Unbabel has a robust system in place for granting, reviewing and revoking access to its infrastructure, network and applications. Least-privilege access is implemented across Unbabel for both physical and logical access, considerate of cases where in Unbabel team members require access to successfully perform their assigned activities.

Access Control of Processing Areas
Unbabel implements suitable measures in order to prevent unauthorized persons from gaining access to the data processing equipment where data is processed, used or stored.

These include:

• Establishing secure areas;
• Protecting and restricting access paths through controls such as custom-designed electronic access cards, alarms, vehicle access barriers;
• Allowing only authorized personnel, either employees of Unbabel or duly authorized third-parties, are able to access the data processing equipment after providing a justification and going through an approval process;
• Ensuring that all access to the server room is logged, monitored and tracked.

Access Control to Data Processing Systems
Unbabel implements suitable measures to prevent their data processing systems from being used by unauthorized persons. Unbabel commits that the persons entitled to use their data processing system are only able to access the data within the scope and to the extent covered by their respective access permission (authorization) and that personal data cannot be read, copied or modified or removed without authorization.

This includes:

• Implementation of Policies and Procedures, and delivery of related training to all employees;
• Access approval controls (including sourcing approval from HR management, business owners and IT system administrators) including allocation of differentiated access rights and roles;
• Allocation of individual terminals and /or terminal user, and identification characteristics exclusive to specific functions;
• Use of passwords is required to access the system, password strength is enforced by complexity requirements defined in the password security policy;
• Revocation of inactive accounts and sessions;
• Periodic checks to assess that the necessary ports and interfaces are exposed;
• Control of files and documents, including controlled and documented destruction of data;
• Logging, tracking and monitoring of access to data.

Unbabel strictly follows the EU General Data Protection Regulation (GDPR) to guarantee its customers secure data transfers and overall data management being duly certified under the new EU-U.S. Data Privacy Framework following the Commission Implementing Decision of 10.7.2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework.

We also apply the Standard Contractual Clauses (SCCs) considered to provide appropriate safeguards within the meaning of Article 46, as well as the Schrems II Decision ruled by the CJEU. This means that we afford and assure a level of protection essentially equivalent to that guaranteed within the European Union.

To establish a contractual relationship with our customers, Unbabel ensures that a Data Processing Agreement (DPA) is in place, which is fully compliant with the GDPR and California Consumer Privacy Act (CCPA) legislations, including the SCCs and Schrems II Decisions.

Further, Unbabel has conducted a Transfer Impact Assessment (TIA), which has been prepared in alignment with the European Data Protection Board (EDPB) Guidelines. This Assessment provides detailed information on how Unbabel securely and effectively processes customer’s data to the US whilst respecting data subject privacy and rights. Our overall assessment results within the TIA deemed the risk of prohibited lawful access as acceptable, and overall, in view of data protection laws the transfer is permissible.
Our Data Protection Officer (DPO) is certified under IAPP as a Certified Privacy Professional (CIPPE).

Unbabel employs Secure Engineering Principles as the basis for any development whether internal or outsourced.

These principles include:

• Security is an Integral Part of the Unbabel Design Process and is fully implemented across Unbabel software.
• Software developers are trained to develop secure software and are familiar with the OWASP Code Review standard as required.
• In all system design, development and operation, Unbabel seeks to reduce risk to a reasonable level.
• Unbabel strives to use a common language in developing security requirements.
• Version control and tag management are standardized across teams.
• The development and code integration pipeline always comprehends static application security testing analysis (SAST) to identify security issues and those must be addressed before code integration (merge) according to their criticality in accordance with the Patch and Vulnerability Management Policy.
• Segregation of duties is maintained throughout the staging, development, testing and production environments.
• Developments are subject to testing before being released in production environments.
• Unbabel isolates public access systems from mission critical resources (in particular the key databases).
• Access management controls are in place to detect unauthorized use of the service and to support incident investigation.

Unbabel has a Security Incident Response Policy and Plan (SIRP) that applies to all security incidents, technological or physical.

We define an information security incident as a “single or a series of unwanted or unexpected information security events that have a significant probability of compromising business operations and threatening information security,” per ISO/IEC 27000:2009. The SIRP prescribes the functions and responsibilities for each relevant department and team member during an incident.

Unbabel categorises its security incidents according to their impact, which in turn determines the priority with which the incident has to be addressed.
Should a security incident occur that affects customers, Unbabel will notify the affected customers as soon as possible. The notification will include the details of the incident, impact, risk assessment and actions taken or to be taken as well as any other information deemed relevant. Any actions identified as a result of an incident will be resolved in a timely manner.

The Security Incident Response Policy and Plan is subject to review at least every two years, or when a significant event or change occurs that warrants an out-of-cycle review.

The SIRP is subject to testing at least every two years, or when there is an event that warrants an out-of-cycle test. Test results and any identified weaknesses and subsequent actions are reported to the Leadership team and the Compliance Committee as required. Actions required are taken in a timely manner.

Managing vulnerabilities across all Unbabel systems is a critical function to ensure the company’s information security. The purpose of this management is to mitigate the exposure to known vulnerabilities and outdated versions of software, in order to reduce the risk of confidentiality, integrity and availability of Unbabel’s IT systems and information.

Security Patches are deployed within an agreed upon timeline, determined in accordance with the urgency assigned to the Security Patch. Similarly, all third party entities who maintain or/and store Unbabel information or connect directly to Unbabel network, must have an agreement in place which states that they have a security patching procedure in place.

Vulnerabilities are identified mostly through the following channels:

• Internally self-identified;
• Reported to the security@unbabel.com mailbox;
• Responsible Disclosure Program – For ethical hackers / bug bounty reporters as published on our website at https://unbabel.com/responsible-disclosure/;
• Penetration Testing – Unbabel employs a third party to conduct frequent penetration testing. The third party is onboarded in line with our Procurement Policy and Supplier Management Policy;
• Monitoring of vulnerability disclosure news feeds;
• External events / news.

Identified vulnerabilities are prioritised using the following criteria:

• Common Vulnerabilities and Exposures – External measure
• Exploitability index – External measure
• CVSS Score – External measure
• Impact on Unbabel’s processes and services – Internal measure
• Recovery priority – Internal measure
• Any remediation measures to be taken as a result of the vulnerability are then addressed within the SLO assigned.