Security Addendum

EXHIBIT A

OMNIFOLD SECURITY ADDENDUM

This Security Addendum (“SA”) is part of the agreement between Omnifold, Inc. (“Omnifold”) and the customer identified in the Agreement (“Customer”) (the “Agreement”), and is effective as of the Effective Date of the Agreement. Capitalized terms not defined herein have the meanings given in the Agreement.

DATA HANDLING

Confidential Treatment. All Customer Data is treated as confidential information and handled in accordance with Omnifold’s data protection practices.

Segregation. Customer Data is processed independently from data belonging to other Omnifold customers. Mathematical models trained on Customer Data are dedicated to Customer and are not shared with or accessible to any other Omnifold customer.

Data Residency. Customer Data is stored and processed within data centers located in the United States. Omnifold will not transfer Customer Data outside the United States without Customer’s prior written consent.

Permitted Use. Omnifold shall process Customer Data solely for the purposes described in the Agreement. Omnifold shall not use Customer Data for any purpose other than performing its obligations under the Agreement.

ENCRYPTION

Omnifold encrypts Customer Data at rest using AES-256 (or equivalent) encryption and in transit using TLS 1.3 or higher. Encryption keys are managed through a centralized key management system, rotated at least annually, and stored separately from the data they protect.

ACCESS CONTROLS

Least Privilege. Access to Customer Data is restricted to personnel whose job functions require it, using role-based access controls consistent with the principle of least privilege. Access requires multi-factor authentication and passwords meeting reasonable complexity requirements. Access permissions are reviewed no less frequently than quarterly.

Deprovisioning. Upon termination of an Omnifold employee’s or contractor’s engagement, access to systems containing Customer Data is revoked within twenty-four (24) hours.

Omnifold personnel will not access Customer Data except (i) to provide or support the services described in the Agreement or (ii) to comply with applicable law or a binding order of a governmental body.

SYSTEM SECURITY

Vulnerability Management. Omnifold uses automated tools to scan for vulnerabilities across infrastructure and application layers. Vulnerabilities are scored and remediated according to the following timelines:

Severity

Remediation Timeline

Critical

14 days

High

30 days

Medium

90 days

Penetration Testing. Omnifold engages a qualified third-party firm to conduct penetration testing of its production environment no less frequently than annually. Summary results can be made available to Customer as described in Section 10.

Endpoint Security. Omnifold-managed devices used to access Customer Data are configured with encryption and endpoint detection and response tools.

PERSONNEL

Background Checks. Omnifold personnel with access to Customer Data are subject to background checks prior to being granted access.

Training. Omnifold provides security awareness training to all employees upon hire and no less frequently than annually thereafter. Training includes topics such as phishing awareness, data handling, and incident reporting.

Confidentiality. Omnifold personnel with access to Customer Data are required to sign confidentiality agreements consistent with Omnifold’s obligations under the Agreement and this SA.

SUBPROCESSORS

Omnifold maintains a list of subprocessors and will make it available upon Customer’s request.

Omnifold ensures that subprocessors of Customer Data maintain security measures consistent with Omnifold’s obligations under this SA.

INCIDENT RESPONSE

If Omnifold becomes aware of unauthorized access to, disclosure of, or destruction of Customer Data (a “Security Incident”), Omnifold will notify Customer without undue delay, and in any case within forty-eight (48) hours after becoming aware of a confirmed Security Incident.

In the event of a Security Incident, Omnifold will promptly take reasonable steps to contain, investigate, and mitigate the incident. Logs determined to be relevant to a Security Incident will be preserved for at least one (1) year.

Omnifold will provide Customer with timely information about the Security Incident, including the nature of the incident, the status of Omnifold’s investigation, and the measures taken or proposed to mitigate the incident. Communications in connection with a Security Incident will not be construed as an acknowledgment by Omnifold of any fault or liability with respect to the Security Incident.

BUSINESS CONTINUITY

Omnifold maintains business continuity and disaster recovery plans, including regular encrypted backups replicated to a geographically separate data center within the United States. Continuity plans are reviewed and tested no less frequently than annually.

AUDIT AND COMPLIANCE

Upon Customer’s written request, and subject to a mutually acceptable non-disclosure agreement, Omnifold will make available summaries of its most recent third-party penetration test results and security assessment reports.

Once per year, Customer may submit a reasonable security questionnaire, and Omnifold will respond in a timely manner.

DATA DELETION AND RETURN

Upon expiration or termination of the Agreement, Customer shall have a period of thirty (30) days to export any Customer Data stored by Omnifold.

Following the export window, or upon earlier written request by Customer, Omnifold shall delete Customer Data from its primary production systems within thirty (30) days. Customer Data in backup systems shall be purged within ninety (90) days following primary deletion. Deletion is performed using secure deletion methods that prevent data recovery.

Upon request, Omnifold shall provide Customer with written certification confirming the completion of data destruction.

CUSTOMER RESPONSIBILITIES

Customer is responsible for ensuring that it is authorized to provide any Customer Data to Omnifold and that its use of the services complies with applicable legal and regulatory obligations.

Customer is responsible for managing and securing its methods of access to Omnifold’s services, including user credentials, single sign-on connections, and any other authentication mechanisms. Customer must promptly report any suspected compromise of credentials.

GENERAL

Omnifold’s information security program is aligned with the NIST Cybersecurity Framework.

Omnifold may update the security practices described in this SA from time to time to reflect changes in technology, threats, or regulatory requirements; provided that no such update shall materially diminish the overall level of protection afforded to Customer Data.

A material breach of this SA by Omnifold shall constitute a material breach of the Agreement.

The obligations set forth in Sections 7 (Incident Response), 9 (Audit and Compliance), and 10 (Data Deletion and Return) shall survive expiration or termination of the Agreement.