Data Privacy Information Sheet:
Data Security Posture Management (DSPM)

The purpose of this document is to provide customers of Proofpoint Data Security Posture Management (DSPM) with the information necessary to assess how this service can support and enhance their data privacy strategy.

DSPM – Product Statement
Proofpoint Data Security Posture Management (DSPM) discovers, classifies, and helps protect sensitive data stored across a customer's cloud and on-premises environments. DSPM scans data at rest within data stores to identify sensitive information, enabling customers to understand where sensitive data resides, who and what can access it, and the potential risks that exposure of the data may present to the company.

Information Processed by Proofpoint DSPM
Proofpoint DSPM processes data located in a customer's cloud accounts and on-premises data stores in order to identify, classify, and help remediate data security risks. Personal information processed by Proofpoint DSPM includes:

• Sensitive information (e.g., PHI, PII, PCI, etc.) stored at rest in the customer's cloud accounts
• Access permissions associated with those data stores
• Data classification describing the type of sensitive data stored
• References (pointers) to the specific data within each store that drives its data classification

Customer Access to Proofpoint DSPM Data and Privacy Options
Proofpoint DSPM data may be accessed by customer administrators or other authorized users. Processing results, including data store inventories, access permissions, and classification findings, are made available to authorized users through the solution's console and application programming interfaces (APIs).

How Proofpoint Retains Records
To protect organizations and their employees from on-going identity threats, Proofpoint analyzes the data collected through Proofpoint DSPM and applies the results to its threat detection and identification process. Data collected is retained in an aggregated form until securely deleted.

Proofpoint's Use of Subprocessors
Proofpoint utilizes subprocessors to provide its SaaS services. A comprehensive list of the subprocessors may be found on the Trust site.

Security
Proofpoint maintains a documented information security program that is aligned with the requirements of NIST 800-53. Security controls include the following:

• Data in transit is protected using HTTPS/TLS.
• Encryption at rest is accomplished using AES 256.
• Access control mechanisms are present for physical and logical access to the facilities and the infrastructure hosting the services for SaaS products.
• Proofpoint has implemented policies and procedures for the identification and remediation of vulnerabilities in its products and services. Please see https://www.proofpoint.com/us/security.
• Proofpoint leverages a distributed security monitoring infrastructure to monitor for and alert on security incidents.
• Security alerts are automatically directed to on-call staff for triage and review 24x7.
• Proofpoint's information security program undergoes an annual third-party audit in the form of a SOC 2 Type II audit for the Availability, Confidentiality, and Security trust services principles.