Guide

United States

Guide retains customer data, including Personally Identifiable Information (PII), only as long as necessary to fulfill service requirements and contractual obligations. Retention timelines may vary based on the type of data and its use; however, customer data is not stored beyond what is needed for the purpose of providing services or as required by law. // Compliance and Legal Hold In cases where data must be retained to comply with specific legal requirements or litigation holds, Guide will securely retain this data beyond standard periods until such obligations are met. // Security Measures for Retention All data stored by Guide, including during its retention period, is encrypted in transit and at rest, according to Guide's Encryption Policy

// Data Deletion and Disposal Customer-Initiated Deletion: Customers can delete data within Guide's platform, triggering the safe and complete removal of this data from all active systems within a reasonable time. Automated Deletion: Certain data, particularly data that is no longer actively used, may be purged automatically as per the system's maintenance cycles to ensure data minimalism and security. Request-Based Deletion: In compliance with GDPR, upon request, Guide will delete user records, including PII, from active databases within 30 days of receiving the request. Any associated data within sub-processor platforms will be removed in accordance with GDPR obligations. // Archived Data and Backups Guide maintains periodic backups to ensure data integrity and disaster recovery. Data from these backups is retained temporarily, strictly for backup and recovery purposes, and is subject to a maximum retention period of 30 days unless otherwise mandated by regulatory requirements. Archived data retained beyond this period is stored in anonymized form where feasible, ensuring no identifiable PII is retained.

Guide policy requires that: - Data must be handled and protected according to its classification requirements and following approved encryption standards, if applicable. - All Production Systems must disable services that are not required to achieve the business purpose or function of the system. - All access to Production Systems must be logged. /** Data Protection Implementation and Processes **/ // Customer Data Protection Guide hosts on Amazon Web Services (AWS) in the us-east region by default. All Guide employees adhere to the following processes to reduce the risk of compromising Production Data: - Implement and/or review controls designed to protect Production Data from improper alteration or destruction. - Ensure that confidential data is stored in a manner that supports user access logs and automated monitoring for potential security incidents. - Ensure Guide Customer Production Data is segmented and only accessible to Customers authorized to access data. - All Production Data at rest is stored on encrypted volumes using encryption keys managed by Guide. - Volume encryption keys and machines that generate volume encryption keys are protected from unauthorized access. Volume encryption key material is protected with access controls such that the key material is only accessible by privileged accounts. // Access Guide employee access to production is guarded by an approval process and by default is disabled. Production access is reviewed by the CTO on a case by case basis. // Separation Customer data will be logically separated at the database/datastore level using a unique identifier for the customer. The separation is enforced at the API layer where the client must authenticate with a chosen account and then the customer unique identifier is included in the access token and used by the API to restrict access to data to the account. All database/datastore queries then include the account identifier. // Data Leakage Prevention Guide uses monitoring tools on Production Systems to identify and report unusual data movement in critical systems. These mechanisms will be configured to prevent data leakage (e.g., through email or other messaging technologies) and generate audit logs and alerts. // Monitoring Guide uses AWS CloudWatch, DataDog and Sentry to monitor the entire cloud service operation (monitoring and internal reporting capabilities are used to report on cryptographic operations, encryption, and key management policies, processes, procedures, and controls). If a system failure and alarm is triggered, key personnel are notified by Slack and/or email message in order to take appropriate corrective action. Guide uses a security agent to monitor production systems. The agents monitor system activities, generate alerts on suspicious activities and report on vulnerability findings to a centralized management console. /** Data At Rest **/ // Encryption All databases, data stores, and file systems are encrypted according to Guide's Encryption Policy. // Retention Stored data will follow Guide’s Data Retention Policy, Asset Management Policy and Data Classification Policy in compliance with statutory, regulatory, and business requirements. // Data Deletion Stored sensitive data that is no longer required will be properly deleted in accordance with Guide's business objectives, retention policies, applicable laws and regulations, and relevant third-party agreements. Guide will securely delete sensitive data in line with its data retention policy and use secure disposal methods as appropriate for the data type.

United States

Cloud hosted

AWS

yes

no

Occasionally, users or prospects may reach out with a request to be ‘forgotten’ per GDPR. These requests are made to the privacy@guide.co email address. The procedure is as follows: A security officer is assigned deletion of the candidate in Linear, with a 30 day due date. The security officer will take the following steps: - Create an entry in the GDPR Recordkeeping Log - Record Deletions: - Delete records from the user table based on the unique keys of the user (where applicable) - Additionally, delete the relevant Candidate and associated Guides based on the unique keys of this candidates PII (candidateId, email, social profile urls). - Request subprocessor removal per GDPR to Greenhouse. Once they update their records, we will propagate the changes to our mirrored tables - Record the following in the Recordkeeping Log - PII removed - Subprocessors notified - Date requested - Date removed - Requested By - Requested on Behalf Of (prospects only)

no

2024-10-07

yes

Okta, Google Workspace

no

no

security@guide.co

yes

yes

no

yes

no