SummaGuard — Acceptable Use Policy & Security Exhibit

Version 1.0 — Effective 2026-09-09 — incorporated into the SummaGuard Subscription Terms v1.0

SummaGuard is a product of SummaCore LLC.

This file contains two documents: (A) the Acceptable Use Policy and (B) the Security Exhibit. Each is incorporated by reference into the SummaGuard Subscription Terms. Capitalized terms not defined here have the meanings given in the SummaGuard Subscription Terms ("Agreement", "Service", "Customer", "Customer Data", "AI Outputs", "Order", "Subscription Term", "Establishment").

(A) Acceptable Use Policy

SummaGuard Acceptable Use Policy ("AUP")

This AUP governs use of the SummaGuard Service by Customer and everyone acting on Customer's behalf — including Customer's users, administrators, contractors, API clients, and AI agents operating under Customer's credentials or tokens. Customer is responsible for all such activity. If a term here conflicts with the SummaGuard Subscription Terms, the Subscription Terms control.

1. Lawful and Intended Use

1.1 Lawful use only. Customer may use the Service only in compliance with applicable law and only for its intended purpose: managing Customer's own environment, health, and safety records and related workflows.

1.2 Rights in uploaded data. Customer may not upload, submit, or transmit any data to the Service that Customer does not have the legal right to collect, process, and store. Customer warrants that Customer Data and Customer's use of the Service comply with applicable law, as further described in the SummaGuard Subscription Terms.

1.3 No unlawful content. Customer may not use the Service to store or transmit content that is unlawful, infringing, defamatory, or malicious (including malware or code intended to disrupt or harm the Service or others).

2. Prohibition on Re-Identifying Anonymous Reporters

This is a named, standalone prohibition because it protects a core function of the Service.

The Service supports anonymous and privacy-protected reporting (including OSHA privacy-case handling under 29 CFR 1904.29(b)(6)–(9) and anonymous near-miss reporting where enabled). Customer and its users may not attempt to identify, unmask, deduce, or re-identify the identity of any individual who has submitted a report anonymously or whose identity is masked by the Service — whether through the Service's features, metadata analysis, timing correlation, access-log inspection, API queries, AI-assisted inference, or any other means. Violations of this Section 2 may result in immediate suspension under Section 5 without prior notice.

3. System Integrity and Abuse

Customer may not:

• (a) probe, scan, or test the security or vulnerability of the Service, or attempt to breach any security or authentication measure, without SummaCore's prior written authorization;
• (b) overload, flood, or otherwise interfere with the integrity or performance of the Service or the data of other customers;
• (c) scrape the Service, harvest data from it by automated means outside the documented interfaces, or use crawlers, spiders, or similar tools against the Service;
• (d) reverse engineer, decompile, or disassemble any part of the Service, or attempt to derive its source code, underlying models, or non-public architecture, except to the extent this restriction is prohibited by applicable law;
• (e) resell, sublicense, or provide the Service to third parties except as expressly permitted by the Agreement or an Order;
• (f) use the Service to develop a competing product, or copy its features, functions, or user interface for that purpose;
• (g) share, sell, or publish access credentials, or circumvent user, Establishment, or usage limits stated in an Order.

4. API and Automated (Agent) Access

The Service exposes documented interfaces for programmatic and AI-agent access. The following rules apply, consistent with the API and Automated Access section of the SummaGuard Subscription Terms:

4.1 Issued credentials only. Automated access is permitted only through the documented interfaces, using the Access Credentials issued through the Service.

4.2 Customer responsibility. Customer is responsible for all activity of its users, API clients, and AI agents acting under its Access Credentials, as if Customer performed the activity itself.

4.3 Credentials are Confidential Information. Access Credentials are Confidential Information under the Agreement. Customer must protect them, must not embed them in client-side or public code, and must promptly rotate or revoke any Access Credential it believes is compromised and notify SummaCore.

4.4 Permissions and rate limits. Automated access uses the same role-based permissions as the User whose credentials it uses, and is subject to rate limits SummaCore applies to protect the Service. Customer must not attempt to exceed those permissions or circumvent rate limits.

4.5 Audit attribution. Write actions performed by automated clients are recorded in the Service's audit trail, attributed to the User or credential under which they were performed. Customer must not take steps to obscure or falsify this attribution.

4.6 Throttling and suspension. SummaCore may throttle, restrict, or suspend automated access that is abusive, that degrades the Service, or that violates this AUP, and will restore access when the issue is resolved.

5. Enforcement

SummaCore applies a graduated enforcement ladder, proportionate to the violation:

1. Notice — SummaCore notifies Customer of the violation and requests correction within a stated period;
2. Throttle — SummaCore may rate-limit or restrict the offending users, tokens, or features;
3. Suspend — SummaCore may suspend the offending access or, for serious violations, the affected account;
4. Terminate — for material violations not cured after notice, SummaCore may terminate as provided in the SummaGuard Subscription Terms.

SummaCore may skip steps and act immediately (including suspension without prior notice) where reasonably necessary to protect the Service, other customers, individual safety or privacy (including under Section 2), or to comply with law. SummaCore will use commercially reasonable efforts to notify Customer promptly of any such action and to limit its scope and duration. Suspension does not relieve Customer of payment obligations for the affected period except as provided in the Subscription Terms.

6. Reporting

Report suspected violations, vulnerabilities, or compromised tokens to [email protected]. Good-faith vulnerability reports made through this channel are not violations of Section 3(a).

(B) Security Exhibit

SummaGuard Security Exhibit

This Security Exhibit describes the technical and organizational measures SummaCore maintains for the SummaGuard Service. It is incorporated into the SummaGuard Subscription Terms and referenced by the Data Processing Addendum. SummaCore may improve these measures over time and will not materially degrade the overall protection described here during a Subscription Term.

1. Hosting and Physical Security

The Service's application and database tiers run on dedicated cloud servers in the United States, with data-center physical security managed by our cloud hosting provider. AI inference runs on separate hardware SummaCore owns and operates in the United States and physically secures.

2. Tenant Isolation — Database-per-Tenant

Each Customer's data is stored in a dedicated, per-Customer database (database-per-tenant isolation), not in shared tables partitioned by tenant ID. This provides hard isolation of Customer Data at the storage layer, tenant-scoped backups, and clean per-tenant export and deletion.

3. Encryption

All data in transit between users (or automated clients) and the Service is encrypted using TLS 1.2 or higher. Sensitive personal information (as catalogued in the product's sensitive-field registry) is encrypted at rest at the column level using AEAD encryption with keys held outside the database engine, except for a small number of fields the registry marks as cleartext by design because the Service must match on them (such as name and email address); database backups inherit this protection and backup media are additionally encrypted (AES-256).

4. Authentication and Access Control

• Authentication is handled by a dedicated OIDC identity provider, with support for multi-factor authentication.
• Role-based access control (RBAC) with least-privilege roles governs what each user can see and do; administrative functions are restricted to designated roles.
• Automated access uses the same role-based permissions as the User whose credentials it uses; rate limits are applied to protect the Service; write actions are recorded in the audit trail with the acting User or credential (see Section 8).

5. Auditability and Record Integrity

• The Service maintains an append-only audit trail of security- and record-relevant actions.
• Core records use temporal (system-versioned) history: prior versions are preserved, so records cannot be silently altered or backdated without trace.
• OSHA privacy-case masking is implemented per 29 CFR 1904.29(b)(6)–(9): for privacy-concern cases, the injured or ill employee's name is withheld from the OSHA 300 Log and handled under the regulation's privacy-case regime.

6. Backups and Resilience

• Automated nightly backups of all tenant databases are encrypted and stored in more than one location; one offsite copy is write-protected for a fixed period and cannot be deleted early, extending the effective backup retention window to up to about 40 days.
• Core recordkeeping functions do not depend on AI-feature availability (see the AI Terms Exhibit and the SummaGuard Subscription Terms Section 17).

7. AI Security (eva)

The Service includes an AI assistant ("eva"). Its security posture:

• Self-hosted inference. eva runs entirely on hardware SummaCore owns and operates. There are no third-party AI subprocessors; Customer Data submitted to AI features never leaves SummaCore-controlled systems for AI processing.
• No training on Customer Data. SummaCore does not use Customer Data — identifiable or otherwise — to train, tune, or improve any AI model. See the AI Terms Exhibit.
• Grounded and confirmable. eva's answers are retrieval-grounded with citations to the Customer's own records and to referenced regulatory text, and record-affecting suggestions follow a suggest-then-confirm pattern requiring human confirmation.
• Audit-logged. AI Features that create or persist a record are recorded in the audit trail with the requesting User and a timestamp; prompt and output content is not recorded.
• Informed by the NIST AI RMF. SummaCore's development and operation of AI features is informed by the NIST AI Risk Management Framework (govern, map, measure, manage), including documented risk identification, human-oversight defaults, and monitoring of AI-feature behavior.

8. Agent and Automated Access Security

Automated access is authenticated with the same credentials and role-based permissions as interactive use. Write actions by automated clients are recorded in the audit trail. SummaCore may throttle or suspend automated access that degrades the Service.

9. Vulnerability and Change Management

Dependencies and platform components are reviewed and updated on a regular cadence, and security patches are prioritized. Changes are tested before production deployment. SummaCore does not currently hold a SOC 2 or ISO 27001 certification and does not claim one.

10. Personnel Access

Access to production systems and Customer Data is limited to authorized SummaCore personnel on a need-to-access basis, over a private network, and administrative access is logged.

11. Incident Response and Breach Notification

SummaCore maintains an incident response process covering detection, containment, remediation, and customer communication. In the event of a security breach affecting Customer Data, SummaCore will notify Customer without unreasonable delay, and in any case consistent with applicable law (including Tex. Bus. & Com. Code §521.053), as further detailed in the Data Processing Addendum.

12. Data Export and Deletion

Customer may self-serve export its data at any time during the Subscription Term, and for 60 days after termination or expiry, using the export tools in the Service at that time, which today are: (a) CSV export of the event register and KPI data; (b) CSV export of the OSHA 300 Log and the OSHA ITA submission files (the 300A summary and case files); (c) a printable Form 300A; and (d) any additional export the Service offers at the time. For data without an export tool (including roster, inspections, CAPA, investigation, and audit-trail records, and attachments other than one-at-a-time download), SummaCore will provide a copy on written request as described in the Subscription Terms. After that window, Customer Data is deleted per the deletion schedule in the SummaGuard Subscription Terms, allowing up to about 40 additional days as backup media rotate (one offsite copy is write-protected for a fixed period and cannot be deleted early). Retention periods and legal holds are configured by SummaCore on Customer's instruction. Customer is responsible for identifying the records it must retain or place under hold, including the five-year retention duty under 29 CFR 1904.33, and for instructing SummaCore accordingly before deletion occurs.

Questions about this Security Exhibit: [email protected].