Laserfiche WebLink
Offsite/Cloud Addendum - 2 <br /> <br />a. All data obtained by the Vendor from the City or from affiliates of <br />the City under the Agreement shall become and remain property <br />of the City. <br />b. At no time shall any data or processes which either belongs to <br />or are intended for the use of City or its officers, agents, or <br />employees, be copied, disclosed, or retained by the Vendor or <br />any party related to the Vendor for subsequent use outside of <br />this agreement unless such use is authorized by the City in <br />writing. <br />5. Data Location: The Vendor shall not store or transfer non-public City <br />data outside of the United States. This includes backup data and <br />disaster recovery locations. The Vendor will permit its personnel and <br />contractors to access City data remotely only as required to provide <br />technical support. <br />6. Encryption: <br />a. The Vendor shall encrypt all non-public data in transit <br />regardless of the transit mechanism. <br />b. For engagements where the Vendor stores sensitive personally <br />identifiable which are non-public or otherwise confidential <br />information, this data shall be encrypted at rest. Examples of <br />such information include without limitation: social security <br />number, date of birth, driver’s license number, financial data, <br />federal/state tax information, and hashed passwords. The <br />Vendor’s encryption shall be consistent with validated <br />cryptography standards as specified in National Institute of <br />Standards and Technology FIPS140-2, Security Requirements. <br />Where encryption of data at rest is not possible, Vendor <br />must provide to the City a description of its existing <br />security measures that provide a similar level of protection. <br />7. Breach Notification and Recovery: The City requires public breach <br />notification when citizens’ personally identifiable information is lost or <br />stolen. Additionally, unauthorized access or disclosure of non-public <br />data is considered to be a breach. The Vendor will provide notification <br />without unreasonable delay and all communication shall be pre- <br />coordinated with the City. When the Vendor or their subcontractors <br />are responsible for the loss, the Vendor shall bear all costs associated <br />with the investigation, response and recovery from the breach, <br />including without limitation credit monitoring services with a term of at <br />least 3 years, mailing costs, website, and toll free telephone call center <br />services. The City rejects any limitation on liability that purports to <br />relieve a vendor from its own negligence or to the extent that it <br />purports to creates an obligation on the part of the City or State of <br />Washington to hold a vendor harmless.