Version : 1.0, Last Updated on : 14 OCT 2026
Posted Personal Data by specific IQAX Subprocessors set out in ANNEX 1 to this Addendum are subject to the technical and organisational security measures as described at https://content.iqax.com/data-protection-addendum/sub-processor/data-processing-addendum.pdf.
Subject to the foregoing, the following measures apply to all other Processing of Posted Personal Data in connection with the Agreement:
- Network security and encryption:
- IQAX implements network security such as firewalls, content filtering, network segmentation, cloud security posture management, regular vulnerability scanning and API management.
- IQAX looks to maintain and protect the confidentiality, integrity and availability of Platform Personal Data using measures such as encryption, role base access control, redundancy copies and backups.
- Data transmission to and from the GSBN Platform is encrypted using encryption such as TLS 1.2. IQAX enables disk encryption for each system component or service that stores data. If a Service includes management of cryptographic keys, IQAX maintains procedures for secure key generation, issuance, distribution, storage, rotation, revocation, recovery, backup, destruction, access and use.
- Physical media intended for off-site storage, if any, such as media containing backup files, will be encrypted prior to transport.
- Distributed ledger components:
- In relation to the distributed ledger components of the GSBN Platform, GSBN applies the following technical and organisational measures to reduce the risk of linkability between on-chain organisational identifiers and off-chain identifiable Posted Personal Data:
- the blockchain ledger records only cryptographic hashes of transactional references, which are designed to evidence the occurrence and integrity of organisational transactions and do not, in themselves, disclose the content of underlying documents or Posted Personal Data;
- the ledger does not store user identifiers, Posted Personal Data fields, or user-level metadata, and does not contain mappings between on-chain transaction records and individual user identities;
- linkage between organisational accounts, transactions and individual user accounts is maintained exclusively within GSBN-managed off-chain systems subject to the remainder of these TOMs for access control, auditability and operational purposes;
- off-chain systems that maintain such linkage are logically and technically segregated from the blockchain ledger environment;
- access to any off-chain account-linkage data is restricted through role-based access controls and limited to authorised personnel and systems on a need-to-know basis;
- user-level logs, audit trails and access records are generated, stored and Processed exclusively off-chain and are not written to, or derivable from, the blockchain ledger; and
- GSBN does not operate any functionality that permits correlation of on-chain ledger records with off-chain Posted Personal Data without access to GSBN-managed systems and the Controller’s cooperation.
- In relation to the distributed ledger components of the GSBN Platform, GSBN applies the following technical and organisational measures to reduce the risk of linkability between on-chain organisational identifiers and off-chain identifiable Posted Personal Data:
- Access control/security policies:
- IQAX implements measures designed to logically separate and prevent the Services from being exposed to, or accessed by, unauthorised persons.
- IQAX classifies Platform Personal Data and manages it according to IQAX’s access control and handling procedure.
- If IQAX requires access to data to provide the Services, and if such access is managed by IQAX, IQAX will restrict access to the minimum level required. Such access, including administrative access to any underlying components (privileged access), will be individual, role-based, and subject to approval and regular validation by authorised IQAX personnel following principles of segregation of duties.
- IQAX implements measures to identify and remove redundant and dormant accounts with privileged access and will promptly revoke such access upon the account owner’s separation or upon the request of authorised IQAX personnel, such as the account owner’s manager.
- IQAX maintains, for a reasonable period of time, audit logs of system usage and activity. IQAX maintains and follows its standard employment verification requirements for all new hires (including hires by wholly-owned IQAX subsidiaries). In accordance with IQAX internal processes and procedures, these requirements will be periodically reviewed and include educational and professional qualifications check, previous employment, character reference, proof of identity validation (HKID, Passport Number etc.), and additional checks as deemed necessary by IQAX.
- IQAX is responsible for implementing these requirements in its hiring process as applicable and permitted under local laws.
- IQAX maintains and follows IT security policies and practices to control IQAX employees accessing IT systems. Access requests are assessed based on role and granted on a need-to-know basis.
- Physical security measures:
- IQAX uses cloud providers that adhere to ISO27001 compliant physical and environmental security controls to define a physical security perimeter and implement physical security controls securing offices, rooms, and facilities, against external and environmental threats, and to ensure these areas are secure.
- Aside from customer connections and certain services/web sites which are intended to be accessed via Internet, connections to IQAX Cloud Services networks are restricted.
- To the extent supported by native device and operating system functionality, IQAX will maintain computer protections including endpoint firewalls, full disk encryption, signature-based malware detection and removal, time-based screen locks, and endpoint management solutions that enforce security configuration and patching requirements.
- IQAX may use wireless networking technology, including to provide maintenance and support for the Services and associated Components. Such wireless networks communication will be encrypted and require secure authentication and will not provide direct access to IQAX cloud services networks.
- Application security testing: IQAX uses industry standard systems for application code vulnerability assessment and testing.
- API security:
- IQAX uses industry standard systems to manage, control and protect its APIs from cybersecurity threats.
- IQAX will maintain a documented security architecture for Services as a whole. IQAX will separately review such security architecture, including measures designed to prevent unauthorized network connections to systems, applications and network devices, for compliance with its network segmentation, isolation, and defence-in-depth standards prior to implementation.
- Threat detection and response:
- IQAX uses industry standard systems for security vulnerability scanning and malicious activity monitoring, detection, blocking and forensics on its servers.
- IQAX maintains an appropriate level of DDOS protection for its online systems. IQAX maintains an inventory of information technology systems used by it in the provision of the Services.
- IQAX continuously monitors and manages the health, including capacity and availability of the Services and underlying components.
- IQAX uses multiple third party public cloud services and each cloud vendor provides monitoring of privileged access and maintains security information and event management to:
(1) identify unauthorised access; and
(2) record access attempts (including where the wrong password is used). - IQAX monitors abnormal usage such as unauthorised access and aims to facilitate a timely and appropriate response to these kind of activities.
- Logs in which privileged access and activity are recorded are retained in compliance with IQAX policies and procedures. IQAX implements measures designed to protect against unauthorised access, modification, and accidental or deliberate destruction of such logs.
- Patches and updates:
- IQAX takes steps to ensure that systems it uses to Process Platform Personal Data are kept up to date with the latest patches for known security vulnerabilities.
- IQAX maintains policies and procedures designed to manage risks associated with the application of changes to the Services. Prior to implementation, changes to a Service, including its systems, networks, and underlying components, will be documented internally including recording a description of and reason for the change, implementation details and schedule, a risk statement addressing impact to the Services and IQAX’s clients, expected outcome, rollback plan, and documented approval by authorised personnel.
- Business continuity management: IQAX maintains regular backups to ensure that the most important data on its systems can be recovered and systems can be restored in the event of a disaster, malware or ransomware attack or cyber security incident.
- ISO 27001 compliance: IQAX maintains up-to-date certification of compliance with ISO 27001 information security standards, provided that initial certification of compliance is due to take place by the end of 2021.