Our dedicated in-house security and privacy team enables Conga customers to meet a multitude of compliance, data protection, and regulatory obligations from around the globe. Conga's trust and assurance activities include:

• Conga certifies to the U.S. Department of Commerce that it adheres to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks. Conga's current certification is available at https://www.privacyshield.gov/list.

• Data Processing Addendums or Agreements including the Standard Contractual Clauses as approved by the European Commission, and incorporating stringent requirements of Article 28 of the EU General Data Protection Regulation 2016/679.

• Service Organization Control (SOC) reports: Conga’s information security control environment undergoes an annual independent evaluation. Conga’s most recent SOC 2, Type II report covering security, confidentiality, and availability is obtainable upon request.

• Cloud Security Alliance's Consensus Assessments Initiative Questionnaire (CAIQ).

• HITRUST CSF Self-Assessment Report.

• Penetration testing is conducted annually by an industry-recognized third party, or as we make material environment changes.

• Conga only utilizes infrastructure partners who demonstrate the ability to meet rigorous standards (ISO 27001, NIST, SOC 2).