Data Protection Section

The following questions are part of the data protection section of data access renewal. Please note that the question numbers have changed from the individual assessment versions (e.g. 3.1-1 is now practices-1).

Instructions for use:

We recommend that app administrators review these with their internal teams as a way to ensure apps meet the requirements of our Platform Terms. All app administrators will be notified if the data protection section is required for each app.

You may need to upload documentation that shows how and why this Platform Data is being used. This documentation must be either written in English or accompanied by an English translation

These questions are displayed here for your convenience only. The questions required for a given app will vary based on the data to which each app has access. If an app has access to certain types of data, you may also need to provide evidence to support your answers.

If you are currently in the process of completing data protection questions, or are addressing follow-up questions from our reviewers, please continue with those processes and note that the questions you are currently answering may be different from the updated questions here.

App Purpose

practices-1

Does the application use Platform Data to disadvantage certain people (meaning some people get something that others can’t) based on race, ethnicity, color, national origin, religion, age, sex, sexual orientation, gender identity, family status, disability, medical or genetic condition?

If you answer "yes", you will be asked the following additional questions:

Practices-1.a.A Which Platform Data does the application use to disadvantage certain people based on race, ethnicity, color, national origin, religion, age, sex, sexual orientation, gender identity, family status, disability, medical or genetic condition?

practices-1.a.B How does the application use Platform Data to disadvantage certain people based on people's race, ethnicity, color, national origin, religion, age, sex, sexual orientation, gender identity, family status, disability, medical or genetic condition?

practices-1.a.C When did the application start using Platform Data in this way?

practices-2

Does the application use Platform Data to make decisions about housing, employment, insurance, education opportunities, credit, government benefits or immigration status?

If you answer "yes", you will be asked the following additional questions:

practices-use-2.a.A Which Platform Data does the application use to make decisions about housing, employment, insurance, education opportunities, credit, government benefits or immigration status?

practices-2.a.B How does the application use Platform Data to make decisions about housing, employment, insurance, education opportunities, credit, government benefits or immigration status?

practices-2.a.C When did the application start using Platform Data in this way?

practices-3

Does the application use Platform Data for activities related to surveillance? Surveillance includes the processing of Platform Data about people, groups or events for law enforcement or national security purposes.

If you answer "yes" you will be asked the following additional questions:

practices-3.a.A Which Platform Data does the application use for activities related to surveillance?

practices-3.a.B How does the application use Platform Data for activities related to surveillance?

practices-3.a.C I When did the application start using Platform Data for this purpose?

Data Sharing

sharing-4

Some of the following questions are about service providers and sub-service providers. A service provider is a person or business that provides you with services to help you use the Platform or Platform Data. A sub-service provider is a service provider that is used by another service provider to provide them services with respect to the Platform Data.

Google Cloud and Amazon Web Services (AWS) are examples of common, large service providers, but you may also work with smaller companies to process or use Platform Data, such as a local web development business in your country or region.

Do you do any of the following? Select all that apply.

• A. I am not sharing Platform Data that is received through this app.
• B. Sell or license Platform Data to another person or business, or facilitate or support others in doing so.
• C. Purchase Platform Data from another person or business, or facilitate or support others in doing so.
• D. Share Platform Data to enable a person or business to provide a service to you (a service provider).
• E. Share Platform Data to enable another person or business (outside your business) to access and use the Platform or Platform Data.
• F. Share Platform Data at the express direction of a user of this app.
• G. Share Platform Data for other purposes that aren’t listed. Please explain.

If you select option E in Sharing-4, you will be presented with:

sharing-4.a Some of the following questions are about service providers and sub-service providers. A service provider is a person or business that provides you with services to help you use the Platform or Platform Data. A sub-service provider is a service provider that is used by another service provider to provide them services with respect to the Platform Data. Google Cloud and Amazon Web Services (AWS) are examples of common, large service providers, but you may also work with smaller companies to process or use Platform Data, such as a local web development business in your country or region.

Do you do any of the following? Select all that apply.

• I am not sharing Platform Data that is received through this app.
• Sell or license Platform Data to another person or business, or facilitate or support others in doing so.
• Purchase Platform Data from another person or business, or facilitate or support others in doing so.
• Share Platform Data to enable a person or business to provide a service to you (a service provider).
• Share Platform Data at the express direction of a user of this app.
• Share Platform Data for other purposes that aren’t listed. Please explain.

If you select option B in Sharing-4, you will be presented with:

sharingsell-4.a.A What types of Platform Data do you sell or license?

sharingsell-4.a.B Which permissions, features, capabilities or other channels does this application use to access and collect that Platform Data?

sharingsell-4.a.C List all entities, businesses and third parties to whom you are selling or licensing Platform Data from this application and explain the purpose of sharing it in each case.

sharingsell-4.a.D When did you start selling or licensing Platform Data?

If you select option D in Sharing-4, you will be presented with:

sharingsp-4.b You indicated above that you share Platform Data with service providers.

Please check the boxes below to indicate which service providers you share Platform Data with. Subsequent questions will ask you to describe who you share Platform Data with and to explain how and why.

Note: Please do not list Meta services or products as service providers.

If you share Platform Data with more than one service provider listed here and additional, unlisted service providers, please select those that apply as well as “Other.” For example, you may select Apple, Google, and Other to represent all of your service providers.

Select all that apply.

• Google (ex. Play Store, Firebase, Cloud, AdMob, Analytics)
• Amazon (ex. Amazon Web Services)
• Salesforce (ex. Heroku, Marketing Cloud)
• Apple (ex. App Store)
• Microsoft (ex. App Center, Azure, Playfab)
• Github
• AppLovin (ex. Adjust)
• Appsflyer
• Stripe
• Twilio (ex. Segment, SendGrid)
• Other (you will be asked to upload a list)

If you select other above, you will be presented with:

sharingsp-4.b.i Please upload a CSV or Excel file listing any service providers you share Platform Data with in addition to those you indicated in the list above.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

If you select option D in Sharing-4 and other above, you will be presented with:

sharingsp-4.c Do you have a written agreement with each of the service providers you share Platform Data with that requires them, and each of their sub-service providers (if any), to use Platform Data only at your direction and only to provide the service that you requested—not for their own purposes or to benefit their own clients?

A written agreement may include terms of service, a standard non-negotiated agreement, or a signed contract. For example, if you use Google Cloud as a service provider, the written agreement is the Terms of Service you agree to.

• Yes
• No

If you select yes above, you will be presented with:

sharingsp-4.c.i Please check the boxes below to indicate the type of language contained in your written data agreements with service providers. Select all that apply.

• Language requiring service providers to only use Platform Data to provide the service requested by you.
• Language requiring service providers to only use Platform Data as instructed by you.
• Language prohibiting service providers to share Platform Data with third parties unless instructed by you.
• Language prohibiting service providers to process Platform Data for their own purposes or for any third parties.
• Language requiring service providers to delete the Platform
• Data received from you when you cease using their service

If you select option D in Sharing-4 and other in 4-b, you will be presented with:

sharingsp-4.c.iv Do you know about any instances where your service providers, and/or any of their sub-service providers (if any), have acted in a way that is inconsistent with Meta Platform Terms, such as selling Platform Data or failing to delete Platform Data after you stop using their services?

• Yes
• No

sharingsp-4.c.v If you stop using a service provider or sub-service provider, do your agreements with them (such as their terms of service) specify how and when that service provider must delete data that they have received from you?

• Yes
• No

If you select no above, you will be presented with:

sharingsp-4.c.vi If you stop using a service provider or sub-service provider, how do you ensure that they delete the Platform Data that they received from you?

If you select option E in Sharing-4, you will be presented with:

sharing-4.d The next questions are about Tech Providers, which are developers of apps whose primary purpose is to manage Platform integrations on behalf of customers or clients so they can access and manage their data on Meta products. Examples of Tech Providers include SaaS (software as a service) providers and agencies.

Tech Provider definition: An individual or business that has been granted access to Meta APIs for the purpose of creating, maintaining and removing integrations on behalf of other individuals or businesses. This includes individuals or businesses that create a single integration on behalf of an individual client or multiple clients.

You indicated above that this app allows people or businesses (clients) to access and use Platform Data. This means that you are a Tech Provider.

Do you process the Platform Data you receive through this app only on behalf of and at the direction of your clients?

If you select no above, you will be presented with:

sharing-4.d.i.A Other than at the direction of and on behalf of your client, who are you processing the Platform Data for?

sharing-4.d.i.B What Platform Data are you processing for this person or business?

sharing-4.d.i.C Why are you processing Platform Data for this person or business?

sharing-4.d.i.D When did you start processing such Platform Data?

sharing-4.d.i.E How are you processing this Platform Data?

If you select option E in Sharing-4, you will be presented with:

sharingtp-4.e You are receiving this question because your business provides services of a Tech Provider. Do you maintain the Platform Data of each of your clients separately (either logically, such as in separate tables, or physically) from the data of your other clients and the data that you maintain for your own purposes?

• Yes
• No

If you select no above, you will be presented with:

Sharingtp-4.e1 Please describe how you store Platform Data collected on behalf of your clients, and who has access to this data, including the following:

• Where is it being stored?
• How do you store and secure the data?
• Who has access?
• How do you control access?

If you select option F in Sharing-4, you will be presented with:

sharingother-4.f.A You indicated that you share Platform Data in circumstances other than those specified in the previous questions. Please describe the data you share in these circumstances. Make sure to include responses to the following questions:

Other than individual users of this app or website, who do you share this data with?

sharingother-4.f.B How is the data being shared?

sharingother-4.f.C When did you start sharing data with the entity(s) you mentioned?

sharingother-4.f.D Is the data still currently being shared?

sharingother-4.f.i For Platform Data shared in such other circumstances, do you have a written agreement with each recipient of the Platform Data that prohibits them from using the Platform Data in a way that would violate Meta’s Platform Terms and Developer Policies (or any other terms that apply to your use of Platform Data)? Examples of a written agreement include terms of service, a standard non negotiated agreement, or a signed contract. * Yes * No

sharingother-4.g To your knowledge, have any of these recipients of Platform Data violated Meta’s Platform Terms? For example, by selling, licensing, or purchasing Platform Data. * Yes * No

If you select yes above, you will be presented with:

sharingother-4.g.i You indicated above that recipients of Platform Data have violated Meta’s Platform Terms. Please provide details.

If you select option E in Sharing-4, you will be presented with:

sharingother-4.i.A You indicated above that you make the Platform Data you receive through this app available to another person or business when users direct you to share Platform Data.

Describe how users direct you to share Platform Data with another person or business.

sharingother-4.i.B Please upload screenshots of the consent flow for such sharing.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

Data Deletion

deletion-5

Would you delete Platform Data in ALL of the following circumstances, except where retention is permitted under our Terms? * When retaining Platform Data is no longer necessary for a legitimate business purpose, * When requested by a user, * When a user no longer has an account with your application (only applies if you offer user accounts), * When requested by Meta, and * When required by law or regulation.

With respect to this question, "Platform Data" does not include the data listed in Platform Term 3.e “Exceptions”. Please review Platform Term 3d “Retention, Deletion, and Accessibility of Platform Data” to understand our deletion requirements. Note that in certain circumstances, deletion is not required if the Platform Data has been aggregated, obscured, or de-identified so that it cannot be associated with a particular user, browser, or device. Maintaining aggregated and anonymous data for business purposes aligned with a users' experience, such as billing, is permissible.

• Yes
• No

If you select no above, you will be presented with:

deletion-5.a Under which of the above circumstances would you NOT delete Platform Data? Why?

deletion-6

If you delete Platform Data, in the circumstances referenced above, do you take steps to delete Platform Data as soon as reasonably possible?

Reasonably possible may depend on the systems and data, but should not generally exceed 120 days. This question applies only to Platform Data, not data independently collected or stored by this app.

This does not apply to Platform Data you are otherwise required to keep under applicable law or regulation.

• Yes
• No

If you select no above, you will be presented with:

deletion-6.a Under what conditions would you retain Platform Data for more than 120 days?
Note: This does not apply to Platform Data you are otherwise required to keep under applicable law or regulation.

If you select yes in deletion-5, you will be presented with:

deletion-5.b You indicated above that you delete Platform Data when it is no longer necessary for a legitimate business purpose.

Please describe how you determine when Platform Data is no longer necessary for a legitimate business purpose.

With respect to this question, "Platform Data" does not include the data listed in Platform Terms 3(e).

deletion-5.c You indicated above that you delete Platform Data when a user requests it. Please describe how users can request that their data be deleted.

Please include screenshots if applicable.

With respect to this question, "Platform Data" does not include the data listed in Platform Term 3(e)

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

Data Security

security-A

Under Platform Term 6.a.i, Meta requires that you maintain administrative, physical, and technical safeguards that are designed to prevent any unauthorized access, destruction, loss, alteration, disclosure, distribution, or compromise of Platform Data.

See our Developer Data Security Best Practices, Data Security Requirements, Data Protection Assessment overview, and FAQ for more information.

Before answering the next set of questions, consult your Chief Information Security Officer, the person with an equivalent role for your organization, or a qualified cybersecurity firm so that you can provide accurate answers.

Check ‘I understand’ to continue the assessment.

security-B

As a reminder, “Platform Data” is defined in our Platform Terms Glossary as: “any information, data, or other content you obtain from us, through Platform or through your App, whether directly or indirectly and whether before, on, or after the date you agree to these Terms, including data anonymized, aggregated, or derived from such data. Platform Data includes app tokens, page tokens, access tokens, app secrets, and user tokens.”

For the avoidance of doubt, this includes data like User ID, email address, and all data that you receive from API calls to graph.facebook.com.

To answer the following questions, you will need to comprehensively understand how Meta Platform Data related to this app is transmitted, stored, and processed in your software and systems.

This question applies to all of the permissions, features and capabilities in this app. To see the permissions, features and capabilities in this app, visit this app’s Dashboard. You can get to the Dashboard by selecting the app in your 'My Apps' page.
Select ‘I understand’ to continue.

backendstorage-8

Do you store Platform Data in your backend environment (e.g., databases, object storage buckets, or block storage within a cloud or other type of hosted environment)?

Select “Yes” if you write Platform Data into any persistent storage in a backend cloud or server environment that retains data after power to the device is shut off, such as on disk, log files, or databases accessible through a website or API.

Select “No” if you do either of the following:
Exclusively process Platform Data on clients possessed by end users of your app and never transmit Platform Data to any backend environment Process Platform Data in a backend environment but none of that data is ever written to any persistent storage

“Platform Data” is any data that you receive from Meta (for example, Meta user IDs, email addresses, profile pictures, Meta user access tokens, and app secrets).

• Yes
• No

If you select yes above, you will be presented with:

datastored-8.a You indicated in the previous question that you do store Platform Data in your backend environment.

Which of the following types of Platform Data do you store in your backend environment?

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

“Store” refers to writing Platform Data into any environment that retains data after the power is shut off (e.g., log files, object or relational databases, or disks).

Select all that apply.

• Meta user ID or hashed user ID
• Email address
• Profile picture
• Meta API user access token
• App secret
• Other Platform Data not listed above

hosting-8.b Which of these hosting solutions do you use to process Platform Data in your backend environment?

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

Select all that apply.

• Amazon Web Services (AWS)
• Microsoft Azure
• Microsoft Azure PlayFab
• Google Cloud Platform (GCP)
• Alibaba / Aliyun
• Tencent
• Oracle Cloud
• Heroku
• Digital Ocean
• A data center owned by another organization with servers owned by my organization
• Data center and servers owned by my organization
• Other

If you select other above, you will be presented with:

hosting-8.b.i In the previous question you selected “Other” to indicate that you use a hosting option not listed.

Describe your backend environment hosting approach.

backendencryption-9.a

Do you enforce encryption at rest for all Platform Data you store in your backend environment?

Encryption at rest protects Platform Data by making the data indecipherable without a decryption key. This provides an additional layer of protection against unauthorized read access. If you store Platform Data in a backend environment, we require you protect that data with encryption at rest or an acceptable alternative protection. Some hosting providers enable encryption at rest by default or have configuration options to enable it. Before answering this question, verify whether encryption at rest is applied to the services that you use to store Platform Data. If so, answer 'Yes' to this question. “Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• Yes
• No, but our hosting providers have a SOC 2 or ISO 27001 certification that states that their physical security and secure media disposal controls have been evaluated by a third party.
• No

backendencryption-9.b

Do you enforce encryption at rest for all Platform Data you store in your backend environment?

Some hosting providers enable encryption at rest by default or have configuration options to enable it. Before answering this question, verify whether encryption at rest is applied to the services that you use to store Platform Data. If so, answer 'Yes' to this question.

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

• Yes
• No

If you select yes above or in 9.a, you will be presented with:

backendencryption-9.b.i You indicated in the previous question that you enforce encryption at rest for all Platform Data stored in your backend environment.

Upload a written explanation (e.g., a policy or procedure document) that states that all Platform Data stored in your backend environment must be protected with encryption at rest.

If you categorize and protect data differently according to a set of data sensitivity levels, your explanation should clearly indicate what sensitivity level is assigned to Platform Data received from Meta, and you should upload the relevant policies.

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

backendencryption-9.b.ii Upload at least one piece of evidence (e.g., a screen capture of a database instance) that shows how you implement this protection in practice: all Platform Data stored in your backend environment is protected with encryption at rest.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

hostingsecurity-9.c.i

What type of evidence do you possess that demonstrates that your hosting provider's physical security and secure media disposal controls have been evaluated?

To show that you are following Meta’s Platform Terms, you must confirm that your hosting provider’s ISO 27001 or SOC 2 audit had in-scope physical security and secure media disposal controls. In the ISO/IEC 27001:2013 or 2017 standards, these are controls A.8.3, A.11.1, and A.11.2. In the SOC 2 standard, these are controls CC6.4 and CC6.5.

Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• An ISO 27001 audit of my hosting provider, where the associated Statement of Applicability (SOA) states that physical security and secure media disposal controls were evaluated
• An SOC 2 audit report that states that physical security and secure media disposal controls were tested and there were no adverse findings related to these controls
• None of the above

hostingsecurity-9.c.i

What type of evidence do you possess that demonstrates that your hosting provider's physical security and secure media disposal controls have been evaluated?

To show that you are following Meta’s Platform Terms, you must confirm that your hosting provider’s ISO 27001 or SOC 2 audit had in-scope physical security and secure media disposal controls. In the ISO/IEC 27001:2013 or 2017 standards, these are controls A.8.3, A.11.1, and A.11.2. In the SOC 2 standard, these are controls CC6.4 and CC6.5.

An ISO 27001 audit of my hosting provider, where the associated Statement of Applicability (SOA) states that physical security and secure media disposal controls were evaluated An SOC 2 audit report that states that physical security and secure media disposal controls were tested and there were no adverse findings related to these controls None of the above

hostingsecurity-9.c.ii

What date was your hosting provider’s ISO 27001 or SOC 2 certificate issued?

devicestorage-10

Do any people in your organization store Platform Data on organizational endpoints or personal devices (e.g., on laptops or smartphones)?

"Store” refers to writing Platform Data into any environment that retains data after the power is shut off, such as laptops, USB drives, removable hard drives, and cloud storage services like Dropbox or Google Drive.

Note: Platform Data persisted within web or mobile clients for individual users of your service is not in scope for this question.

“Platform Data” is any data that you receive from Meta (for example, Meta user IDs, email addresses, profile pictures, Meta user access tokens, and app secrets).

• Yes. One or more people in my organization store Platform Data on their organizational or personal devices.
• No. Under no circumstances does anyone in my organization store Platform Data on organizational or personal devices.

If you select yes above, you will be presented with:

devicestorage1-10.a When people in your organization store Platform Data on organizational endpoints or personal devices, which of these protections do you implement to reduce the risk of data loss? We require that you implement protections to reduce the risk of access to Platform Data when stored at rest.

Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.
Select all that apply.

• Software or service that enforces full disk encryption on organizational devices (e.g., Bitlocker or FileVault)
• Endpoint Data Loss Prevention (DLP) software on all managed devices to monitor and log actions related to the stored Platform Data
• People in my organization are obligated to follow an acceptable use policy that only allows processing Platform * Data if there is a clear and actionable business purpose and states that the data must be deleted when the business purpose no longer exists
• None of the above

devicestorage2-10.a When people in your organization store Platform Data on organizational endpoints or personal devices, which of these protections do you implement to reduce the risk of data loss?

We require that you implement protections to reduce the risk of access to Platform Data when stored at rest.

Select all that apply.

• A. Software or service that enforces full disk encryption on organizational devices (e.g., Bitlocker or FileVault)
• B. Endpoint Data Loss Prevention (DLP) software on all managed devices to monitor and log actions related to the stored Platform Data
• C. People in my organization are obligated to follow an acceptable use policy that only allows processing Platform Data if there is a clear and actionable business purpose and states that the data must be deleted when the business purpose no longer exists
• D. None of the above

If you select A or B above, you will be presented with:

devicestorage-10.a.i You indicated in the previous question that you protect Platform Data stored on organizational or personal devices by implementing either full disk encryption on these devices or with endpoint Data Loss Prevention (DLP) software.

Upload a written explanation (e.g., a policy or procedure document) that states how you implement this technical protection.

If you categorize and protect data differently according to a set of data sensitivity levels, your explanation should clearly indicate what sensitivity level is assigned to Platform Data received from Meta, and you should upload the relevant policies.

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

devicestorage-10.a.ii Upload at least one piece of evidence (e.g., a tool configuration or screen capture from your application) that shows how you implement this protection in practice: technical protections for Platform Data stored on organizational or personal devices.

For example: A screen capture of a Group Policy that requires BitLocker to be enabled for managed devices A screen capture of a DLP management tool that shows PII data monitoring is enabled for all endpoints A screen capture of another tool or product that your IT administrators use to enforce the use of technical protections on all organizational devices

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

If you select C above, you will be presented with:

devicestorage-10.a.iii You indicated in a previous question that people in your organization are obligated to follow an acceptable use policy when they store Platform Data on organizational or personal devices.

Upload a written explanation (e.g., a policy or procedure document) containing your acceptable use policy.

We require that this policy clearly describes the following:
The allowable business purposes for processing Platform Data on organizational or personal devices A requirement to delete the data when this purpose no longer exists

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

devicestorage-10.a.iv I can confirm that all people in my organization who may process Platform Data on organizational or personal devices:
Have been informed of the acceptable use policy for this data Have acknowledged their understanding of this policy Are informed of this policy as part of their onboarding as new employees

• Yes, I can confirm.
• No, I cannot confirm.

devicestorage1-10.b

You indicated in the previous question that under no circumstances does anyone in your organization store Platform Data on organizational or personal devices.

Have you advised people in your organization that storing Platform Data on organizational or personal devices is not permitted under any circumstances, and required them to acknowledge this obligation?

"Store” refers to writing Platform Data into any environment that retains data after the power is shut off, such as laptops, USB drives, removable hard drives, and cloud storage services like Dropbox or Google Drive.

Our policies require organizations to advise all people in their organization, including high-privilege users like administrators, that storing Platform Data is not permitted.

If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• Yes
• No

devicestorage2-10.b

You indicated in the previous question that under no circumstances does anyone in your organization store Platform Data on organizational or personal devices.

Have you advised people in your organization that storing Platform Data on organizational or personal devices is not permitted under any circumstances, and required them to acknowledge this obligation?

"Store” refers to writing Platform Data into any environment that retains data after the power is shut off, such as laptops, USB drives, removable hard drives, and cloud storage services like Dropbox or Google Drive.

Our policies require organizations to advise all people in their organization, including high-privilege users like administrators, that storing Platform Data is not permitted.

• Yes
• No

devicestorage1-10.c

You indicated in the previous question that under no circumstances does anyone in your organization store Platform Data on organizational or personal devices.

Have you advised people in your organization that storing Platform Data on organizational or personal devices is not permitted under any circumstances, and required them to acknowledge this obligation?

"Store” refers to writing Platform Data into any environment that retains data after the power is shut off, such as laptops, USB drives, removable hard drives, and cloud storage services like Dropbox or Google Drive.

Our policies require organizations to advise all people in their organization, including high-privilege users like administrators, that storing Platform Data is not permitted.

If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

Yes This is not needed, because Platform Data is never accessible to people in my organization. No

devicestorage2-10.c

You indicated in the previous question that under no circumstances does anyone in your organization store Platform Data on organizational or personal devices.

Have you advised people in your organization that storing Platform Data on organizational or personal devices is not permitted under any circumstances, and required them to acknowledge this obligation?

"Store” refers to writing Platform Data into any environment that retains data after the power is shut off, such as laptops, USB drives, removable hard drives, and cloud storage services like Dropbox or Google Drive.

Our policies require organizations to advise all people in their organization, including high-privilege users like administrators, that storing Platform Data is not permitted.

• Yes
• This is not needed, because Platform Data is never accessible to people in my organization.
• No

If you select Yes above, you will be presented with:

devicestorage-10.c.i You indicated in a previous question that under no circumstances do people in your organization store Platform Data on organizational or personal devices.

Upload a written explanation (e.g., a policy or procedure document) that states that people in your organization must not store Platform Data on these devices.

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

devicestorage-10.c.ii

I can confirm that all people in my organization:
Have been informed of the policy prohibiting them from storing Platform Data on organizational or personal devices Have acknowledged their understanding of this policy Are informed of this policy as part of their onboarding as new employees

• Yes, I can confirm.
• No, I cannot confirm.

devicestorage-10.d

Upload a data flow diagram and a description of how your app uses Platform Data.

The following details should be included:
Show how your app makes calls to Meta APIs, such as graph.facebook.com and identify all components that use Platform Data, including those that store, cache, process, or transfer Platform Data across networks Describe the primary use cases (i.e., flows that provide valuable outcomes to users of your app) that you support

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

transitencryption1-11.a

Do you enable security protocol TLS 1.2 or greater to encrypt data for all network connections that pass through, or connect, or cross public networks where Platform Data is transmitted?

Encryption in transit protects Platform Data when it is transmitted across untrusted networks (e.g., the internet) by making it indecipherable except for the origin and the destination devices. Parties in the middle of the transmission should not be able to read Platform Data even if they can see the network traffic (as in a man-in-the-middle attack). TLS is the most prevalent form of encryption in transit because it’s the technology that browsers use to secure communications to websites like banks.
We require that all web listeners (e.g., internet-facing load balancers) that receive or return Platform Data must enable TLS 1.2 or greater. TLS 1.0 and TLS 1.1 may only be used for compatibility with client devices that are not capable of TLS 1.2 or greater. We recommend, but do not require, that encryption in transit be applied to transmissions of Platform Data that are entirely within trusted private networks that you control (e.g., within a Virtual Private Cloud (VPC)). For more information on this requirement and how to upload any required evidence, please refer to our Data Security Requirements.
Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• Yes
• No

transitencryption2-11.a

Do you enable security protocol TLS 1.2 or greater to encrypt data for all network connections that pass through, or connect, or cross public networks where Platform Data is transmitted?

Encryption in transit protects Platform Data when it is transmitted across untrusted networks (e.g., the internet) by making it indecipherable except for the origin and the destination devices. Parties in the middle of the transmission should not be able to read Platform Data even if they can see the network traffic (as in a man-in-the-middle attack). TLS is the most prevalent form of encryption in transit because it’s the technology that browsers use to secure communications to websites like banks.
We require that all web listeners (e.g., internet-facing load balancers) that receive or return Platform Data must enable TLS 1.2 or greater. TLS 1.0 and TLS 1.1 may only be used for compatibility with client devices that are not capable of TLS 1.2 or greater. We recommend, but do not require, that encryption in transit be applied to transmissions of Platform Data that are entirely within trusted private networks that you control (e.g., within a Virtual Private Cloud (VPC)). For more information on this requirement and how to upload any required evidence, please refer to our Data Security Requirements.
* Yes
* No

transitencryption1-11.b

Do you enable security protocol TLS 1.2 or greater to encrypt data for all network connections that pass through, or connect, or cross public networks where Platform Data is transmitted?

Encryption in transit protects Platform Data when it is transmitted across untrusted networks (e.g., the internet) by making it indecipherable except for the origin and the destination devices. Parties in the middle of the transmission should not be able to read Platform Data even if they can see the network traffic (as in a man-in-the-middle attack). TLS is the most prevalent form of encryption in transit because it’s the technology that browsers use to secure communications to websites like banks.
We require that all web listeners (e.g., internet-facing load balancers) that receive or return Platform Data must enable TLS 1.2 or greater. TLS 1.0 and TLS 1.1 may only be used for compatibility with client devices that are not capable of TLS 1.2 or greater. We recommend, but do not require, that encryption in transit be applied to transmissions of Platform Data that are entirely within trusted private networks that you control (e.g., within a Virtual Private Cloud (VPC)). For more information on this requirement and how to upload any required evidence, please refer to our Data Security Requirements.
Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• Yes
• This is not needed. We never transmit Platform Data over the internet for any reason other than requests directly to Meta.
• No

transitencryption2-11.b

Do you enable security protocol TLS 1.2 or greater to encrypt data for all network connections that pass through, or connect, or cross public networks where Platform Data is transmitted?

Encryption in transit protects Platform Data when it is transmitted across untrusted networks (e.g., the internet) by making it indecipherable except for the origin and the destination devices. Parties in the middle of the transmission should not be able to read Platform Data even if they can see the network traffic (as in a man-in-the-middle attack). TLS is the most prevalent form of encryption in transit because it’s the technology that browsers use to secure communications to websites like banks.
We require that all web listeners (e.g., internet-facing load balancers) that receive or return Platform Data must enable TLS 1.2 or greater. TLS 1.0 and TLS 1.1 may only be used for compatibility with client devices that are not capable of TLS 1.2 or greater. We recommend, but do not require, that encryption in transit be applied to transmissions of Platform Data that are entirely within trusted private networks that you control (e.g., within a Virtual Private Cloud (VPC)). For more information on this requirement and how to upload any required evidence, please refer to our Data Security Requirements.

• Yes
• This is not needed. We never transmit Platform Data over the internet for any reason other than requests directly to Meta.
• No

If you select Yes above, you will be presented with:

transitencryption1-11.c You indicated in the previous question that you enable security protocol TLS 1.2 or greater to encrypt data in transit.

Do you ensure that Platform Data is never transmitted over public networks in unencrypted form (e.g., via HTTP or FTP), and that SSL 2.0 and SSL 3.0 are never used?

We require that Platform Data must never be transmitted across untrusted networks in unencrypted form, and you must never use SSL 2.0 or SSL 3.0. For more information on this requirement and how to upload any required evidence, please refer to our Data Security Requirements.
Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• Yes
• No

transitencryption2-11.c You indicated in the previous question that you enable security protocol TLS 1.2 or greater to encrypt data in transit.

Do you ensure that Platform Data is never transmitted over public networks in unencrypted form (e.g., via HTTP or FTP), and that SSL 2.0 and SSL 3.0 are never used?

We require that Platform Data must never be transmitted across untrusted networks in unencrypted form, and you must never use SSL 2.0 or SSL 3.0. For more information on this requirement and how to upload any required evidence, please refer to our Data Security Requirements.
* Yes
* No

transitencryption-11.a.i

Upload a written explanation (e.g., a policy or procedure document) that states how you enable security protocol TLS 1.2 or greater for data in transit.

Your document should include the following statements:
1. Platform Data is never transmitted without encryption in transit 2. SSL version 2 and SSL version 3 are never used

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

If you select Yes above, you will be presented with:

transitencryption-11.a.ii

Upload at least one piece of evidence (e.g., a full screen capture of the results of a Qualys SSL report run against one of your web domains) that shows how you implement this protection in practice: enable security protocol TLS 1.2 or greater for data in transit.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

testing1-12.a

Within the last 12 months, which of the following approaches have you used to test the software you use to process Platform Data for vulnerabilities and security issues?

This question only refers to the software you build or package (e.g., code libraries) in order to process Platform Data, rather than software built or maintained by other companies (e.g., Android or iOS operating systems).

Meta requires that you take steps to test your software for vulnerabilities and security issues at least once every 12 months in order to prevent unauthorized access to Platform Data. [Subtext - Tier D and E only]

Select all that apply.
* Static application security testing (SAST)
* Dynamic application security testing (DAST)
* Penetration test by an internal team
* Penetration test by an external security firm
* Vulnerability reports from external researchers obtained through a Vulnerability Disclosure Program (VDP) or bug bounty program
* Another approach for identifying vulnerabilities
* None of the above

testing-12.a.i

Upload a written explanation (e.g., a policy or procedure document) that states how you test the software you use to process Platform Data for vulnerabilities and security issues.

The following testing procedures should all be included in your written explanation: 1. Test for security vulnerabilities at least once every 12 months 2. Have a process to triage the findings based on severity 3. Ensure that high severity vulnerabilities, which could lead to unauthorized access to Platform Data, are remediated in a timely manner

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

testing-12.a.ii

Upload at least one piece of evidence (e.g., a summary of the outcome of a recent penetration test) that shows how you implement this protection in practice: test the software you use to process Platform Data for vulnerabilities and security issues.

The following details should be included in your evidence:
1. An explanation of the scope and testing methodology 2. The date when the testing activity took place (To be acceptable, the date must be no earlier than 12 months prior to the date that we notified you about this assessment.) 3. If applicable, a summary of any unremediated critical and high severity vulnerabilities

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

testing1-12.b

Within the last 12 months, which of the following approaches have you used to test for vulnerabilities and security issues in your backend environment where you process Platform Data?

This question only refers to the software you build or package (e.g., code libraries) in order to process Platform Data, rather than software built or maintained by other companies (e.g., an analytics service that you rely on as a Service Provider).

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

Meta requires that you take steps to test your software for vulnerabilities and security issues at least once every 12 months in order to prevent unauthorized access to Platform Data.

Select all that apply.
* Static application security testing (SAST)
* Dynamic application security testing (DAST)
* Web scan
* Penetration test by an internal team
* Penetration test by an external security firm
* Vulnerability reports from external researchers obtained through a Vulnerability Disclosure Program (VDP) or bug bounty program
* Another approach for identifying vulnerabilities
* This is not necessary because my organization uses a no-code backend solution
* None of the above

testing2-12.b

Within the last 12 months, which of the following approaches have you used to test for vulnerabilities and security issues in your backend environment where you process Platform Data?

This question only refers to the software you build or package (e.g., code libraries) in order to process Platform Data, rather than software built or maintained by other companies (e.g., an analytics service that you rely on as a Service Provider).

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

Select all that apply.
* Static application security testing (SAST)
* Dynamic application security testing (DAST)
* Web scan
* Penetration test by an internal team
* Penetration test by an external security firm
* Vulnerability reports from external researchers obtained through a Vulnerability Disclosure Program (VDP) or bug bounty program
* Another approach for identifying vulnerabilities
* This is not necessary because my organization uses a no-code backend solution
* None of the above

testing-12.b.i

Upload a written explanation (e.g., a policy or procedure document) that states how you test for vulnerabilities and security issues in your backend environment where you process Platform Data.

The following testing procedures should all be included in your written explanation: 1. Test for security vulnerabilities at least once every 12 months 2. Have a process to triage the findings based on severity 3. Ensure that high severity vulnerabilities, which could lead to unauthorized access to Platform Data, are remediated in a timely manner

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

testing-12.b.ii

Upload at least one piece of evidence (e.g., a summary of the outcome of a recent penetration test) that shows how you implement this protection in practice: test for vulnerabilities and security issues in your backend environment where you process Platform Data.

The following details should be included in your evidence: 1. An explanation of the scope and testing methodology 2. The date when the testing activity took place (To be acceptable, the date must be no earlier than 12 months prior to the date that we notified you about this assessment.) 3. If applicable, a summary of any unremediated critical and high severity vulnerabilities

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

testing1-12.c

Do you test the cloud environment you use to process Platform Data for security misconfigurations (e.g., using a tool like NCC Scout Suite to identify misconfigurations) at least every 12 months?

Meta requires that you take steps to test your software for vulnerabilities and security issues at least once every 12 months in order to prevent unauthorized access to Platform Data.

Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• Yes
• Not applicable because my organization relies only on a backend service that does not expose any sensitive security configuration options
• No

If you select Yes above, you will be presented with:

testing-12.c.i Upload a written explanation (e.g., a policy or procedure document) that states how you test the cloud environment you use to process Platform Data for security misconfigurations.

The following testing procedures should all be included in your written explanation: 1. Test for security vulnerabilities at least once every 12 months 2. Have a process to triage the findings based on severity 3. Ensure that high severity vulnerabilities, which could lead to unauthorized access to Platform Data, are remediated in a timely manner

Please highlight or circle where in your policy these conditions are outlined.

Meta requires that you take steps to test your software for vulnerabilities and security issues at least once every 12 months in order to prevent unauthorized access to Platform Data.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

testing-12.c.ii Upload at least one piece of evidence (e.g., a summary of a NCC Scout Suite test) that shows how you implement this protection in practice: test the cloud environment you use to process Platform Data for security misconfigurations.

The following details should be included in your evidence:
1. An explanation of the scope and testing methodology 2. The date when the testing activity took place (To be acceptable, the date must be no earlier than 12 months prior to the date that we notified you about this assessment.) 3. If applicable, a summary of any unremediated critical and high severity vulnerabilities

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

accesstoken-13.a

Does your app or software ever store access tokens on customer or client devices that are readable by a different app or user?

“Customer or client device” refers to a piece of hardware, such as an Android or iPhone mobile phone, that belongs to end users of your app or service.

Select “No” if you do not have an app or software that runs on customer or client devices, such as mobile phones.

• Yes
• No

appsecret-13.b

Is the Facebook app secret ever exposed to customer or client devices (e.g., within compiled code)?

• Yes
• Yes, but my app is configured as a desktop or native app
• No

Accesstoken-13.c

You are receiving this question because you indicated on a previous question that you store Meta API user access tokens in your backend environment.

How do you protect these tokens from unauthorized use?

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

Access tokens are fundamental to the security of Meta's APIs. We require developers to protect access tokens from unauthorized access. Learn about access tokens.

Select all that apply.
* By storing this data in a data vault (e.g., Vault by Hashicorp) with separate key management service (KMS)
* By using application encryption (e.g., user access tokens are never written, unencrypted into databases or any other persistent storage)
* By configuring the app to require the appsecret_proof parameter for API calls to Meta
* I use a different approach to protect user access tokens
* None of the above [subtext

accesstoken-13.c.i The previous question asked how you protect user access tokens stored in your backend environment from unauthorized use.

Upload a written explanation (e.g., a policy or procedure document) that states how you protect these access tokens.

Your written explanation should include:
1. Description of how user access tokens are protected from unauthorized read access 2. A requirement that user access tokens must never be written to log files in cleartext (unencrypted) form

Please highlight or circle where in your policy these conditions are outlined.

Access tokens are fundamental to the security of Meta's APIs. We require developers to protect access tokens from unauthorized access. Learn about access tokens.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

Accesstoken-13.c.ii Upload at least one piece of evidence (e.g., a screen capture of an access token key, but not its value) that shows how you implement this protection in practice: protect access tokens stored in your backend environment from unauthorized use.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

appsecret-13.d

You are receiving this question because you indicated in a previous question that you store the app secret in your backend environment.

How do you protect the app secret from unauthorized use?

The app secret is a parameter associated with Meta Technologies that can be used as an access token in certain API calls to change the configuration of an app, for example configuring Webhook callbacks.You can find an app’s app secret on the App Dashboard under Settings > Basic. For more information about the app secret, refer to our developer documentation on Login Security. For more information on our requirements to protect app secrets and user access tokens, including any evidence you may be required to provide, see Protect the Meta App Secret and Access Tokens.

We require you protect the app secret in one of two ways: By never exposing it outside of a secured server environment. This means it is never returned by a network call to a browser or mobile app, and the secret is not embedded into code that’s distributed to mobile or native/desktop clients. Or, by configuring the App Authentication with type “Native or desktop app” so that Meta APIs will no longer trust API calls that include the app secret.

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

Select all that apply.
* A. By storing this data in a data vault (e.g., Vault by Hashicorp) with separate key management service (KMS) * B. By using application encryption (e.g., the app secret is never written, unencrypted into databases or any other persistent storage)
* C. I use a different approach for protecting app secrets
*D. None of the above

If you select A,B, or C above, you will be presented with:

appsecret-13.d.i You indicated in the previous question that you protect the app secret stored in your backend environment from unauthorized use.

Upload a written explanation (e.g., a policy or procedure document) that states how you implement this protection.

Your written explanation should include:
1. Description of how the app secret is protected from unauthorized read access 2. A requirement that the app secret must never be written to log files in cleartext (unencrypted) form

Please highlight or circle where in your policy these conditions are outlined.

The app secret is fundamental to the security of Meta's APIs. We require developers to protect the app secret from unauthorized access. Learn about the app secret.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

appsecret-13.d.ii Upload at least one piece of evidence (e.g., a screen capture of your secrets manager containing the app secret with the value redacted) that shows how you implement this protection in practice: protect the app secret stored in your backend environment from unauthorized use.

To see an example of acceptable evidence, go to our evidence guide for this question.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

mfa1-15.a

Do you require multi-factor authentication (MFA) for all access to your collaboration and communication tools?

We require MFA or an acceptable alternative protection for all users of your collaboration and communication tools (e.g., email, Slack). We do not require any particular method of implementing MFA.
Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• Yes
• No, but we enforce a password-complexity policy and have authentication backoff delays and automatic account lockouts with failed login attempts.
• No

mfa1-15.b

Do you require multi-factor authentication (MFA) for all access to your code repository tool (e.g., GitHub) or any tool used to track changes to the app and any of the system’s code and configuration?

We require MFA or an acceptable alternative protection for all users of your code repository. We do not require any particular method of implementation for MFA.
Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• Yes
• No, but we enforce a password-complexity policy and have authentication backoff delays and automatic account lockouts with failed login attempts.
• No

mfa1-15.c

Do you require multi-factor authentication (MFA) for all access to your software deployment tools, for example Jenkins or another continuous integration, continuous deployment (CI/CD) tool?

We require MFA or an acceptable alternative protection for all users of your software deployment tools. We do not require any particular method of implementing MFA.

Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• Yes
• No, but we enforce a password-complexity policy and have authentication backoff delays and automatic account lockouts with failed login attempts.
• No

mfa1-15.d

Do you require multi-factor authentication (MFA) for all access to your backend administrative tools, for example a cloud administrative portal?

We require MFA or an acceptable alternative protection for all users of your cloud or server administrative tools. We do not require any particular method of implementing MFA.
Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue. * Yes
* No, but we enforce a password-complexity policy and have authentication backoff delays and automatic account lockouts with failed login attempts.
* No

mfa1-15.e

Do you require multi-factor authentication (MFA) for all remote access to servers, for example via SSH?

We require MFA or an acceptable alternative protection for all remote access to servers. We do not require any particular method of implementing MFA.

Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• Yes
• No, but we enforce a password-complexity policy and have authentication backoff delays and automatic account lockouts with failed login attempts.
• Not applicable. We have no remote access to servers.
• No

If you Yes or 'No, but' above, you will be presented with:

mfa-15.e.i Upload a written explanation (e.g., a policy or procedure document) that states your requirements for multi-factor authentication (MFA) or other measures to prevent account takeover (e.g., password complexity combined with authentication backoff and automatic account lockouts when a login attempt fails).

Your explanation should include your authentication requirements for all access to any collaboration and communication tools, code repositories, software deployment tools, backend administrative tools, and remote access to servers via a tool like SSH.

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

mfa-15.e.ii Upload at least one piece of evidence (e.g., a tool configuration or screen capture from your application) that shows how you implement this protection in practice: multi-factor authentication or other measures to prevent account takeover.

Your evidence should show how you use authentication to protect all access to any collaboration and communication tools, code repositories, software deployment tools, backend administrative tools, and remote access to servers via a tool like SSH.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

maintaining1-16

Do you have a system for maintaining accounts that manages granting, revoking and reviewing access to people in your organization?

We require you to have a system for maintaining accounts and that you review access grants regularly, no less than once every 12 months. You must have a process for revoking access promptly when: * Access is no longer required * Access is no longer being used * A person departs the organization

Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• Yes/No

If you select Yes above, you will be presented with:

maintaining1-16.a Which of the processes below do you implement as part of your system for maintaining accounts?

Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

Select all that apply.
* A. We review all access grants at least once every 12 months and revoke access that is no longer required.

• B. We review all access grants at least once every 12 months and revoke access that is no longer being used.

• C. We promptly revoke all access grants when a person leaves the organization.

• D. None of these

If you select A,B, or C above, you will be presented with:

maintaining-16.a.i Upload a written explanation (e.g., a policy or procedure document) that states the following: requirements related to your system for maintaining accounts.

Your written explanation must include requirements to:
1. Revoke access that is no longer required 2. Revoke access that is no longer being used 3. Revoke access promptly when a person leaves your organization

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

maintaining-16.a.ii Upload at least one piece of evidence (e.g., a tool configuration or screen capture) that shows how you implement this protection in practice: implement a system for maintaining accounts.

Your evidence must show how you: 1. Revoke access that is no longer required 2. Revoke access that is no longer being used 3. Revoke access promptly when a person leaves your organization

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

patches1-17.a

You indicated in a previous question that you store Platform Data in your backend environment.

Relevant to the software you use to process Platform Data in your backend environment, do you do all of the following: * Have a defined and repeatable way of identifying patches in third-party software that resolve security vulnerabilities * Prioritize available patches based on risk (e.g., based on CVSS severity) Apply patches as an ongoing activity

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• Yes
• This is not necessary since my organization uses a no-code backend solution.
• No

If you select Yes above, you will be presented with:

updated-17.a.i You indicated in the previous question that you have processes for keeping your code and backend environment updated.

Upload a written explanation (e.g., a policy or procedure document) that states how you keep your code and backend environment updated.

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

Updated-17.a.ii Upload at least one piece of evidence (e.g., a tool configuration or screen capture from your application) that shows how you implement this protection in practice: keep your code and backend environment updated.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

mobile1-17.b

Relevant to the third-party software you use to process Platform Data in a mobile app such as an Android or iPhone app, do you do all of the following:
* Have a defined and repeatable way of identifying patches in third-party software that resolve security vulnerabilities * Prioritize available patches based on risk (e.g., based on CVSS severity) Apply patches as an ongoing activity

Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• Yes
• This is not necessary since my organization does not process Platform Data in a mobile app.
• No

If you select Yes above, you will be presented with:

mobile-17.b.i In the previous question you indicated that you keep third-party software updated in your mobile app.

Upload a written explanation (e.g., a policy or procedure document) that states how you keep third-party code updated in your mobile app.

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

Mobile-17.b.ii Upload at least one piece of evidence (e.g., a tool configuration or screen capture from your application) that shows how you implement this protection in practice: keep third-party code updated in your mobile app.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

patches1-17.c

Relevant to the operating systems, antivirus software, browsers running on laptops, and other systems and applications used by people in your organization to build and operate your app, do you do all of the following: Have a defined and repeatable way of identifying patches in third-party software that resolve security vulnerabilities Prioritize available patches based on risk (e.g., based on CVSS severity) Apply and verify patches as an ongoing activity

Our policies require that you comply with this requirement. If you do not have this protection in place you will receive a violation warning with a deadline to resolve the issue.

• Yes
• No

If you select Yes above, you will be presented with:

antivirus-17.c.i You indicated in the previous question that you keep third-party software in the systems and applications used to build and operate your app updated.

Upload a written explanation (e.g., a policy or procedure document) that states how you keep this third-party software and antivirus software updated.

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

antivirus-17.c.ii Upload at least one piece of evidence (e.g., a tool configuration or screen capture from your application) that shows how you implement this protection in practice: keep third-party software and antivirus software updated.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

Reporting-21

Do you have a publicly available way for people to report security vulnerabilities in this app to you?

• Yes
• No

If you select No above, you will be presented with:

contact-21.ayou Is there a publicly available email address, phone number, or contact form that people can use to contact you, which is regularly monitored?

• Yes
• No

auditlog-22

You indicated in a previous question that you store Platform Data in your backend environment.

Do you collect admin audit logs for this backend environment?

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

• Yes
• No

If you select Yes above, you will be presented with:

** auditlog-22.a ** Upload a written explanation (e.g., a policy or procedure document) that states how you collect admin audit logs for your backend environment where Platform Data is stored.

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

auditlog-22.a.i Upload at least one piece of evidence (e.g., a tool configuration or screen capture from your application) that shows how you implement this protection in practice: collect admin audit logs for your backend environment where Platform Data is stored.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

auditlog-22.b

You indicated in a previous question that you store Platform Data in your backend environment.

Do you collect application event audit logs for this backend environment? Application events can include:
Input and output validation failures Authentication and access control failures Application errors and system events

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

• Yes
• No

If you select Yes above, you will be presented with:

auditlog-22.b.i Do these application event audit logs for your backend environment where Platform Data is stored include all of the following fields?
* Meta user ID (when shared with you) * Event type * Date and time * Success or failure indicator

• Yes
• No

Auditlog-22.b.ii Upload a written explanation (e.g., a policy or procedure document) that states your approach for collecting application event audit logs for your backend environment where Platform Data is stored.

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

Auditlog-22.b.iii Upload at least one piece of evidence (e.g., a tool configuration or screen capture from your application) that shows how you implement this protection in practice: collect application event audit logs for your backend environment where Platform Data is stored.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

auditlog-22.c

You indicated in a previous question that you store Platform Data in your backend environment.

Do you have policies or procedures in place to prevent unauthorized access and tampering with audit logs for this backend environment?

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

• Yes
• No

auditlog-22.d

You indicated in a previous question that you store Platform Data in your backend environment.

For this environment, do you retain audit logs for at least 30 days?

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

• Yes
• No

auditlog-22.e

You indicated in a previous question that you store Platform Data in your backend environment.

Do you use an automated solution to review application event audit logs for this backend environment in order to find indicators of everyday security events or incidents that result in risk or damage (e.g., attempts to bypass access controls or exploit software vulnerabilities)?

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

Yes/No

If you select Yes above, you will be presented with:

Auditlog-22.e.i Do you review these application event audit logs for your backend environment where Platform Data is stored at least every 7 days?

Yes/No

auditlog-22.e.ii Upload a written explanation (e.g., a policy or procedure document) that states how you review application event audit logs for your backend environment where Platform Data is stored at least every 7 days.

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

auditlog-22.e.iii Upload at least one piece of evidence (e.g., a tool configuration or screen capture from your application) that shows how you implement this protection in practice: review application event audit logs for your backend environment where Platform Data is stored at least every 7 days.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

auditlog-22.f

You indicated in a previous question that you store Platform Data in your backend environment.

Do you review admin audit logs for this environment in order to find indicators of everyday security events or incidents that result in risk or damage (e.g., attempts to bypass access controls or exploit software vulnerabilities)?

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

Yes/No

auditlog-22.f.i

Do you review these admin audit logs for your backend environment where Platform Data is stored at least every 7 days?

Yes/No

If you select Yes above, you will be presented with:

auditlog-22.f.iijust Upload a written explanation (e.g., a policy or procedure document) that states your approach for reviewing admin audit logs for your backend environment where Platform Data is stored in order to find indicators of everyday security events or incidents at least every 7 days.

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

auditlog-22.g

You indicated in a previous question that you store Platform Data in your backend environment.

If you identify an everyday security event or incident that results in risk or damage to your audit logs for this backend environment, do you have a process to investigate further?

“Backend environment” refers to a cloud or server environment that your customers or clients can access remotely, such as a website or web API.

Reminder: If a security event or incident occurs, our policies require you to promptly report it to us.

• Yes
• No

If you select Yes above, you will be presented with:

auditlog-22.g.i Upload a written explanation (e.g., a policy or procedure document) that states how you investigate everyday security events or incidents in your backend environment where Platform Data is stored, which result in risk or damage to your audit logs.

Please highlight or circle where in your policy these conditions are outlined.

Please ensure files are not password protected. You can upload multiple files, maximum 2 GB each. We accept .xls, .xlsx, .csv, .doc, .docx, .pdf, .txt, .jpeg, .jpg, .png, .ppt, .pptx, .mov, .mp4, .zip and .zipx.

securityprocesses-23

Do you have security processes in place for people who have access to Platform Data?

Such processes could include one or more of the following:
* Background checks completed before gaining access to Platform Data * Confidentiality agreements signed before gaining access to Platform Data * Training for new personnel on information security policies and procedures * Regular, ongoing security awareness training (i.e., annually) * Training related to specific job roles that access Platform Data * Return of assets (e.g., a laptop or mobile phone) upon separation from the organization

• Yes
• No