Added: Data Residency (UAE). Processor will store all Customer Data in the UAE region; cross-border transfers require prior written approval and lawful basis under UAE PDPL.

Security Controls. Provider maintains ISMS aligned to ISO/IEC 27001 with annual third-party audits; SOC 2 Type II available upon request with appropriate NDAs.

Sub-processors. 30-day advance notice required for material changes; Customer retains right to object. Critical vendors undergo due diligence and execute equivalent DPAs.

Incident Response. Provider notifies Customer within 24 hours 12 hours of confirmed data breach; detailed PIR within 5 business days.