- This Information Security Exhibit (“Exhibit”) describes the administrative, technical, and physical safeguards that LogRocket, Inc. (“LogRocket”, referred to in the Agreement as “Company”) maintains to protect the confidentiality, integrity, and availability of Customer Data. It forms part of the agreement between Customer and LogRocket that references it (the “Agreement”) and is also Annex II of LogRocket's Data Processing Addendum (“DPA”). The current version is published at https://cpq.logrocket.com/legal/security-exhibit.
- “Customer Data” has the meaning given in the Agreement and includes any personal data that LogRocket processes on Customer's behalf. “Platform” means the LogRocket services provided under the Agreement (referred to in the DPA as the “Application Services”). Capitalized terms used but not defined in this Exhibit have the meanings given in the Agreement.
- This Exhibit applies in full to the Platform as hosted by LogRocket, including the cloud-hosted (SaaS) Platform and any LogRocket-managed self-hosted deployment. If Customer hosts the Platform on its own infrastructure, Customer controls and is responsible for the security of that environment, and Sections 4 (Business Continuity and Disaster Recovery), 5 (Availability and Backups), and 20 (Data Deletion), and the hosting-related parts of Sections 3, 7, and 12, do not apply to it. The rest of this Exhibit continues to apply to LogRocket's own systems, personnel, and software development, and to any Customer Data that LogRocket receives (for example, in a support request).
- This Exhibit supplements, and does not limit, the DPA and any Business Associate Agreement between the parties.
LogRocket Information Security Exhibit
The safeguards LogRocket maintains to protect Customer Data
§1
Purpose and Scope
§2
Security Program
- LogRocket maintains a written information security program (the “Security Program”) of administrative, technical, and physical safeguards reasonably designed to protect Customer Data against unauthorized access, use, disclosure, alteration, loss, and destruction. The Security Program includes LogRocket's security policies and procedures, which are summarized in the LogRocket Trust Center at https://cpq.logrocket.com/trust, and is independently audited as described in Section 19.
- LogRocket has designated a Security Officer who is responsible for the Security Program. LogRocket reviews its security policies and procedures at least annually and updates them as needed to address changes in risk, technology, and legal requirements.
- LogRocket may update the Security Program and this Exhibit from time to time, but will not materially diminish the overall protection of Customer Data during the term of the Agreement.
§3
Encryption and Key Management
- LogRocket encrypts Customer Data in transit over public networks using industry-standard protocols (TLS). The Platform accepts only encrypted connections: HTTP requests are redirected to HTTPS, and HTTP Strict Transport Security (HSTS) is enforced.
- LogRocket encrypts Customer Data at rest, including in backups, using industry-standard encryption algorithms.
- LogRocket maintains procedures for the generation, handling, protection, and destruction of cryptographic keys and certificates, and restricts access to them to authorized personnel.
- LogRocket requires full-disk encryption on workstations with privileged access to LogRocket systems.
§4
Business Continuity and Disaster Recovery
- LogRocket maintains a business continuity and disaster recovery plan, appropriate to the size, scope, and complexity of its operations, that identifies risk scenarios, assigns recovery responsibilities, and sets recovery priorities for each part of the Platform.
- LogRocket targets Recovery Time Objectives (“RTO”, the time to restore a function after a major incident is declared) and Recovery Point Objectives (“RPO”, the maximum period of data loss, measured back from the incident) as defined in the Business Continuity/Disaster Recovery policy, which meet or exceed the following:
- Core functions (data capture and ingestion, session replay, session and error listing, and data processing): RTO of 30 minutes and RPO of 1 hour.
- All other functions (including search, billing, integrations, live mode, and data export): RTO of 4 hours and RPO of 24 hours.
- LogRocket reviews the plan regularly and tests it in full at least annually, and remediates issues the test identifies. LogRocket also regularly performs failover, high-availability, and backup-restore tests on production systems.
§5
Availability and Backups
- LogRocket designs production systems for fault tolerance: externally facing services run at least two active instances, all active data is replicated to a separate machine, storage fails over automatically to its replica, and failed or unresponsive instances restart automatically.
- LogRocket backs up primary production datastores at least every six hours and all other production datastores at least daily. Backups are encrypted, stored in a non-public location, and, where supported, kept in a different zone or region from the systems they support. LogRocket tests restoring from backups at least annually.
- LogRocket monitors the availability of production systems and publishes the Platform's service status on a public status page.
§6
Access Control
- LogRocket grants access to systems that store or process Customer Data on the principle of least privilege, only to personnel with a business need for it and only on request and approval.
- Each person receives a unique user ID, and single sign-on is used where available. Passwords must meet LogRocket's Information Security Policy, including a minimum length of 12 characters (15 characters for privileged accounts and accounts with access to Customer Data), and may not be reused or shared.
- Multi-factor authentication is required for email and for any access to source code, production infrastructure, DNS, or deployment systems.
- Administrative access, and any access that allows viewing, changing, or deleting Customer Data, requires an authenticated privilege escalation (such as assuming a separate administrative role or account).
- LogRocket personnel may access Customer's account in the Platform only to support Customer. Such access must be requested and approved, is logged, and sessions time out after no more than 30 minutes.
- LogRocket reviews access rights at least every six months. Access is removed promptly when a person leaves LogRocket or no longer needs it, and when someone with production access leaves, LogRocket also rotates the credentials and secrets they could reach.
- Workstations lock automatically when idle and run malware protection. Access to LogRocket systems over untrusted networks requires a VPN.
§7
Physical Security
- The Platform is hosted in data centers operated by LogRocket's cloud infrastructure providers (primarily Google Cloud Platform), which maintain physical and environmental controls audited under SOC 2 and ISO 27001. LogRocket reviews these providers under its vendor management program (Section 16).
- LogRocket's offices use badge-controlled access, visitors must present identification, and network equipment is kept secured.
- Equipment and storage media that held Customer Data or other sensitive information are securely erased, or destroyed if they cannot be erased, before reuse or disposal.
§8
Logging and Monitoring
- Systems that handle Customer Data keep an audit trail of access and changes, recording at least the user ID, date and time, and the records viewed or changed.
- LogRocket retains security-relevant logs (including cloud administrative activity, authentication events, permission changes, configuration changes, and code and infrastructure deployments) for at least one year, and error and request logs for at least three months.
- LogRocket uses these logs to monitor for, investigate, and determine the root cause of operational issues and security events, including Security Incidents.
§9
Asset Management and Data Classification
- LogRocket keeps an inventory of its hardware assets and of software that may interact with production data, and records purchases, transfers, decommissioning, and loss.
- LogRocket classifies information by sensitivity (Restricted, Confidential, or Public), assigns each category of information an owner, and applies handling, access, and transfer controls matching its classification.
§10
Risk Management
- LogRocket maintains a documented process to identify, assess, and treat risks to its systems and to the Customer Data they hold, including risks arising from its vendors (Section 16).
§11
Personnel Security and Training
- Where permitted by law, LogRocket conducts background checks on employees before hire, covering criminal history, education, and residence.
- LogRocket employees and contractors with access to LogRocket systems or confidential information sign confidentiality agreements before receiving access.
- LogRocket personnel receive security and privacy training when they join and at least annually after that. Engineers also receive training on secure coding practices.
- Violations of LogRocket's security policies result in disciplinary action, up to and including termination. LogRocket is responsible for its personnel's compliance with this Exhibit.
§12
Network Security
- LogRocket uses firewalls and network access controls to restrict access to production systems to authorized services and personnel, and monitors production systems to detect and respond to malicious activity.
- LogRocket scans its networks and systems for vulnerabilities at least quarterly, and continuously where possible (see Section 15).
§13
Data Minimization
- LogRocket processes Customer Data only as necessary to provide the Platform in accordance with the Agreement and the DPA.
- Customer controls what data the Platform collects. The LogRocket SDK lets Customer mask page content and user input, sanitize network requests and responses, and suppress console logs, and Customer chooses the retention period that applies to its data. Data that Customer does not send to LogRocket is never processed by it.
§14
Secure Development and Change Management
- LogRocket follows a documented software development lifecycle. Changes to how data is recorded, processed, or stored are described in a technical specification that is reviewed by infrastructure and security personnel before work begins.
- Code is written to follow OWASP secure coding practices, particularly code responsible for authentication, permissions, data deletion, and handling externally sourced data.
- All code and infrastructure changes are made through pull requests, run against automated tests, and reviewed by two engineers. Changes with security implications are also reviewed separately for security. Third-party code is checked for known vulnerabilities before use.
- LogRocket maintains separate development, staging, and production environments. Changes are validated in staging before release and deployed to production only through an automated pipeline that authorized personnel control. Deployments roll out gradually and are rolled back automatically if they fail health checks.
§15
Vulnerability Management and Security Testing
- LogRocket maintains a vulnerability management program that identifies vulnerabilities through scanning, penetration testing, vendor advisories, security researchers, and its own personnel, and tracks and risk-ranks each one.
- An independent third party performs a penetration test of the Platform's web application and API at least annually.
- LogRocket applies security patches to its infrastructure, software dependencies, and workstations based on severity, in accordance with its Patch Management Policy.
- Suspected vulnerabilities in the Platform can be reported to security@logrocket.com.
§16
Vendors and Subprocessors
- Before engaging a vendor that will access Customer Data, LogRocket assesses its security, including by reviewing an independent audit report such as a SOC 2 report where one is available, with a depth of review proportionate to the data the vendor will handle. LogRocket reviews such vendors at least annually after that.
- LogRocket's written agreements with subprocessors that have access to Customer Data require security and confidentiality measures substantially as protective of Customer Data as those in this Exhibit, to the extent applicable to the services they provide.
- The current list of LogRocket's subprocessors is published in the LogRocket Trust Center at https://cpq.logrocket.com/trust. LogRocket gives notice of new subprocessors as described in the DPA.
- LogRocket remains responsible to Customer for the performance of the subprocessors it uses to provide the Platform and is liable for their acts and omissions as if they were its own.
§17
AI Features
- When Customer uses an AI feature of the Platform, the relevant Customer Data is sent to one of the AI model providers listed as LogRocket's subprocessors, only to produce the output Customer requested. Each request contains only the requesting Customer's data.
- AI model providers are contractually prohibited from using Customer Data to train or improve their models, and LogRocket does not use Customer Data to train AI models except as the Agreement expressly permits.
- AI model inference for the Platform runs in data centers in the United States.
§18
Incident Response and Notification
- LogRocket maintains a documented incident response plan covering triage, investigation, containment, resolution, and post-incident review, and reviews and tests it regularly.
- “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Data stored or otherwise processed by LogRocket.
- LogRocket will notify Customer of a Security Incident by email without undue delay, and in any event within forty-eight (48) hours after becoming aware of it. The notice will describe, to the extent then known, the nature of the Security Incident, the categories and approximate volume of Customer Data affected, its likely consequences, and the measures taken or proposed to address it. LogRocket will provide updates as more information becomes available.
- LogRocket will promptly take steps to contain, investigate, and mitigate the Security Incident, including rotating the credentials and keys of affected systems; reasonably cooperate with Customer; and reasonably assist Customer with any notifications Customer must make to regulators or affected individuals. LogRocket will also take any other action that applicable law requires of it as a result of the Security Incident.
- After a Security Incident is resolved, LogRocket will provide Customer, on request, a summary of its root cause and the remediation steps taken.
- LogRocket's notice of a Security Incident is not an acknowledgment of fault or liability. Customer can report suspected Security Incidents to security@logrocket.com.
§19
Audits and Assurance
- LogRocket undergoes an annual SOC 2 Type II audit by an independent auditor covering the Security, Availability, and Confidentiality trust services criteria. On Customer's written request, and subject to the confidentiality obligations of the Agreement, LogRocket will provide its most recent SOC 2 Type II report (or a comparable industry-standard successor report).
- On Customer's written request, and subject to the same confidentiality obligations, LogRocket will provide a summary of the results of its most recent annual penetration test.
- LogRocket will address issues reasonably identified through these reviews in accordance with the Security Program and commensurate with the associated risk.
§20
Data Deletion
- LogRocket retains Customer Data for the retention period in Customer's current plan at any given time. During the period of the Agreement, the retention period is as defined in the Agreement. After the Agreement expires or is terminated, Customer's plan defaults to LogRocket's free plan, whose retention period is 30 days.
- On Customer's written request, LogRocket will assist Customer with deleting Customer Data, including to respond to data subject requests, as described in the DPA.
- On Customer's written request, LogRocket will certify the deletion in writing.
- Copies of deleted Customer Data that remain in backups expire as those backups are rotated out, and are marked so they are not restored in the meantime.
§21
Customer Responsibilities
- Customer is responsible for: (a) configuring the Platform's privacy controls so that it collects only the data Customer needs; (b) not providing Sensitive Data to the Platform except as the Agreement permits; (c) managing its users' access to the Platform and the security of its accounts and credentials; (d) the security of any environment in which Customer hosts the Platform; and (e) promptly notifying LogRocket at security@logrocket.com of any suspected unauthorized access to its LogRocket accounts.