·EN

·Amplitude Trust Center

·Welcome to Amplitude's Customer Trust Portal. Our commitment to data privacy and security is embedded in every part of our business. Use this Customer Trust Portal to learn about our security posture and request access to our security documentation. grc@amplitude.com ⌘K

·Loading content...

·Documentation

·Featured

·Amplitude AI Capabilities FAQ (Sept 2026) Amplitude's AI Settings and Controls

·Amplitude's MCP - Security and Compliance Audit Logging

·Subprocessors

·amazonwebservices.com · United States, Germany

·Cloud hosting and infrastructure provider; generative AI technology used to enhance Amplitude's AI features (AWS Bedrock). United States, Germany Datadog · United States

·Logging and operational monitoring. United States Fivetran · United States, Germany

·Cloud-based data movement platform. United States, Germany Google · United States, EU

·Generative AI technology, delivered via Google Vertex AI, used to enhance Amplitude's AI features; cloud hosting and infrastructure provider for the Statsig-branded Amplitude Services (US only). United States, EU Microsoft Azure · United States

·Cloud service Provider for the Statsig-branded Amplitude Services. United States

·Controls

·Access control

·Rigorous user authentication and authorization safeguards restrict system access to the right people at the right time Multi-factor authentication enforcement Role-based access control Least-privilege privileged access Unique user identification Quarterly independent access reviews

·Multi-factor authentication for production access Quarterly access reviews Rapid offboarding process Timely access revocation

·VPN requirement for production resources Data security

·Encryption and network protections maintain confidentiality and integrity of customer data throughout its lifecycle Encryption at rest Encryption in transit Customer data segregation Restricted access to confidential data Firewall and port restrictions Authorized application access Controlled removable media usage Portable media encryption Encryption at rest Encryption in transit Privacy and data governance

·Comprehensive policies and tooling give customers control over where, how and how long their personal data is processed Data classification Global data processing addendum Customer-driven deletion API Regulated customer data handling Regional data residency choice Confidentiality obligations Privacy by design program

·Data retention and destruction procedures Automatic data deletion Public privacy policy and DPO contact Data Privacy Framework certification HIPAA Business Associate Agreements

·Frequently asked security questions

·Is Amplitude secure?

·Amplitude operates this public trust center. It publishes 7 independent compliance certifications, security documentation available on request, and a published list of its subprocessors.

·Is Amplitude SOC 2 compliant?

·Yes. Amplitude maintains SOC 2 Type II compliance. You can review this in the compliance section of this trust center.

·Does Amplitude have ISO 27001 certification?

·Yes. Amplitude is ISO 27001 certified. You can review this certification in the compliance section of this trust center.

·Is Amplitude GDPR compliant?

·Yes. Amplitude maintains GDPR compliance. See the compliance section of this trust center for details.

·Who are Amplitude's subprocessors?

·Amplitude discloses its subprocessors in this trust center, including amazonwebservices.com, Datadog, and Fivetran. See the subprocessors section for the complete list.

·How do I request Amplitude's security documentation?

·You can request access to Amplitude's security documentation directly through this trust center. Submit an access request and the Amplitude team reviews and grants access. Contact supportReport a vulnerability

·Trust center by Wolfia: AI trust center & security questionnaire automation

·Does your team answer security questionnaires too? Wolfia answers them for you and runs trust centers

·Controls

·Access control

·Rigorous user authentication and authorization safeguards restrict system access to the right people at the right time Multi-factor authentication enforcement

·Corporate and production systems require multi-factor authentication. Role-based access control

·Access is assigned by job role to enforce consistent least-privilege access. Least-privilege privileged access

·Administrative access to systems, databases, networks, and encryption keys is limited to authorized staff with a business need. Unique user identification

·Every account has a unique ID, enabling precise accountability for all activity. Quarterly independent access reviews

·A separate team reviews privileged and standard access quarterly to enforce least privilege.

·Multi-factor authentication for production access

·Production access requires multi-factor authentication. Quarterly access reviews

·User access is reviewed at least quarterly, with required changes tracked to completion. Rapid offboarding process

·Departing personnel lose access within one business day, with the change documented. Timely access revocation

·Termination checklists ensure departing employees lose access within defined timeframes.

·VPN requirement for production resources

·Administrative access to production is available only over a company-managed VPN.

·Data security

·Encryption and network protections maintain confidentiality and integrity of customer data throughout its lifecycle Encryption at rest

·Customer data is encrypted at rest across production databases and object storage in both the US and EU regions. Encryption in transit

·Sensitive data is encrypted in transit over public networks using secure protocols. Customer data segregation

·Logical isolation keeps each customer's data separate to prevent cross-tenant leakage. Restricted access to confidential data

·Access to networks, applications, and databases is limited to authorized users. Firewall and port restrictions

·Only approved ports and protocols can reach production networks, blocking unsolicited traffic. Authorized application access

·Data access is restricted to approved applications to prevent access outside defined boundaries. Controlled removable media usage

·Workstations block external storage devices unless explicitly approved. Portable media encryption

·Portable media is encrypted to protect data if a device is lost. Encryption at rest

·Customer data is encrypted at rest in Statsig's cloud datastores. Encryption in transit

·Sensitive data is encrypted in transit over public networks, and production systems are accessed only over encrypted connections.

·Privacy and data governance

·Comprehensive policies and tooling give customers control over where, how and how long their personal data is processed Data classification

·Information is classified (public, internal, customer, and company data) so protection matches sensitivity. Global data processing addendum

·A standard data processing addendum with current EU standard contractual clauses sets privacy obligations worldwide. Customer-driven deletion API

·Self-service and API tools let customers delete user records to meet GDPR, CCPA, and similar requirements. Regulated customer data handling

·Customer data is handled in accordance with data protection requirements and customer agreements. Regional data residency choice

·Customers can choose US or EU hosting to meet data-residency requirements. Confidentiality obligations

·Employees and contractors are required to protect confidential and private information. Privacy by design program

·Privacy-by-design principles embed data minimization and consent into product development.

·Data retention and destruction procedures

·Formal policies define retention periods and secure destruction, reviewed at least annually. Automatic data deletion

·Data is automatically deleted once its retention window expires. Public privacy policy and DPO contact

·A public privacy notice and a dedicated data protection officer contact provide transparency and accountability. Data Privacy Framework certification

·Amplitude is certified under the EU-US, UK Extension, and Swiss-US Data Privacy Frameworks for lawful transfer of personal data to the United States. HIPAA Business Associate Agreements

·Amplitude builds its products in line with HIPAA privacy and security rules and can sign Business Associate Agreements with regulated customers.

·Application security

·Secure development practices and independent testing uncover and remediate vulnerabilities before they affect customers Secure development lifecycle policy

·A documented secure development lifecycle requires change tracking, testing, and approval for every code change. Secure development lifecycle

·A formal secure development lifecycle governs development, maintenance, and changes, including emergency changes. Mandatory peer code reviews

·Every code change requires review and approval by someone other than the author. Controlled production changes

·Production changes must be authorized, documented, tested, reviewed, and approved before deployment. Annual penetration testing

·Independent penetration testing is performed at least annually, with remediation plans tracked to completion. Annual third-party penetration tests

·An independent firm penetration-tests the production environment at least annually, with findings tracked to remediation. Continuous vulnerability scanning

·External-facing systems are continuously scanned for vulnerabilities, including in open-source dependencies, with critical and high findings tracked to remediation. Public bug bounty program

·A public bug bounty program invites the security community to report vulnerabilities.

·Automated dependency vulnerability scanning

·Continuous scanning flags vulnerable open-source dependencies for prompt patching. Independent retesting of remediations

·An independent retest of the 2025 assessment confirmed no outstanding vulnerabilities remained.

·Security monitoring and logging

·Continuous logging, automated detection and alerting provide rapid visibility into anomalous or malicious activity Comprehensive cloud audit logging

·Production account activity is logged, encrypted, and tamper-evident for audits and investigations. Centralized log management

·Centralized log management helps identify and investigate security-relevant events. Network and security logging

·Network flow, router, and firewall logs support monitoring and security review. Network flow and load balancer logs

·Network flow and load balancer logs support threat detection and firewall validation.

·Automated anomaly detection with on-call alerting

·Real-time monitoring alerts on-call engineers to high-severity events 24/7.

·Continuous infrastructure monitoring and alerting

·Infrastructure and performance are continuously monitored, with alerts on predefined thresholds.

·Quarterly independent access log reviews

·Access to sensitive logs is reviewed quarterly to confirm only authorized staff can view it. Continuous application monitoring

·Applications, databases, and cloud storage are monitored to keep service delivery within commitments. Continuous control monitoring platform

·Automated tooling continuously tracks the status of internal controls to surface gaps early. Intrusion detection

·Intrusion detection continuously monitors the network for potential breaches.

·Incident response

·Documented, tested procedures ensure swift containment, resolution and learning from security incidents Formal incident response plan

·A documented plan defines roles, escalation paths, and communications for security events. Incident response plan

·A documented plan guides staff in reporting and responding to security and privacy incidents. Incident reporting channels

·Customers report suspected breaches via support channels; staff report through an internal portal for tracking. Automatic paging for critical incidents

·Critical events automatically page on-call staff to speed acknowledgment and resolution. Post-incident root cause analysis

·Every incident ends with a root-cause analysis and corrective actions shared with engineering. Annual incident response testing

·The incident response plan is tested at least annually to maintain readiness. Annual incident response exercises

·Annual tabletop drills test incident response readiness and surface improvements. Incident tracking and notification

·Incidents are logged, tracked, resolved, and communicated to affected parties per documented procedures. Security breach response training

·Responsible staff are trained to identify and respond to suspected security incidents.

·Business continuity and disaster recovery

·Redundant architecture, robust backups and tested plans protect availability and facilitate rapid recovery

·Business continuity and disaster recovery plan

·Documented business continuity and disaster recovery plans support recovery from disruptions.

·Disaster recovery and business continuity plans

·Documented disaster recovery and business continuity plans define roles and recovery steps for major disruptions. Annual disaster recovery testing

·The recovery plan is tested at least annually through tabletop exercises. Automatic daily database backups

·Production databases are backed up daily and retained for 30 days. Customer data backups

·Customer data is backed up to support recovery and service continuity.

·Point-in-time recovery for key datastores

·Continuous backups allow point-in-time recovery to any second within the last 35 days.

·Backup monitoring and exception handling

·Backups are monitored for completion, and exceptions are troubleshot and rerun.

·Annual failover and backup restoration tests

·Recovery procedures and backups are tested each year to confirm they work when needed. Continuity communication planning

·Continuity plans include communication procedures for when key personnel are unavailable.

·Employee security

·Hiring, training and endpoint protections cultivate a security-minded workforce and resilient devices Pre-employment background checks

·Employees and contractors are screened, as permitted by local law, before accessing confidential data. Security awareness training

·Employees complete security awareness training within 30 days of hire and at least annually thereafter. Code of conduct acknowledgment

·New employees acknowledge the code of conduct at hire. Mandatory code of conduct acceptance

·All personnel attest to a code of conduct that includes information security obligations. Employee confidentiality agreements

·Personnel sign confidentiality agreements during onboarding. Managed device encryption and hardening

·Company laptops enforce disk encryption, strong passwords, and automatic lockout. Managed endpoint security

·Company laptops are managed via MDM with standard security baselines, and unauthorized software installation is blocked. Endpoint malware protection and updates

·Employee devices run malware protection and receive current operating system and security updates.

·Vendor management

·Structured oversight of third-party providers reduces supply-chain and compliance risk Third-party risk management program

·A formal program governs how vendors are evaluated, approved, and monitored. Vendor risk management policy

·A formal program classifies vendors by risk and sets due-diligence requirements. Annual compliance report reviews

·Critical vendors' security and privacy attestations are reviewed annually to confirm ongoing compliance. Vendor due diligence

·New providers undergo due diligence covering security, privacy, compliance, financial viability, and performance. Published subprocessor list

·A published subprocessor list lets customers track third parties, for which Amplitude remains contractually responsible. Critical vendor inventory

·An inventory of critical third parties supports oversight of the most important vendors. Annual vendor reviews

·Critical third parties are reviewed at least annually against organizational requirements. Cybersecurity insurance coverage

·Dedicated cyber insurance helps limit the financial impact of a significant security incident. Vendor confidentiality commitments

·Vendor agreements include confidentiality obligations before information is shared.

·Compliance and governance

·Independent attestations and board-level oversight demonstrate a mature, well-governed security program SOC 2 Type II certification

·An annual independent SOC 2 Type II audit covers security, availability, and confidentiality. SOC 2 Type II audit

·An independent SOC 2 Type II audit examined the design and operating effectiveness of security controls over a defined period. GDPR and CCPA compliance commitments

·Amplitude contractually commits to GDPR, CCPA, and other key privacy regulations. Annual security risk assessments

·Risk assessments are performed at least annually, covering operational, strategic, compliance, fraud, environmental, regulatory, and technological risks. AI usage governance policy

·Internal policies govern the responsible, secure use of AI across the company. Board cybersecurity oversight

·The board or a subcommittee is briefed on cybersecurity risk at least annually.

·Board audit committee cybersecurity oversight

·A board-level committee reviews security and privacy risk at least twice a year. Annual control self-assessments

·Control self-assessments are performed at least annually to confirm controls operate effectively. Annual policy review

·Information security policies are documented and reviewed at least annually. ISO/IEC 27001 certification

·Amplitude maintains an ISO/IEC 27001-certified information security management system, extended with ISO/IEC 27017 for cloud security and 27018 for personal data protection. SOC 1 Type 2 report

·An independent SOC 1 Type 2 report covers controls relevant to financial reporting. AI provider data-use restrictions

·Amplitude contractually prohibits its AI providers from using customer data to train or improve their models. Human oversight for agentic AI

·Agentic AI features require explicit human approval for consequential actions, respect each user's existing permissions, and give administrators visibility into agent activity.

·Infrastructure security

·Layered technical safeguards defend the production environment against unauthorized access and disruption Cloud infrastructure hosting

·Production runs in cloud data centers, with physical security managed by the hosting provider. Environment segmentation

·Development, testing, and production are separated to limit the blast radius of any compromise. Firewall protection

·Firewalls block unauthorized access, with rulesets reviewed at least annually. Web application firewall

·A web application firewall filters malicious traffic before it reaches the application. Network segmentation

·The network is segmented to help prevent unauthorized access to customer data. Load-balanced multi-zone architecture

·Traffic is load-balanced across multiple availability zones for resilience against single-point failures. Bastion-only SSH access

·Public SSH is blocked; administrators reach production only through a hardened bastion host. Configuration and hardening standards

·Documented configuration and hardening standards follow industry best practices and are reviewed at least annually. Routine patch management

·Infrastructure is patched through routine maintenance and in response to identified vulnerabilities.

·Documentation

·Featured

·Amplitude AI Capabilities FAQ (Sept 2026) Amplitude's AI Settings and Controls

·Amplitude's MCP - Security and Compliance Audit Logging

·Certifications

·Amplitude SOC 2 Type II Report - 2026-2027 Statsig - SOC 2 Bridge Letter

·SOC 1 Type 2 Report - Valid through October 2026 Statsig - SOC 2 Type II Report

·Statsig - SOC 2 Type II Confirmation Letter

·Amplitude SOC 2 Type II Bridge Letter (2026)

·Smith+Howard PC - SOC 2 Engagement Letter (May 2026)

·Amplitude ISO/IEC 27001 Certificate (2026-2027)

·Security

·AI Penetration Testing Response

·Amplitude AI Penetration Testing Report - February 2026 Amplitude Pentest Report - January 2026 Amplitude Data Flow Diagram Statsig - Pentest Re-Assessment Report Audit Logging

·AI

·Amplitude AI Capabilities FAQ (Sept 2026) Amplitude's AI Settings and Controls

·Amplitude's MCP - Security and Compliance

·Policies

·Disaster Recovery and Business Continuity Policy

·Privacy & Legal

·Amplitude MSA Amplitude DPA Amplitude Security, Privacy, and AI Amplitude Privacy Notice Subprocessor List Privacy FAQs Amplitude & HIPAA EU-US Data Privacy Framework FAQ DORA FAQ DORA Addendum Certificate of Liability Insurance

·General Corporate Information

·Amplitude - Certificate of Incorporation Amplitude's Leadership Team and Board Corporate Structure Code of Business Conduct Corporate Governance Guidelines

·UK Modern Slavery Act Transparency Statement Human Rights Policy Supplier Code of Conduct Amplitude SEC Filing Details

·Tax and Billing Information

·W-9 Form Amplitude Tax Residency Certificate

·amazonwebservices.com · United States, Germany

·Cloud hosting and infrastructure provider; generative AI technology used to enhance Amplitude's AI features (AWS Bedrock). United States, Germany Datadog · United States

·Logging and operational monitoring. United States Fivetran · United States, Germany

·Cloud-based data movement platform. United States, Germany Google · United States, EU

·Generative AI technology, delivered via Google Vertex AI, used to enhance Amplitude's AI features; cloud hosting and infrastructure provider for the Statsig-branded Amplitude Services (US only). United States, EU Microsoft Azure · United States

·Cloud service Provider for the Statsig-branded Amplitude Services. United States MongoDB · United States

·Database provider for the Statsig-branded Amplitude Services. United States OpenAI · United States, EU

·Generative AI technology used to enhance Amplitude's AI features. United States, EU

·Snowflake · United States, Germany (for AI Feedback only)

·Data warehousing services (if Customer has purchased an applicable add-on service or is using AI Feedback).

·United States, Germany (for AI Feedback only) Wiz · United States, Germany

·Security vulnerability management and detection. United States, Germany

·Loading content...

·Updates

·DORA Addendum

·Effective: September 10, 2025

·This Digital Operational Resilience Act ("DORA") Addendum ("DORA Addendum") is incorporated into and forms part of the Main Service Agreement which governs Customer's use of Amplitude Services ("Agreement"). To the extent that there is any conflict between the terms of the DORA Addendum and any other terms of the Agreement, the DORA Addendum will prevail.

·This DORA Addendum will apply to the extent Customer is subject to DORA.

11. Definitions

·Capitalized terms that are used but not defined in this DORA Addendum have the meanings given to them in the Agreement.

·"Agreement" means the Main Service Agreement or other agreement between Customer and Amplitude which governs Customer's use of the Amplitude Services and Customer's Order Form(s).

·"DORA" means Regulation (EU) 2022/2554 on digital operational resilience for the financial sector.

·"Financial Entity" means an entity captured by Art. 2(2) DORA and which is not excluded from the scope of DORA by Art. 2(3) or 2(4) DORA, for so long as such an entity remains subject to DORA.

·"ICT Incident" has the meaning given to "ICT-related Incident" in DORA.

·"ICT Service" has the meaning given in DORA.

·"Personal Data" has the meaning set out in the Data Processing Addendum between the parties.

·"Regulator" means a government, regulatory body, or competent authority with binding authority to regulate Customer's activities as a Financial Entity, or resolution authority with respect to Customer.

22. Agreement to DORA's Key Contractual Provisions

·The Parties hereby agree that the provisioning of Amplitude Services is subject to the following key contractual provisions as set forth in Article 30(2) of DORA (Key Contractual Provisions). The Parties further agree that Amplitude Services do not constitute an ICT service supporting critical or important functions within the meaning of DORA and are not subject to the contractual obligations set forth in Article 30(3) of DORA.

AA. Description of all functions and ICT services - Art. 30(2)(a). All functions and services are described and set forth in the applicable Agreement and Order Form.

BB. Service Location - Art. 30(2)(b). The locations where Amplitude Services are provided, the Amplitude subprocessor functions and location of the ICT services are set forth at https://amplitude.com/subprocessor-list.

CC. Availability, Authenticity, Integrity, and Confidentiality of Customer Data - Art. 30(2)(c). As set forth in Annex II of the Data Processing Addendum between Amplitude and Customer, Amplitude will employ and maintain security protections in accordance with industry standards, including but not limited to technical and organizational measures to protect the availability, authenticity, integrity, and confidentiality of Customer Data.

DD. Access, recovery and return in an easily accessible format of Customer Data - Art. 30(2)(d). In the event of a Amplitude insolvency, resolution in bankruptcy, or discontinuation of Amplitude's business that results or is reasonably likely to result in termination of Amplitude Services pursuant to the Agreement, or any termination of the Agreement, Amplitude will provide reasonable assistance to access, recover and retrieve Customer Data in the orderly transition away from Amplitude Services.

EE. Service Level Descriptions - Art. 30(2)(e). Amplitude shall monitor the availability of Amplitude Services and shall document records of such availability at https://status.amplitude.com. Amplitude shall notify Customer of any events that have a material impact on the availability of Amplitude Services. Customer may subscribe to receive updates whenever Amplitude creates, updates or resolves an incident by clicking on the subscribe button on https://status.amplitude.com/.

FF. Assistance in the Event of ICT Incident - Art. 30(2)(f). If Amplitude becomes aware of an ICT Incident, Amplitude will promptly notify Customer without undue delay Amplitude shall promptly take reasonable steps to investigate, identify the cause of an ICT Incident, mitigate and remediate any ICT Incident,. Amplitude's notice to Customer shall include, but not be limited to, the nature and consequences of the ICT Incident, the measures taken and/or proposed by Amplitude to mitigate or contain the ICT Incident, the status of Amplitude's investigation, and the categories and approximate number of data records concerned. Communications by or on behalf of Amplitude in connection with a ICT Incident are not an acknowledgement by Amplitude of fault or liability with respect to the ICT Incident.

GG. Cooperation - Art. 30(2)(g). Taking into account the nature of Amplitude Services and the information provided by Customer to Amplitude, Amplitude shall fully cooperate with the competent authorities and the resolution authorities of Customer.

HH. Termination Rights - Art. 30(2)(h) and Art. 28(7).

• 11. The periods for notice of termination specified in the Agreement shall remain unaffected.
• 22. In addition to any rights of termination described in the Agreement, in the following circumstances, Customer may terminate the Agreement with respect to Amplitude Services by providing written notice to Amplitude:
• ·a. where Amplitude is in material breach of its contractual obligations under the Agreement and where Amplitude fails to correct any such violation within thirty (30) calendar days of Amplitude's receipt of notice from Customer specifying such violation in sufficient detail for Amplitude to understand Customer's concern and demanding correction;
• ·b. where Customer provides Amplitude with evidence in writing of weaknesses pertaining to Amplitude's overall ICT risk management and in particular in the way Amplitude ensures the availability, authenticity, integrity and confidentiality of Customer Data (whether personal or otherwise sensitive data, or non-personal data) and Amplitude fails to take reasonable steps to remediate such weaknesses within thirty (30) calendar days of Amplitude's written receipt of notice from Customer specifying such evidenced weaknesses in sufficient detail for Amplitude to understand Customer's concerns and to demand correction; or
• ·c. where Customer Regulator can no longer effectively supervise Customer as a result of the conditions of, or circumstances related to, the contractual arrangements between Amplitude and Customer concerning Amplitude Services and such Customer Regulator instructs Customer to terminate the Agreement with respect to such Service. When exercising termination rights under this clause 2(H)(2)(c), Customer must provide Amplitude with reasonable evidence of such Customer Regulator instruction.

II. Training - Art 30(2)(i). Upon written request by Customer, Amplitude may provide Customer with details regarding Amplitude's own security awareness programs and digital operational resilience training appropriate for the purpose of Art. 13(6) of DORA. Where additional training is required, Customer may, subject to mutually agreed terms, request Amplitude to participate in Customer's virtual security awareness programs or digital operational resilience training where appropriate.

33. Costs & Fees on Termination

·In order to receive assistance from Amplitude in connection with the exercise of the following rights, the Customer agrees to pay fees, costs, and expenses for such assistance as reasonably determined by Amplitude and such fees may be set out in a separate statement of work:

• 2Section 2(D). (Data recovery);
• 2Section 2(F). (Assistance with an ICT Incident) for assistance beyond the scope of Amplitude Services Agreement (any additional assistance and associated costs beyond the scope of the Agreement to be determined ex-ante (in advance) and mutually agreed by the parties); and
• 2Section 2(I). (Training).

·Except in circumstances where Customer terminates under Section 2(H)(2) all fees with respect to the then current subscription term for Amplitude Services that Amplitude provides shall be immediately due and payable by Customer to Amplitude on termination.

44. Miscellaneous

AA. Governing law. This DORA Addendum shall be governed by the laws of, and the parties agree to submit to the courts of, the same jurisdiction as set forth in the Agreement.

BB. Conflicts. For purposes of this Addendum, the rights and obligations of the parties in this DORA Addendum are in addition to, and not in replacement of, the rights and obligations of the parties in the Agreement. In the event of a conflict between this Addendum and other provisions of the Agreement, this Addendum will prevail with respect to Amplitude Services that constitutes ICT Services under DORA, except that the Data Processing Addendum will control with respect to Personal Data as specified therein. Except as amended and supplemented by this Addendum, the Agreement will remain in full force and effect.

CC. Termination. This DORA Addendum shall automatically terminate with respect to any such services when the term of such services terminates or expires pursuant to the Agreement.

DD. References for Convenience. References in the clause and section headings of this Addendum to articles of DORA are for convenience only and shall have no impact on interpretation of the relevant clause or section of this Addendum.

EE. Updates to DORA. Where a provision of DORA or delegated legislation made pursuant to DORA is superseded, invalidated or replaced by law or regulation, the Addendum shall be updated accordingly.

55. Previous DORA Addendum Version

·June 10, 2025