Data Privacy Information Sheet:
Proofpoint Takedown

The purpose of this document is to provide customers of Proofpoint Takedown with the information necessary to assess how this service can support and enhance their data privacy strategy.

Takedown – Product Statement
Proofpoint Takedown is an expert-led service that helps customers safeguard against URL- and
domain-based attacks. Customers submit a takedown request to initiate the process of investigating
and mitigating malicious domain and URL activity that targets or impersonates the customer’s
organization and puts its employees, customers, and partners at risk.

Proofpoint Takedown addresses a wide range of malicious infrastructure, including:

• phishing websites and credential harvesting pages
• malware-hosting and malware distribution sites
• malicious domains, subdomains, and URLs used in fraud, including domains used in email and SMS phishing campaigns
• lookalike and typo-squatted domains (for example, using “0” in place of “O”), as well as nonlookalike domains used to target the customer

How Proofpoint Takedown Works Each takedown request follows a defined process:

1. Submission. The customer submits a suspected malicious site to Proofpoint through theTakedown portal, a native Proofpoint integration, or the Takedown API.
2. Investigation. Proofpoint reviews any evidence submitted by the customer and investigates the site for malicious activity.
3. Decision. All evidence is reviewed in accordance with the relevant domain registrar, hosting provider, registry, or other relevant DNS service operator’s abuse reporting requirements to determine whether mitigation is necessary.
4. Mitigation. If there is sufficient evidence, the site is blocked by Proofpoint, shared with trusted blocklist providers, and Proofpoint engages with the relevant registrars, hosting providers, registries, and other DNS service operators to mitigate the threat. As a recognized Trusted Reporter, Proofpoint submits evidence-based reports aligned with each provider’s requirements.
5. Resolution. Once the ticket is closed, results are available in the Takedown portal and provided to the customer via email.

Information Processed by Proofpoint Takedown
Proofpoint Takedown processes information submitted by customers as part of a takedown request,
together with information gathered by Proofpoint during its investigation, to validate and mitigate
malicious domain and URL activity targeting the customer. Each investigation may draw on
Proofpoint threat intelligence. Proofpoint email traffic telemetry, reputable open-source intelligence
(OSINT) and third-party threat corroboration sources, and live website checks.

Data subjects whose personal information may be processed include the customer’s employees and
contractors that submit the Takedown request. Personal information processed by Proofpoint

Takedown includes email header information, such as:

• email addresses
• IP addresses
• sender and recipient names

Customer Access to Proofpoint Takedown Data and Privacy Options
Proofpoint Takedown data may be accessed by customer administrators or other authorized users.
Authorized users can submit, track, and audit takedown requests through the Proofpoint Takedown
portal, native integrations with Proofpoint products, and application programming interfaces (APIs).
Results of each request are made available in the Takedown portal and provided via email once the
ticket is closed.

How Proofpoint Retains Records
To protect organizations and their employees from on-going URL- and domain-based threats,
Proofpoint analyzes the data collected through Proofpoint Takedown and applies the results to its
threat detection and identification process. Validated malicious domains and URLs may be shared
across Proofpoint products and with trusted blocklist providers. Data is retained as set forth on the
Trust site.

Proofpoint’s Use of Subprocessors
Proofpoint utilizes subprocessors to provide its SaaS services. A comprehensive list of the
subprocessors may be found on the Trust site.

Security Proofpoint maintains a documented information security program that is aligned with the requirements of NIST 800-53. Security controls include the following:

• Data in transit is protected using HTTPS/TLS.
• Encryption at rest is accomplished using AES 256.
• Access control mechanisms are present for physical and logical access to the facilities and the infrastructure hosting the services for SaaS products.
• Proofpoint has implemented policies and procedures for the identification and remediation of vulnerabilities in its products and services. Please see https://www.proofpoint.com/us/security.
• Proofpoint leverages a distributed security monitoring infrastructure to monitor for and alert on security incidents.
• Security alerts are automatically directed to on-call staff for triage and review 24x7.
• Proofpoint’s information security program undergoes an annual third-party audit in the form of a SOC 2 Type II audit for the Availability, Confidentiality, and Security trust services principles.