Espressive   CUEC

Espressive Complimentary User Entity Controls (CUEC)
‍
Revised 03/2024, Reviewed 01/2025

Downloadable link here
‍

The Company's service offering divides the responsibility for security between Espressive and Customer. Theprimary responsibility for data integrity and protection lies with The Company, but some business needs demandthat Customer establish policies for certain aspects of their interactions with the service. This document formalizes the intended controls that the Customer is responsible for and should implement to ensure a secure operating environment.
‍

1. Customer is responsible for the use of Services by their employees, contractors, or other designated personnel (hereafter Users).
2. Customer must establish policies and inform its Users of acceptable business use of the service if no Customer policy already applies to third-party systems.
3. Customer is responsible for establishing and enforcing information security and privacy policies as it relates to the use of the system and the data stored within the system.
4. Customer is responsible for notifying Espressive when personally identifiable information (PII) or any other type of sensitive information has been entered into the system and should be deleted from the system.
5. Customer is responsible for assessing risk related to the implementation of the service, including, but not limited to, information security risk assessments and data privacy impact analysis (DPIA’s).
6. Customer is responsible for implementing and configuring an identity and access management system that is supported by and is compatible with the system.
7. Customer is responsible for ensuring access is granted only to authorized Users.
8. Customer is responsible for ensuring appropriate access levels and roles are granted to Users.
9. Customer is responsible for implementing password policy restrictions for Users.
10. Customer is responsible for ensuring the confidentiality of User accounts used to access the Service.
11. Customer is responsible for notifying Espressive of any security breaches or unauthorized disclosures involving the Service or any access or credentials thereof.
12. Customer is responsible for defining User system security and access controls and Espressive is responsible for executing those controls as defined.
13. Customer is responsible for ensuring consent from data subjects prior to processing or storing personal data by the system.
14. Customer is responsible for validating, responding to and processing data subject access requests, and, when applicable, notifying Espressive, as the processor, within 5 business days of receipt, as required by applicable privacy laws.
15. Customer is responsible for activating and configuring PII masking, an Espressive optional feature, which is deactivated by default, to minimize the possibility of processing or storing personal or sensitive data by the system.
16. Customer is responsible for configuring data retention periods in the system.
17. Customer is responsible for opting-in to analytical processing.