COVU OS Lite Security Exhibit

This exhibit describes the security program COVU, Inc. maintains for OS Lite. It states only controls COVU has implemented; it does not claim SOC 2 or any other certification. It is incorporated into the OS Lite Terms of Service and Data Processing Addendum.

1. Program

COVU maintains a written information-security program with administrative, technical, and physical safeguards appropriate to the nature of the data OS Lite processes and the risks to it, reviewed periodically and after material changes or incidents.

2. Access Control

• Tenant isolation. Agency data is segregated per tenant, enforced at the application and database layer (row-level security), so one agency cannot access another's data.
• Role-based access and least privilege for both customer-facing roles and COVU internal access; internal access to customer content is limited to service, support, security, and legal-compliance needs.
• Multi-factor authentication required for privileged COVU access to production systems.
• Deprovisioning of personnel access promptly on role change or departure; agency administrators control their own users' access.

3. Data Protection

• Encryption in transit (TLS 1.2 or higher) for all OS Lite traffic and encryption at rest for production data stores.
• Secrets and token protection: API keys, OAuth tokens, and other secrets are stored in managed secret systems, not in source code. Email connections use delegated authorization (OAuth) rather than stored passwords. Where an agency chooses to store third-party portal credentials in OS Lite, they are encrypted at the application layer with a server-held key, are never stored in plaintext, and are revealed only one credential at a time on an explicit authenticated request.
• Minimization: the OS Lite Companion captures only what its user-facing features need, with in-product disclosure and pause controls.

4. Operations

• Logging and monitoring of production systems, authentication events, and administrative actions, with error and security monitoring.
• Vulnerability and patch management for application dependencies and infrastructure, with prioritized remediation.
• Change management and secure development: code review, automated testing, and gated releases before production deployment.
• Backups and continuity: regular backups with defined rotation and restoration capability.

5. People and Vendors

• Workforce confidentiality and training: personnel are bound by confidentiality obligations and receive security awareness expectations appropriate to their role.
• Vendor management: subprocessors (listed at /subprocessors) are assessed and bound by contract to protections materially consistent with COVU's obligations.

6. Incident Response and Deletion

• A documented incident-response process covering detection, containment, investigation, remediation, and the customer notification commitments in the DPA (without undue delay; where practicable within 72 hours of confirmation).
• Deletion of customer data from active systems within 60 days of service end or verified request, with backups expiring through ordinary rotation, per the DPA.

Questions: hello@covu.com.

Change log

• v0.9-draft (July 16, 2026) — initial draft; every statement must be re-verified against implemented controls before publication.
• v1.0 (July 16, 2026) — published to production pending counsel validation; content unchanged from v0.9-draft.