Our dedicated in-house security and privacy team enables Conga customers to meet a multitude of compliance, data protection, and regulatory obligations from around the globe. Conga's trust and assurance activities include:

• Conga certifies to the U.S. Department of Commerce that it adheres to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks. Conga's current certification is available at https://www.privacyshield.gov/list.

• Data Processing Addendums or Agreements including the Standard Contractual Clauses as approved by the European Commission, and incorporating stringent requirements of Article 28 of the EU General Data Protection Regulation 2016/679.

• Service Organization Control (SOC) reports: Conga’s information security control environment undergoes an annual independent evaluation. Conga’s most recent SOC 2, Type II report covering security, confidentiality, and availability is obtainable upon request.

• Cloud Security Alliance's Consensus Assessments Initiative Questionnaire (CAIQ).

• Penetration testing is conducted annually by an industry-recognized third party, or as we make material environment changes.

• Conga only utilizes infrastructure partners who demonstrate the ability to meet rigorous standards (ISO 27001, NIST, SOC 2).

• Conga is ISO 27001 and ISO 27701 certified (The Information Security Management System (ISMS) and Privacy Information Management System (PIMS) at Conga is bounded by the systems used to develop and operate applications providing services to Conga customers).