Privacy

Subprocessors

A sub-processor is a third-party engaged by HashiCorp who processes Personal Data of HashiCorp customers in connection with the delivery and support of our Products or Services. HashiCorp engages different types of sub-processors to perform various functions, as explained in the tables below.

Due diligence

HashiCorp undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed sub-processors that will or may have access to or otherwise process Personal Data.

Contractual safeguards

HashiCorp requires its sub-processors to satisfy equivalent obligations as those that apply legally or contractually to HashiCorp (as a Data Processor), all as set forth in HashiCorp’s Data Processing Agreement (“DPA”), including but not limited to the following requirements to:

• Process Personal Data in accordance with data controller’s (i.e. the customer’s) documented instructions (as communicated in writing to the relevant sub-processor by HashiCorp);

• In connection with their sub-processing activities, use only personnel who are reliable and subject to a contractually binding obligation to observe data privacy and security, to the extent applicable, pursuant to applicable data protection laws;

• Require a duty of confidentiality of personnel to whom they grant access to Personal Data;

• Implement and maintain appropriate technical and organizational measures and provide an annual certification that evidences compliance with this obligation. In the absence of such certification, HashiCorp reserves the right to audit the sub-processor;

• Comply with EU-US DPF, Swiss-US DPF, and the UK-US DPF Extension (as applicable) and/or Standard Contractual Clauses with respect to personal data transfers;

• Not engage in the sale of customer’s personal data;

• Promptly inform HashiCorp about any actual or potential security breach in accordance with applicable data privacy laws; and

• Cooperate with HashiCorp in order to deal with requests from data controllers, data subjects or data protection authorities, as applicable.

Process to engage new subprocessors

HashiCorp will provide a notice of updates to this list of sub-processors that are utilized to deliver its Services. HashiCorp undertakes to keep this list updated regularly to enable its customers to stay informed of the scope of sub-processing associated with HashiCorp.

Subprocessors

For information on where HashiCorp production systems and support teams are located, please see hashicorp.com/trust/privacy/tia

The following table describes the countries and legal entities engaged by HashiCorp in the storage or processing of Personal Data.

HashiCorp engages various HashiCorp wholly-owned subsidiaries to perform limited internal activities in connection with delivering our products and services, and those subsidiaries may qualify as Subprocessors. HashiCorp, Inc. and its subsidiaries are parties to an intra-group data transfer agreement. For any questions regarding these subsidiaries, please reach out to privacy@hashicorp.com.