Data Processing Addendum

This Data Processing Addendum (this “DPA”) is entered into by and between Functional Software, Inc. d/b/a Sentry (“Sentry”, “we”, or “us”) and the party that electronically accepts or otherwise agrees or opts-in to this DPA (“Customer”, or “you”). This DPA is effective as of the date electronically agreed and accepted by you.

You have entered into one or more agreements with us (each, as amended from time to time, an “Agreement”) governing the provision of our real-time error tracking, crash reporting, application monitoring, and visibility service more fully described at www.sentry.io (the “Service”). This DPA will amend the terms of the Agreement to reflect the parties’ rights and responsibilities with respect to the processing and security of Customer Data (as defined below) under the Agreement. If you are accepting this DPA in your capacity as an employee, consultant or agent of Customer, you represent that you are an employee, consultant or agent of Customer, and that you have the authority to bind Customer to this DPA.

Any capitalized terms not defined in this DPA shall have the meanings set forth in the Agreement.

1. Definitions.

   The following definitions apply to this DPA:

   “Customer Data” means data you submit to, store on, or send to us via the Service.

   “Data Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data on systems that are managed and controlled by Sentry. Data Incidents will not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including, without limitation, pings, port scans, denial of service attacks, network attacks on firewall or networked systems, or unsuccessful login attempts.

   “Europe” means, for the purposes of this DPA, the member states of the European Economic Area, Switzerland and the United Kingdom.

   “European Data Protection Legislation” means the data protection and privacy laws and regulations enacted in Europe and applicable to the Personal Data in question, including as applicable: (i) the GDPR; (ii) the Swiss Federal Data Protection Act of 19 June 1992 and its Ordinance (“Swiss DPA”); and/or (iii) in respect of the United Kingdom, the GDPR as it forms part of UK law by virtue of Section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”) and the Data Protection Act 2018; in each case as may be amended, superseded or replaced from time to time.

   “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

   “Notification Email Address” means the email address(es) that you designate to receive notifications when you create an account to use the Service. You agree that you are solely responsible for ensuring that your Notification Email Address is current and valid at all times.

   “Personal Data” means any personal data or personal information (as those terms are defined by Privacy Laws, as applicable) contained within Customer Data.

   “Privacy Laws” means: (i) European Data Protection Legislation; and (ii) the data protection and privacy laws and regulations enacted in the jurisdictions set forth in Schedule 3 to the extent applicable to the processing of Personal Data under the Agreement.

   “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses as approved by the European Commission pursuant to its decision 2021/914 of 4 June 2021.

   “Subprocessor” means a third party that we use to process Customer Data in order to provide parts of the Service and/or related technical support. For the avoidance of doubt, the term Subprocessor may include Sentry affiliates or other third parties but does not include Sentry employees or contractors.

   “Term” means the term of the Agreement.

   “UK Addendum” means the International Data Transfer Addendum (version B1.0) issued by the Information Commissioner’s Office under s.119(A) of the UK Data Protection Act 2018, as may be amended, superseded or replaced from time to time.

   The terms “personal data”, “special categories of personal data”, “data subject”, “process”, “processing”, “controller”, “processor” and “supervisory authority” have the meanings given in European Data Protection Legislation or, if not defined therein, the GDPR.

2. Data Processing.

   1. Roles and Regulatory Compliance; Authorization.

      1. Scope of this DPA. Except as set forth in Section 10, this DPA applies where and only to the extent Sentry processes Personal Data as a processor for the purposes of European Data Protection Legislation.

      2. Roles and Responsibilities. The parties acknowledge and agree that: (i) Sentry will process the Personal Data as described in Schedule 1; (ii) for the purposes of European Data Protection Legislation, Sentry is a processor of Personal Data and Customer is the controller (or a processor acting on behalf of a third party controller); and (iii) each of us will comply with our obligations under Privacy Laws with respect to the processing of Personal Data.

      3. Authorization by Third Party Controller. If you are a processor of Personal Data acting on behalf of a third party controller: (i) you warrant to us that your instructions and actions with respect to that Personal Data, including your appointment of Sentry as another processor, have been authorized by the relevant controller; and (ii) you will serve as our sole point of contact and where we would otherwise be required (including for the purposes of the Standard Contractual Clauses) to provide information, assistance or cooperation to or seek authorization from any such third party controllers, we may provide such information, assistance or cooperation to or seek such authorization from you.

   2. Customer responsibilities.

      1. Customer Authorization. Sentry shall process Personal Data in accordance with Customer’s documented lawful instructions. By entering into this DPA, you hereby authorize and instruct us to process Personal Data: (i) to provide the Service, and related technical support; (ii) as otherwise permitted or required by your use of the Service and/or your requests for technical support; (iii) as otherwise permitted or required by the Agreement, including this DPA; and (iv) as further documented in any other written instructions that are agreed by the parties. We will not process Personal Data for any other purpose, unless required to do so by applicable law or regulation. The parties agree that the Agreement (including this DPA), and your use of the Service in accordance with the Agreement, set out your complete and final processing instructions and any processing outside the scope of these instructions (if any) shall require prior written agreement between the parties. Customer shall ensure its instructions are lawful and that the processing of Personal Data in accordance with such instructions will not violate Privacy Laws. Notwithstanding the foregoing, if you are a processor of Personal Data acting on behalf of a third party controller then where legally required we are entitled to follow the instructions of such third party controllers with respect to their Personal Data.

      2. Prohibition on Sensitive Data. You will not submit, store, or send any sensitive data or special categories of personal data (collectively, “Sensitive Data”) to us for processing, and you will not permit nor authorize any of your employees, agents, contractors, or data subjects to submit, store, or send any Sensitive Data to us for processing. You acknowledge that we do not request or require Sensitive Data as part of providing the Service to you, that we do not wish to receive or store Sensitive Data, and that our obligations in this DPA will not apply with respect to Sensitive Data.

3. Deletion.

   1. Deletion During Term.

      We will enable you to delete Personal Data during the Term in a manner that is consistent with the functionality of the Service. If you use the Service to delete any Personal Data in a manner that would prevent you from recovering Personal Data at a future time, you agree that this will constitute an instruction to us to delete Personal Data from our systems in accordance with our standard processes and applicable law. We will comply with this instruction as soon as reasonably practicable, but in all events in accordance with applicable law.

   2. Deletion When Term Expires.

      When the Term expires, we will destroy any Personal Data in our possession or control. This requirement will not apply to the extent that we are required by applicable law to retain some or all of the Personal Data, in which event we will isolate and protect the Personal Data from further processing and delete in accordance with Sentry’s deletion practices, except to the extent required by law. You acknowledge that you will be responsible for exporting, before the Term expires, any Personal Data you want to retain after the Term expires.

4. Data Security.

   1. Security Measures.

      We will implement and maintain appropriate technical and organizational measures to protect Personal Data against Data Incidents and to preserve the security and confidentiality of Personal Data, as described in Schedule 2 (collectively, the “Security Measures”). Sentry shall ensure that any person who is authorized by Sentry to process Personal Data shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty). Customer acknowledges that Security Measures are subject to technical progress and development and that accordingly we may update or modify the Security Measures from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Service.

   2. Data Incidents.

      Upon becoming aware of a Data Incident, we will notify you promptly and without undue delay, and will take reasonable steps to minimize harm and secure Personal Data. Any notifications that we send you pursuant to this Section 4.2 will be sent to your Notification Email Address and will describe, to the extent possible and/or known to Sentry, the details of the Data Incident, the steps we have taken to mitigate the potential risks, and any suggestions we have for you to minimize the impact of the Data Incident. We will not assess the contents of any Personal Data in order to identify information that may be subject to specific legal requirements. You are solely responsible for complying with any incident notification laws that may apply to you, and to fulfilling any third-party notification obligations related to any Data Incident(s). Our notification of or response to a Data Incident under this Section will not constitute an acknowledgement of fault or liability with respect to the Data Incident.

   3. Your Security Responsibilities.

      You agree that, without prejudice to our obligations under Sections 4.1 or 4.2, you are solely responsible for your use of the Service, including making appropriate use of the Service to ensure a level of security appropriate to the risk in relation to Customer Data, securing any account authentication credentials, systems, and devices you use to use the Service, and backing up your Customer Data. You understand and agree that we have no obligation to protect Customer Data that you elect to store or transfer outside of our or our Subprocessors’ systems (e.g., offline or on-premise storage). You are solely responsible for evaluating whether the Service and our commitments under this Section 4 meet your needs, including with respect to your compliance with any of your security obligations under Privacy Laws, as applicable.

   4. Audit Rights.

      1. Audit Reports. You acknowledge that Sentry is regularly audited against various information security standards by independent third-party auditors and internal auditors, respectively. Upon request, we shall supply (on a confidential basis) a summary copy of our audit report(s), so that you can verify our compliance with the audit standards against which it has been assessed, and this DPA. Further, we will provide written responses (on a confidential basis) to all reasonable requests for information necessary to confirm our compliance with this DPA, provided that you will not exercise this right more than once per calendar year.

      2. Independent Audits. While it is the parties’ intention to rely ordinarily on the provision of the above audit report(s) to verify our compliance with this DPA, we will allow an internationally-recognized independent auditor that you select to conduct audits to verify our compliance with our obligations under this DPA. You must send any requests for audits under this Section 4.4.2 to legal@sentry.io. Following our receipt of your request, the parties will discuss and agree in advance on the reasonable start date, scope, duration, and security and confidentiality controls applicable to the audit. You will be responsible for any costs associated with the audit. You agree not to exercise your audit rights under this Section 4.4.2 more than once in any twelve (12) calendar month period, except (i) if and when required by a competent data protection authority; or (ii) an audit is necessary due to a Data Incident. You agree that (to the extent applicable), you shall exercise any audit rights under Privacy Laws and the Standard Contractual Clauses by instructing us to comply with the measures described in this Section 4.4.

5. Data Subject Rights; Data Export.

   1. Access; Rectification; Restricted Processing; Portability.

      You acknowledge that the Service may, depending on the functionality of the Service, enable you to: (i) access the Customer Data; (ii) rectify inaccurate Customer Data; (iii) restrict the processing of Customer Data; (iv) delete Customer Data; and (v) export Customer Data.

   2. Cooperation; Data Subjects’ Rights.

      To the extent that you cannot access the relevant Personal Data within the Service, we will provide you, at your expense, with all reasonable and timely assistance to enable you to respond to: (i) requests from data subjects who wish to exercise any of their rights under applicable Privacy Laws; and (ii) any other correspondence, enquiry or complaint received from a data subject, supervisory authority or other third party in connection with the processing of the Customer Data. In the event that any such request, correspondence, enquiry or complaint is made directly to us, we will promptly inform you of it, and provide you with as much detail as reasonably possible.

6. Data Transfers.

   1. Data Storage and Processing Facilities.

      You agree that we may, subject to Section 6.2, store and process Customer Data in the United States and any other country in which we or our Subprocessors maintain data processing operations. Sentry shall ensure that such transfers are made in compliance with applicable Privacy Laws and this DPA.

   2. Transfers of Data out of Europe.

      If the storage and/or processing of Personal Data as described in Section 6.1 involves a transfer of Personal Data to Sentry outside of Europe, and European Data Protection Legislation applies to the transfer (collectively, “Transferred Personal Data”), then (i) the Standard Contractual Clauses shall be incorporated into and form a part of this DPA in accordance with Section 6.3; and (ii) for so long as Sentry is self-certified to the Privacy Shield we shall continue to process Transferred Personal Data in compliance with the Privacy Shield Principles. With respect to Transferred Personal Data, you agree that if we adopt an alternative data transfer mechanism (including any new version of, or successor to, the Standard Contractual Clauses or Privacy Shield adopted pursuant to applicable European Data Protection Legislation) for Transferred Personal Data not described in this DPA (“Alternative Transfer Solution”), the Alternative Transfer Solution shall apply instead of the transfer mechanisms described in this DPA (but only to the extent such Alternative Transfer Solution complies with applicable European Data Protection Legislation and extends to the territories to which Transferred Personal Data is transferred), and if we request that you take any action (including, without limitation, execution of documents) reasonably required to give full effect to that solution, you will promptly do so.

   3. Standard Contractual Clauses.

      1. For the purposes of the Standard Contractual Clauses, the parties agree that (i) Sentry is the “data importer” and you are the “data exporter”; (ii) the SCCs shall be incorporated in the form attached hereto; (iii) the Annexes or Appendices of the SCCs shall be populated with the information from Schedules 1 and 2 and Section 7.2 of this DPA; and (iv) the SCCs shall be governed by the laws of the Republic of Ireland. It is not the intention of either party to contradict or restrict any of the provisions set forth in the Standard Contractual Clauses and, accordingly, if and to the extent the Standard Contractual Clauses conflict with any provision of the Agreement (including this DPA), the Standard Contractual Clauses shall prevail to the extent of such conflict. In particular, nothing in the DPA shall exclude the rights of third-party beneficiaries granted under the Standard Contractual Clauses. You agree that in the event we cannot ensure compliance with the Standard Contractual Clauses, we will inform you promptly and you will provide us with a reasonable period of time to cure any non-compliance. You will reasonably cooperate with us to agree what additional safeguards or measures, if any, may be reasonably required to cure the non-compliance and will only be entitled to suspend the transfer of Personal Data and/or terminate the affected parts of the Service if we have not or cannot cure the non-compliance before the end of the cure period.

      2. If the UK GDPR applies to the Transferred Personal Data, the SCCs as incorporated under Section 6.3.1 shall apply with the following modifications: (i) the SCCs shall be amended as specified by the UK Addendum, which shall be incorporated by reference; (ii) Tables 1 to 3 in Part 1 of the UK Addendum shall be populated with the information from Schedules 1 and 2 and Section 7.2 of this DPA; (iii) Table 4 in Part 1 of the UK Addendum shall be deemed completed by selecting “importer”; and (iv) any conflict between the SCCs and the UK Addendum shall be resolved in accordance with Section 10 and Section 11 of the UK Addendum.

      3. If the Swiss DPA applies to the Transferred Personal Data, the SCCs as incorporated under Section 6.3.1 shall apply with the following modifications: (i) references to “Regulation (EU) 2016/679” shall be interpreted as references to the Swiss DPA; (ii) references to “EU,” “Union,” and “Member State” shall be replaced with “Switzerland”; (iv) references to the “competent supervisory authority” and “competent courts” shall be interpreted as references to the “Swiss Federal Data Protection and Information Commissioner” and the “competent Swiss courts”; and (v) the SCCs shall be governed by the laws of Switzerland and disputes shall be resolved before the competent Swiss courts.

7. Subprocessors.

   1. Consent to Engagement.

      You authorize us to engage third parties as Subprocessors. Whenever we engage a Subprocessor, we will enter into a contract with that Subprocessor which imposes data protection terms that require the Subprocessor to protect Personal Data to an equivalent standard required under this DPA, and we shall remain responsible for the Subprocessor’s compliance with the obligations of this DPA and for any acts or omissions of the Subprocessor that cause us to breach any of our obligations under this DPA.

   2. List of Subprocessors.

      A list of our current Subprocessors is available at https://sentry.io/legal/subprocessors/ or such other website as Sentry may designate (“Subprocessor Page”). We may update the Subprocessor Page to reflect any changes in Subprocessors. We will provide thirty (30) days’ prior written notice to you if you subscribe to receive notice via the mechanism on the Subprocessor Page. During this period you will have the opportunity to object as described in Section 7.3 below.

   3. Objections; Sole Remedy.

      You have the right to object to the appointment or replacement of a Subprocessor prior to its appointment or replacement on reasonable grounds that the Subprocessor does not or cannot comply with the requirements set forth in this DPA (each, an “Objection”). If we do not remedy or provide a reasonable workaround for your Objection within a reasonable time, you may, as your sole remedy and our sole liability for your Objection, terminate the Agreement for your convenience, and without further liability to either party.

   4. Disclosure of Subprocessor agreements.

      You agree that by complying with this Section 7, we fulfil our obligations under Clause 9(a) and (b) of the Standard Contractual Clauses. You further acknowledge that, for the purposes of Clause 9(c) of the Standard Contractual Clauses, we may be restricted from disclosing Subprocessor agreements to you (or the relevant third party controller) due to confidentiality restrictions. Notwithstanding this, we shall use reasonable efforts to require Subprocessors to permit us to disclose Subprocessor agreements to you and, in any event, will provide (upon request and on a confidential basis) all information we reasonably can in connection with such Subprocessor agreement.

8. Additional Information.

   You acknowledge that we are required under European Data Protection Legislation (i) to collect and maintain records of certain information, including, among other things, the name and contact detail of each processor and/or controller on whose behalf we are acting and, where applicable, of such processor’s or controller’s local representative and data protection officer; and (ii) to make such information available to the supervisory authorities. Accordingly, if European Data Protection Legislation applies to the processing of Personal Data, you will, when requested, provide this additional information to us, and ensure that the information is kept accurate and up-to-date.

9. Data Protection Impact Assessment.

   We will provide you with reasonable and timely assistance as you may require in order to conduct a data protection impact assessment and, if necessary, consult with the relevant data protection authority.

10. Jurisdiction Specific Terms.

The terms specified in Schedule 3 with respect to the listed jurisdictions will apply in addition to the terms of this DPA.

11. Miscellaneous.

    With the exception of the third-party beneficiary rights granted (where applicable) under the Standard Contractual Clauses, there are no third-party beneficiaries to this DPA. Except as expressly provided herein, nothing in this DPA will be deemed to waive or modify any of the provisions of the Agreement, which otherwise remains in full force and effect. Specifically, nothing in this DPA will affect any of the terms of the Agreement relating to Sentry’s limitations of liability, which will remain in full force and effect. Notwithstanding the foregoing, in no event shall either party exclude or limit its liability with respect to any data subject’s rights under European Data Protection Legislation or the Standard Contractual Clauses. If you have entered into more than one Agreement with us, this DPA will amend each of the Agreements separately. In the event of a conflict or inconsistency between the terms of this DPA and the terms of the Agreement, the terms of this DPA will control. This DPA amends and supersedes any prior data processing addendum or similar agreement regarding its subject matter.

12. Change in Privacy Laws.

    Notwithstanding anything to the contrary in the Agreement (including this DPA), in the event of a change in Privacy Laws or a determination or order by a supervisory authority or competent court affecting this DPA or the lawfulness of any processing activities under this DPA, we reserve the right to make any amendments to this DPA as are reasonably necessary to ensure continued compliance with European Data Protection Legislation or compliance with any such orders.

---

Standard Contractual Clauses

MODULE TWO: Transfer Controller to Processor

MODULE THREE: Transfer Processor to Processor

SECTION I

Clause 1 :

Purpose and scope

Clause 2 :

Effect and invariability of the Clauses

Clause 3 :

Third-party beneficiaries

Clause 4 :

Interpretation

Clause 5 :

Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6 :

Description of the transfers

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7 — Optional :

Docking clause

SECTION II — OBLIGATIONS OF THE PARTIES

Clause 8 :

Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

MODULE TWO: Transfer Controller to Processor

MODULE THREE: Transfer processor to processor

Clause 9 :

Use of sub-processors

MODULE TWO: Transfer Controller to Processor

MODULE THREE: Transfer processor to processor

Clause 10 :

Data subject rights

MODULE TWO: Transfer Controller to Processor

MODULE THREE: Transfer processor to processor

Clause 11 :

Redress

Clause 12 :

Liability

Clause 13 :

Supervision

SECTION III — LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

Clause 14 :

Local laws and practices affecting compliance with the Clauses

MODULE TWO: Transfer Controller to Processor

MODULE THREE: Transfer processor to processor

Clause 15 :

Obligations of the data importer in case of access by public authorities

SECTION IV — FINAL PROVISIONS

Clause 16 :

Non-compliance with the Clauses and termination

Clause 17 :

Governing law

These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of the Republic of Ireland

Clause 18 :

Choice of forum and jurisdiction

---

Schedule I

---

Schedule II

Security Measures

Technical and Organizational Measures	Relevant Section(s) of Sentry’s Security Policy (see below)
Measures of pseudonymization and encryption of personal data	Data Flow – Data into System Data Flow – Data through System Data Security and Privacy – Data Encryption Data Security and Privacy – PII Scrubbing
Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services	Infrastructure and Network Security – Physical Access Control Infrastructure and Network Security – Logical Access Control Application Security – Multi-Factor Authentication Application Security – Single Sign-On Application Security – SAML 2.0 Application Security – REST API Authentication (API Key) Application Security – Audit Controls
Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident	Infrastructure and Network Security – Intrusion Detection and Prevention Business Continuity and Disaster Recovery Corporate Security – Contingency Planning Corporate Security – Vulnerability Disclosure
Processes for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures in order to ensure the security of the processing	Infrastructure and Network Security – Penetration Testing Infrastructure and Network Security – Third-Party Audit Corporate Security – Risk Management Corporate Security – Security Policies
Measures for user identification and authorization	Infrastructure and Network Security – Logical Access Control Application Security – Multi-Factor Authentication Application Security – Single Sign-On Application Security – SAML 2.0 Application Security – REST API Authentication (API Key) Application Security – Audit Controls
Measures for the protection of data during transmission	Data Flow – Data Through System
Measures for the protection of data during storage	Data Security and Privacy – Data Encryption
Measures for ensuring physical security of locations at which personal data are processed	Infrastructure and Network Security – Physical Access Control
Measures for ensuring events logging	Application Security – Audit Controls
Measures for ensuring system configuration, including default configuration	Application Security – Secure Application Development (Application Development Lifecycle) Corporate Security – Risk Management Corporate Security – Security Policies
Measures for internal IT and IT security governance and management	Security and Compliance Infrastructure and Network Security – Third-Party Audit Corporate Security – Risk Management
Measures for certification/assurance of processes and products	Infrastructure and Network Security – Third-Party Audit Corporate Security – Risk Management
Measures for ensuring data minimization	Data Security and Privacy – Data Retention Data Security and Privacy – Data Removal
Measures for ensuring data quality	Data Flow – Data Through System Data Security and Privacy – Data Encryption Application Security – Audit Controls Sentry maintains an online form to allow data subjects to request a copy of their personal data, make changes to their personal data or request deletion of their personal data
Measures for ensuring limited data retention	Data Security and Privacy – Data Retention Data Security and Privacy – Data Removal
Measures for ensuring accountability	Corporate Security – Risk Management Corporate Security – Security Policies
Measures for allowing data portability and ensuring erasure	Sentry maintains an online form to allow data subjects to request a copy of their personal data, make changes to their personal data or request deletion of their personal data
Measures and assurances regarding U.S. government surveillance (“Additional Safeguards”)	Sentry uses encryption both in transit and at rest. As of the date of this DPA, Sentry has not received any national security orders of the type described in Paragraphs 150-202 of the judgment in the EU Court of Justice Case C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems. No court has found Sentry to be the type of entity eligible to receive process issued under FISA Section 702: (i) an “electronic communication service provider” within the meaning of 50 U.S.C § 1881(b)(4) or (ii) a member of any of the categories of entities described within that definition. Sentry shall not comply with any request under FISA for bulk surveillance, i.e., a surveillance demand whereby a targeted account identifier is not identified via a specific “targeted selector” (an identifier that is unique to the targeted endpoint of communications subject to the surveillance). Sentry shall use all available legal mechanisms to challenge any demands for data access through national security process that Sentry receives, as well as any non-disclosure provisions attached thereto. Sentry shall take no action pursuant to U.S. Executive Order 12333. Sentry publishes a transparency report indicating the types of binding legal demands for the personal data it has received, including national security orders and directives, which shall encompass any process issued under FISA Section 702. Sentry will notify Customer if Sentry can no longer comply with the Standard Contractual Clauses or these Additional Safeguards, without being required to identify the specific provision with which it can no longer comply.

Sentry Security Policy

(Current version is at https://sentry.io/security/, version as of September 21, 2022 is below)

Security & Compliance

Security and compliance are top priorities for Sentry because they are fundamental to your experience with the product. Sentry is committed to securing your application’s data, eliminating systems vulnerability, and ensuring continuity of access.

Sentry uses a variety of industry-standard technologies and services to secure your data from unauthorized access, disclosure, use, and loss. All Sentry employees undergo background checks before employment and are trained on security practices during company onboarding and on an annual basis.

Security is directed by Sentry’s Chief Technology Officer and maintained by Sentry’s Security & Operations team.

Infrastructure and Network Security

Physical Access Control

Sentry is hosted on Google Cloud Platform. Google data centers feature a layered security model, including extensive safeguards such as:

• Custom-designed electronic access cards
• Alarms
• Vehicle access barriers
• Perimeter fencing
• Metal detectors
• Biometrics

According to the Google Security Whitepaper: Google data centers also implement “security measures such as laser beam intrusion detection and 24/7 monitoring by high-resolution interior and exterior cameras” to detect and track intruders. In addition, “access logs, activity records, and camera footage are available in case an incident occurs” and “experienced security guards, who have undergone rigorous background checks and training, routinely patrol” Google data centers.

Sentry employees do not have physical access to Google data centers, servers, network equipment, or storage.

Logical Access Control

Sentry is the assigned administrator of its infrastructure on Google Cloud Platform, and only designated authorized Sentry operations team members have access to configure the infrastructure on an as-needed basis behind a two-factor authenticated virtual private network. Specific private keys are required for individual servers, and keys are stored in a secure and encrypted location.

Penetration Testing

Sentry undergoes annual penetration testing conducted by an independent, third-party agency. For testing, Sentry provides the agency with an isolated clone of sentry.io and a high-level diagram of application architecture. No customer data is exposed to the agency through penetration testing.

Information about any security vulnerabilities successfully exploited through penetration testing is used to set mitigation and remediation priorities. A summary of penetration test findings is available to customers via their Sentry account or upon request.

Third-Party Audit

Google Cloud Platform undergoes various third-party independent audits regularly and can provide verification of compliance controls for its data centers, infrastructure, and operations. This includes, but is not limited to, the SSAE 18-compliant SOC 2 certification and ISO 27001 certification. Sentry undergoes regular third-party independent audits on a regular basis and Sentry’s SOC 2 report and ISO 27001 certificate are available to customers via their Sentry account or upon request.

Intrusion Detection and Prevention

Unusual network patterns or suspicious behavior are among Sentry’s most significant concerns for infrastructure hosting and management. Sentry and Google Cloud Platform’s intrusion detection and prevention systems (IDS/IPS) rely on both signature-based security and algorithm-based security to identify traffic patterns that are similar to known attack methods.

IDS/IPS involves tightly controlling the size and make-up of the attack surface, employing intelligent detection controls at data entry points, and developing and deploying technologies that automatically remedy dangerous situations, as well as preventing known threats from accessing the system in the first place.

Sentry does not provide direct access to security event forensics but does provide access to the engineering and customer support teams during and after any unscheduled downtime.

Business Continuity and Disaster Recovery

High Availability

Every part of the Sentry service uses properly-provisioned, redundant servers (e.g., multiple load balancers, web servers, replica databases) in the case of failure. As part of regular maintenance, servers are taken out of operation without impacting availability.

Business Continuity

Sentry keeps hourly encrypted backups of data in multiple regions on Google Cloud Platform. While never expected, in the case of production data loss (i.e., primary data stores lost), we will restore organizational data from these backups.

Disaster Recovery

In the event of a region-wide outage, Sentry will bring up a duplicate environment in a different Google Cloud Platform region. The Sentry operations team has extensive experience performing full region migrations.

Data Flow

Data into System

SDKs securely send events, containing information on errors and exceptions, to the Sentry server, which processes and stores the events. Audit data of processing and storing is transmitted to our in-house logging infrastructure through encrypted connections.

We believe SDKs should provide some mechanism for proactively scrubbing data, ideally through an extensible interface that the user can customize. Sentry provides documentation outlining SDK configuration to filter out bits of data for security and privacy purposes, but that otherwise delivers the rest of the event data intact. Scrubbing the following values is recommended:

• Values where the keyname matches password, passwd, or secret
• Values that match the regular expression of r’^(?:\d[ -]*?)16$’ (credit card-like)
• Session cookies
• Authentication header (HTTP)

Data through System

Data is sent securely to Sentry via TLS to an HTTPS endpoint. All data is AES-256bit encrypted, both in transit and at rest. Sentry aggregates events along with contextual data related to the user’s environment, preceding events, and the release and deployment changeset. Events data is also enriched with artifacts like source maps or symbols uploaded by the user or sourced externally.

Sentry’s latest SSL Labs Report can be found here.

Data out of System

Once the event is processed, it can then be accessed via Sentry’s user interface and REST APIs. Sentry integrates with a variety of third-party tools so developers can combine error data from Sentry with data from other systems, manage workflows efficiently, and be alerted of errors through notification and chat tools, in addition to email and SMS. Therefore, Sentry’s high standards for security and compliance also extend to its partner network.

Data Security and Privacy

Data Encryption

All data in Sentry servers is encrypted at rest. Google Cloud Platform stores and manages data cryptography keys in its redundant and globally distributed Key Management Service. So, if an intruder were ever able to access any of the physical storage devices, the Sentry data contained therein would still be impossible to decrypt without the keys, rendering the information a useless jumble of random characters.

Encryption at rest also enables continuity measures like backup and infrastructure management without compromising data security and privacy.

Sentry exclusively sends data over HTTPS transport layer security (TLS) encrypted connections for additional security as data transits to and from the application.

Data Retention

Sentry retains event data for 90 days by default, regardless of plan. We remove individual events after 90 days, and we remove aggregate issues after 90 days of inactivity. All event data and most metadata are eradicated from the service and from the server without additional archiving in order to prevent the threat of intrusion.

Data Removal

All customer data stored on Sentry servers is eradicated upon a customer’s termination of service and deletion of account after a 24-hour waiting period to prevent accidental cancellation. Data can also be deleted upon request and via Sentry’s REST API and UI.

Users have the ability to remove individual events via bulk delete of all events within an issue and can permanently remove data related to a given tag.

PII Scrubbing

We recommend that users do not send any personally identifiable information (PII) to Sentry. To mitigate accidents and other security risks, Sentry offers server-side filtering as a default setting. The Data Scrubber option in Sentry’s settings ensures PII doesn’t get sent to or stored on Sentry’s servers, automatically removing values that appear to be sensitive information.

Additionally, users can specify values to be scrubbed in the Project Settings. IP Address storage can also be disabled. The latter is particularly important if you’re concerned about PII and using Sentry’s Browser JavaScript SDK.

Application Security

Multi-Factor Authentication

In addition to password login, multi-factor authentication (MFA) provides an added layer of security to Sentry. We encourage MFA as an important step towards securing data access from intruders. Sentry users can deploy universal second-factor devices like YubiKeys (which can also be used to confirm the sudo prompt) or time-based one-time password (TOTP) apps like Google Authenticator as additional factors. This also applies to sign-in with an SSO provider.

Sentry’s organization list also displays who has MFA enabled so users can vet their own organization’s security.

Single Sign-On

Sentry’s single sign-on (SSO) implementation prioritizes security. We aggressively monitor linked accounts and disable them with any reasonable sign that the account’s access has been revoked. SSO also improves user experience by streamlining login and improving access from trusted domains. Sentry currently offers SSO via Google Business Apps and GitHub Organizations.

SAML 2.0

To facilitate user authentication through the web browser and improve identity management, Sentry offers Security Assertion Markup Language (SAML)-based SSO and System Cross-Domain Identity Management (SCIM) as standard features to customers on its Business and Enterprise plans. SAML 2.0 enhances user-based security and streamlines signup and login from trusted portals to enhance user experience, access management, and auditability. SCIM enables automated account provisioning.

Sentry integrates with SAML 2.0 and SCIM providers including Azure Active Directory and Okta.

REST API Authentication (API Key)

Sentry’s REST API uses an auth token for authentication. Authentication tokens are passed using the auth header and are used to authenticate a user account with the API.

We strongly recommend using organization-wide authentication tokens.

Email Security

The Sentry service includes email notifications and reports. Sender policy framework (SPF) is a system to prevent email address spoofing and minimize inbound spam. We have SPF records set through Dyn, our domain name service (DNS), and domain-based message authentication, reporting, and conformance (DMARC) set up for monitoring reports to prevent the possibility of phishing scams. Sentry users can see the TXT records on dmarc.sentry.io and sentry.io:

\$ dig \_dmarc.sentry.io TXT +short

"v=DMARC1; p=reject; fo=1; aspf=r; pct=100; rua=mailto:dmarc_agg@vali.email; ruf=mailto:security@sentry.io;"

\$ dig sentry.io TXT +short | grep spf

"v=spf1 include:_spf.google.com include:mail.zendesk.com include:sendgrid.net include:mktomail.com include:mg-spf.greenhouse.io -all"

Audit Controls

We know user administration is central to security and management, and auditing user logs is often the first step in both an emergency response plan and policy compliance requirements. All Sentry customers get admin controls governing identity, access, and usage to keep your data safe, secure, and centrally managed.

Membership within Sentry is handled at the organization level. The system is designed so each user has a singular account that can be reused across multiple organizations (even those using SSO). Each Sentry user should have their own account and can choose their own personal preferences and notifications settings. Access to organizations is dictated by role:

• Billing
• Member
• Admin
• Manager
• Organization Owner

For any organization on a Sentry plan, the project administration portal is the hub for seeing and managing users and usage. The member list includes the username, email, status, added date, teams, and role for each user. The admin or owner can revoke access by project, team, or org and change the user role. Additionally, the admin can request login and password history and revoke passwords and active sessions for any user via request to Sentry Support.

In the audit log, all of the actions by user and event within the Sentry UI (e.g., member.invite, project.create) are listed chronologically by time and IP address so you’ll always have a view into your organization’s most recent history.

Secure Application Development (Application Development Lifecycle)

Sentry practices continuous delivery, which means all code changes are committed, tested, shipped, and iterated on in a rapid sequence. A continuous delivery methodology, complemented by pull request, continuous integration (CI), and automated error tracking, significantly decreases the likelihood of a security issue and improves the response time to and the effective eradication of bugs and vulnerabilities. Release notes and details for Sentry and its SDKs can be found on their respective GitHub release pages (e.g., Sentry releases and raven-js releases).

Corporate Security

Malware Protection

At Sentry, we believe that good security practices start with our own team, so we go out of our way to protect against internal threats and local vulnerabilities. All company-provided workstations are enrolled in Mobile Device Management (MDM) and Endpoint Detection and Response (EDR) solutions to enforce security settings including full-disk encryption, screen lock, and OS updates.

Risk Management

Sentry follows the risk management procedures outlined in NIST SP 800-30, which include nine steps for risk assessment and seven steps for risk mitigation.

All Sentry product changes must go through code review, CI, and build pipeline to reach production servers. Only designated employees on Sentry’s operations team have secure shell (SSH) access to production servers.

We perform testing and risk management on all systems and applications on a regular and ongoing basis. New methods are developed, reviewed, and deployed to production via pull request and internal review. New risk management practices are documented and shared via staff presentations on lessons learned and best practices.

Sentry performs risk assessments throughout the product lifecycle per the standards outlined in HIPAA Security Rule, 45 CFR 164.308:

• Before the integration of new system technologies and before changes are made to Sentry physical safeguards
• While making changes to Sentry physical equipment and facilities that introduce new, untested configurations
• Periodically as part of technical and non-technical assessments of the security rule requirements as well as in response to environmental or operational changes affecting security

Contingency Planning

The Sentry operations team includes service continuity and threat remediation among its top priorities. We keep a contingency plan in case of unforeseen events, including risk management, disaster recovery, and customer communication sub-plans that are tested and updated on an ongoing basis and thoroughly reviewed for gaps and changes at least annually.

Security Policies

Sentry maintains an internal wiki of security policies, which is updated on an ongoing basis and reviewed annually for gaps. An overview of specific security policies is available to Sentry enterprise customers upon request:

• Access Management
• Change Management
• Data Request
• Data Management
• Information Security
• Incident Response
• Policy Management and Maintenance
• Risk Management
• Vendor Management
• Vulnerability Management

Background Checks

Sentry conducts background checks for all new hires, including verification on the following:

• Identity verification
• Global watchlist check
• National criminal records check
• County criminal records check
• (U.S. only) Sex offender registry check

Security Training

All new employees receive onboarding and systems training, including environment and permissions setup, formal software development training (if pertinent), security policies review, company policies review, and corporate values and ethics training.

All employees additionally complete security training at least once a year. Policies presented to employees as part of the onboarding process are reviewed once a year to ensure we are keeping up with best practices.

Disclosure Policy

Sentry follows the incident handling and response process recommended by SANS, which includes identifying, containing, eradicating, recovering from, communicating, and documenting security events. Sentry notifies customers of any data breaches as soon as possible via email and phone call, followed by multiple periodic updates throughout each day addressing progress and impact. Sentry Enterprise plans include a dedicated customer success manager who holds responsibility for customer communication, as well as regular check-ins and escalations.

Sentry maintains a live report of operational uptime and issues on our status page. Anyone can subscribe to updates via email from the status page. Any known incidents are reported there, as well as on our Twitter feed.

Vulnerability Disclosure

Anyone can report a vulnerability or security concern with a Sentry product by contacting security@sentry.io and including a proof of concept, a list of tools used (including versions), and the output of the tools. We take all disclosures very seriously, and once we receive a disclosure we rapidly verify each vulnerability before taking the necessary steps to fix it. Once verified, we periodically send status updates as problems are fixed.

To encrypt sensitive information that is sent to us, our PGP key can be found on keyservers with the fingerprint:

E406 C27A E971 6515 A1B1 ED86 641D 2F6C 230D BE3B

Other Resources

Compliance Certifications

Sentry has obtained the following compliance certifications:

• SOC2 Type I
• SOC2 Type II
• HIPAA Attestation
• ISO 27001

If you already use Sentry, you can access the report and certificate via your Sentry account. Otherwise, contact us for a copy of any report(s) you’re interested in reading (it’ll be less infuriating than your social feed.)

---

Schedule 3

Jurisdiction Specific Terms

1. California.

This section applies where and only to the extent Sentry processes Personal Data as a service provider (for the purposes of and as defined by the CCPA).

The parties acknowledge and agree that (i) Sentry shall act solely as a service provider (as that term is defined under the CCPA) on behalf of Customer; and (ii) Sentry shall not retain, use or disclose Personal Data for any purpose other than the purposes described in this DPA, and shall not “sell” Personal Data (within the meaning under the CCPA).

For purposes of this section, “CCPA” means the California Consumer Privacy Act of 2018 (California Civil Code §§ 1798.100 et seq.) and its regulations; as may be amended, superseded or replaced from time to time.