 Data Replication. The above procedures include replication of Customer Data to a secondary location.
11.4 Testing. Hyland periodically tests elements of its business continuity and disaster recovery capabilities consistent with industry standards and Hyland’s internal practices. Testing activities are intended to validate the effectiveness of recovery procedures and support continuous improvement of resilience controls. Such tests are evaluated as part of Hyland’s annual audit processes.
11.5 Service Disruptions. In the event of a service disruption affecting the Cloud Services, Hyland will take reasonable steps to restore service availability in accordance with the Agreement and applicable service specifications.
12. SECURITY INCIDENT RESPONSE
12.1 Security Incident Response Program. Hyland maintains a documented incident response program designed to identify, assess, contain, respond to, and remediate Security Incidents affecting the Cloud Services. The incident response program is maintained in accordance with Hyland’s internal governance practices and is intended to reduce the potential impact of Security Incidents on Cloud Services and Customer Data.
12.2 Security Incident Handling. Security Incidents are evaluated and managed in accordance with Hyland’s established incident response procedures. Such procedures include activities related to incident analysis, containment, remediation, recovery, and post ‑incident review, as applicable to the nature and severity of the incident as determined by Hyland.
12.3 Notification. Hyland will notify Customer of a confirmed Security Incident within 48 hours.
12.4 Post Incident Review and Corrective Actions. Following the containment and stabilization of a Security Incident, Hyland may conduct a post incident review to identify contributing factors and determine appropriate corrective actions intended to reduce the likelihood of recurrence.
If Hyland determines that Customer Data has been adversely impacted by a Security Incident, Hyland may provide Customer with a root cause analysis summary after initial corrective actions have been implemented. Such summary will not be unreasonably delayed but may be provided after initial corrective actions have been implemented to contain the security threat or stabilize the Cloud Services.
The root cause analysis summary may include, as applicable, the duration of the event, resolution status, a high-level technical summary, any outstanding issues, and recommended follow-up actions, including corrective and/or preventive actions Customer may need to take. Information relating to the Cloud Services or Customer Data that requires additional confidentiality or security protections, including information related to other customers, will not be disclosed.
If Customer requires additional details regarding a Security Incident, Customer may submit a request to Hyland Support, which will be reviewed and handled on a case-by-case basis. The disclosure of additional information may be subject to confidentiality, security, and legal considerations, and, where necessary, may require an onsite or controlled review to protect the confidentiality and security of the information.
12.5 Coordination and Cooperation. Upon request and to the extent permitted by law, Hyland will reasonably cooperate with Customer in connection with Security Incidents impacting Customer Data, including providing relevant information regarding the incident, subject to confidentiality, security, and legal restrictions.
13. SUPPLIER MANAGEMENT
13.1 Supplier Security Requirements. Hyland requires its authorized third parties with access to Customer Data to maintain security controls that are designed to be no less protective than those described in this Attachment, as applicable to the Cloud Services provided.
13.2 Supplier Due Diligence and Risk Assessment. Hyland conducts security due diligence and risk-based assessments of its suppliers prior to onboarding and manages suppliers' security throughout the engagement lifecycle in accordance with its third-party risk management program.
14. AUDIT, ASSURANCE AND CUSTOMER SECURITY INQUIRIES
14.1 Internal Monitoring and Independent Audit Reports. Hyland monitors compliance with its information security program through periodic internal reviews. Results are reported to Hyland leadership, and identified issues are tracked through remediation in accordance with Hyland’s internal governance practices. Hyland also maintains a periodic independent audit and assurance program. Where available, industry standard audit reports, certifications and/or third-party led penetration test summaries (such as SOC2 Type II or ISO 27001) may be provided to Customer upon written request through Hyland’s Trust Center and subject to confidentiality, security, and legal restrictions.
14.2 Customer Security Inquiries. No more than once during each 12-month period, Customer may request to conduct a Security Inquiry, for the purpose of verifying Hyland’s security controls applicable to the Cloud Services. The Customer must provide Hyland with reasonable advance written notice of its desire to conduct such Security Inquiry. The proposed Security Inquiry must not overlap with, or otherwise cover the same or similar information as, or scope of:
a. any controls already provided for by an external audit, assessment or test already performed by Hyland, such as a SOC2 report, ISO 27001 or other similar audit or assessment;
b. any content already provided by Hyland through its completed SIG, CAIQ or similar standardized security questionnaires; or
c. executive summaries of externally led penetration tests performed on Cloud Services;
each of which may be made available to Customer upon Customer’s written request, on a controlled basis through Hyland’s Trust Center and subject to confidentiality, security and legal restrictions.
For each Security Inquiry, Hyland and Customer must mutually agree upon the timing, scope, and criteria of such Security Inquiry, which, subject to the foregoing, may include:
i. the completion of questionnaires supplied by Customer; and
ii. review of confidential and restricted documentation, such as Hyland internal policies, practices, and procedures, including any documentation requested by Customer that cannot be removed from Hyland’s premises as a result of physical limitations or policy restrictions will not be provided externally or removed from Hyland’s premises and such reviews must be conducted through a secure screenshare which may be arranged by Hyland to prohibit any type of copying or screen shots.
Customer understands and agrees that Hyland will not permit access to internal systems or devices used to host or support Hyland’s offerings or to Hyland’s or third party facilities.
To the extent Customer desires to engage a third party to perform such Security Inquiry, Hyland must approve of such third party in writing in advance, Customer shall cause such third party to enter into a reasonable and market-standard Non-Disclosure Agreement with Hyland and agree to abide by Hyland’s security standards, and Customer shall manage the engagement with the third party, ensuring the third party understands the scope of the Security Inquiry as mutually agreed upon between Hyland and Customer and how Customer utilizes the Cloud Services.
Customer shall pay Hyland fees (at Hyland’s standard rates) for the Professional Services (including any out-of-pocket costs and expenses) that are required or requested of Hyland in connection with such Security Inquiry.
Customer is prohibited, and Customer shall prohibit each third-party it involves in a Security Inquiry, from distributing or publishing the results of such Security Inquiry to any other party without Hyland’s prior written approval.
Nothing in this Attachment (including this section) will require Hyland or any of its affiliates to disclose information that is subject to (1) confidentiality agreements with third parties; (2) attorney-client privilege; or (3) any statutory confidentiality obligations.
The most current version of this document shall be such in effect as of 12:00am EST (Eastern Standard Time) of the date stamped on such online version.