U.S. Securities and Exchange Commission Regulation S-P

Proofpoint, Inc. (“Proofpoint”) is committed to supporting the privacy, security, and compliance obligations of our financial-institution customers. We align our practices with the U.S. Securities and Exchange Commission Regulation S-P, including its 2024 amendments that strengthen safeguards and introduce enhanced breach-notification requirements.

We recognize that our customers rely on us to maintain the confidentiality and integrity of customer information and to provide timely notice of Security Breaches that could impact that information.

Proofpoint's contracts already provide the contractual protection our customers need to comply with their Regulation S-P obligations. In accordance with Regulation S-P and Section 6 of our Data Security, Protection, Audit and Compliance Policy (“DSP Policy”), Proofpoint will notify each affected customer within seventy-two (72) hours after becoming aware of any Security Breach involving customer information. More information is available in our DSP Policy here: https://www.proofpoint.com/us/legal/trust/policies-and-procedures.