Security Overview

This Security Overview summarizes how we protect client data and goods, and explains how to report a vulnerability. It is informational and does not create contractual obligations; security commitments to clients are set out in signed agreements and our Data Processing Addendum.

Our Approach

We design our systems and operations around three principles:

1. Least privilege: people and systems get only the access they need.
2. Defense in depth: multiple layers of protection, so no single failure exposes data.
3. Accountability: access and changes are logged and reviewed.

Safeguards

We maintain administrative, technical, and physical safeguards designed to protect client data and goods. These cover:

• Data protection: encryption, secure hosting, and backups for client data.
• Access control: individual accounts for authorized portal users, and role-based access for our personnel.
• Monitoring and incident response: detection, investigation, and resolution of security events, with client notification as described in our agreements and as required by law.
• Physical security: controlled access to storage facilities and client goods.
• People and vendors: confidentiality obligations for personnel, and data protection requirements for vendors that handle client data.

Clients can request additional detail, including completed security questionnaires, at legal@cpmonesource.com.

Reporting a Vulnerability

We welcome reports from security researchers. If you believe you have found a vulnerability in our websites or systems, email legal@cpmonesource.com with:

• A description of the vulnerability and where it exists.
• Steps to reproduce it.
• The potential impact.

Guidelines

When researching and reporting vulnerabilities, please:

• Act in good faith and avoid privacy violations, data destruction, and service disruption.
• Access only the minimum data needed to demonstrate the issue, and do not keep or share it.
• Do not use social engineering, phishing, or physical attacks against our staff or facilities.
• Do not perform denial-of-service testing.
• Give us reasonable time to fix the issue before disclosing it publicly.

Our Commitment

If you follow these guidelines, we will:

• Acknowledge your report promptly.
• Keep you informed as we investigate and resolve the issue.
• Not pursue legal action against you for research conducted in good faith under this policy.

Changes to This Overview

• We may update this overview as our practices change. We will post the updated version with a new effective date.

Contact Us

CPM One Source, Inc.
6140 Malburg Way
Vernon, CA 90058
legal@cpmonesource.com
1-818-262-1367