Accessibility Statement

This Security Overview summarizes how we protect client data and goods, and explains how to report a vulnerability. It is informational and does not create contractual obligations; security commitments to clients are set out in signed agreements and our Data Processing Addendum.

Our Approach

We design our systems and operations around three principles:

1. Least privilege: people and systems get only the access they need.
2. Defense in depth: multiple layers of protection, so no single failure exposes data.
3. Accountability: access and changes are logged and reviewed.

Safeguards

We maintain administrative, technical, and physical safeguards designed to protect client data and goods. These cover:

• Data protection: encryption, secure hosting, and backups for client data.
• Access control: individual accounts for authorized portal users, and role-based access for our personnel.
• Monitoring and incident response: detection, investigation, and resolution of security events, with client notification as described in our agreements and as required by law.
• Physical security: controlled access to storage facilities and client goods.
• People and vendors: confidentiality obligations for personnel, and data protection requirements for vendors that handle client data.

Clients can request additional detail, including completed security questionnaires, at legal@cpmonesource.com.

Reporting a Vulnerability

We welcome reports from security researchers. If you believe you have found a vulnerability in our websites or systems, email legal@cpmonesource.com with:

• A description of the vulnerability and where it exists.
• Steps to reproduce it.
• The potential impact.

Guidelines

When researching and reporting vulnerabilities, please:

• Act in good faith and avoid privacy violations, data destruction, and service disruption.
• Access only the minimum data needed to demonstrate the issue, and do not keep or share it.
• Do not use social engineering, phishing, or physical attacks against our staff or facilities.
• Do not perform denial-of-service testing.
• Give us reasonable time to fix the issue before disclosing it publicly.

Our Commitment

If you follow these guidelines, we will:

• Acknowledge your report promptly.
• Keep you informed as we investigate and resolve the issue.
• Not pursue legal action against you for research conducted in good faith under this policy.

Changes to This Overview

We may update this overview as our practices change. We will post the updated version with a new effective date.

Contact Us

CPM One Source, Inc.
6140 Malburg Way
Vernon, CA 90058
legal@cpmonesource.com
1-818-262-1367