This Security Addendum describes the technical and organizational measures MetisGrid ("MetisGrid") maintains to protect Customer Content, including Customer Personal Data. It forms part of the Terms of Service and constitutes Annex II of the Data Processing Addendum.

MetisGrid may update these measures provided that updates do not materially reduce the overall level of protection during a subscription term. The current version is published at the Security page.

1. Hosting and Infrastructure

The Service's database, authentication, file storage and server-side functions are hosted by Supabase on Amazon Web Services in the US East (N. Virginia) region. The web application is delivered by Netlify. These providers are listed on the Subprocessor List.
The hosting providers maintain independent third-party attestations, such as SOC 2 Type II reports.
Application code and database changes are version-controlled.

2. Tenant Isolation

Customer data is segregated by organization identifier in a multi-tenant database.
Row-level security policies are enforced at the database layer so that every query is scoped to the authenticated user's organization and permissions. Isolation is enforced server-side and does not depend on client behavior.
Server-side functions validate the caller's organization and role before reading or writing data on their behalf, including for AI requests.
Exercise participants receive only the exercise content that has been revealed to them. Answer keys, scoring guidance and facilitator material are withheld from participants by the database.

3. Encryption

Data in transit is encrypted using TLS 1.2 or higher.
Data at rest, including database storage, file storage and backups, is encrypted with AES-256 by the hosting providers, which manage the encryption keys.
Service credentials and AI provider keys are kept in the hosting provider's encrypted secret storage and are never sent to browsers.

4. Identity and Access Management

Customer Users

Authentication is provided through a managed identity service. Passwords are stored only as salted hashes; MetisGrid cannot retrieve plaintext passwords.
Access tokens are short-lived and are renewed only while the User remains signed in. Signing out ends the session.
Role-based access control allows Customer administrators to assign administrator, facilitator, analyst and observer roles with distinct permissions.

MetisGrid personnel

Access to production systems is limited to authorized MetisGrid personnel.
MetisGrid personnel access Customer Content only to provide support at Customer's request, to respond to a Security Incident, or where necessary to secure the Service.

5. AI Processing Controls

AI requests are sent through MetisGrid's server-side service, which verifies the caller's identity, organization and usage limits before any request reaches an AI provider. AI provider credentials are never exposed to the browser.
Only the content necessary for the requested function is included in a request to an AI provider. Requests are scoped to the calling user's organization and permissions.
AI providers are accessed over authenticated, encrypted API connections. AI providers have no access to MetisGrid's database or storage.
AI providers are engaged on terms that prohibit using Customer Content to train their models.
Structured AI output is validated before it is saved. Scores for exercise responses are assigned or confirmed by a facilitator.

6. Logging

Administrative actions, such as changes to roles, licenses, AI settings and report sharing, are recorded in an audit log with timestamp, actor and affected object. Audit records are retained for 12 months.
AI requests are logged with time, user, feature and usage.

7. Vulnerability Management

Hosting-provider platform patches are applied by the providers under their shared-responsibility models.
MetisGrid operates a Vulnerability Disclosure Policy for external researchers.

8. Secure Development

Input validation and output encoding are applied to user-supplied content. Database access uses parameterized queries.
A content security policy, strict transport security and related browser-security headers are set on Service responses.

9. Backups

The database is backed up by the hosting provider. Backups are encrypted and expire automatically; no backup is kept for more than 90 days.

10. Incident Response

MetisGrid investigates suspected Security Incidents promptly.
Affected Customers are notified within 48 hours of MetisGrid becoming aware of a Security Incident, as set out in the Terms of Service and DPA, with updates until resolution.
A summary describing the cause and corrective actions is provided to affected Customers on request.

11. Data Handling and Deletion

MetisGrid provides a copy of Customer Content in a machine-readable format on request by a Customer administrator.
On termination, Customer Content is deleted from active systems within 30 days after the 30-day export period and purged from backups within 90 days thereafter.
Storage media are decommissioned by the hosting providers under their own standards.

12. Subprocessor Management

Subprocessors are bound by written data-protection and confidentiality terms consistent with the DPA.
The Subprocessor List is published and Customers are notified of changes with 30 days' notice.

13. Personnel

Anyone MetisGrid authorizes to access Customer Content is bound by confidentiality obligations.

14. Physical Security

Physical security of data centers is the responsibility of the hosting providers and is covered by their third-party attestations. MetisGrid does not operate physical facilities that store Customer Content.

15. Assurance

MetisGrid will complete reasonable security questionnaires from Customers.
MetisGrid will notify Customers of any change to this Addendum that materially affects the measures described, with 30 days' notice.

16. Contact

Security questions and reports: security@metisgrid.com