SECURITY MEASURES

Last Updated: September 25, 2026

This Security Measures document ("Security Measures") is incorporated into and forms part of the Terms of Service located at https://joylabs.com/legal/terms-of-service ("Terms of Service") between Joy Labs Ventures LLC doing business as Laneful ("Laneful") and Customer. Capitalized terms used but not defined in these Security Measures have the meanings set forth in the Terms of Service. In the event of a conflict between these Security Measures and the Terms of Service, the Terms of Service shall control. Laneful will implement and maintain appropriate technical and organizational measures designed to protect Customer Data. The following constitute the baseline security controls applicable to the Services. Laneful reserves the right to update these controls from time to time in its sole discretion to reflect industry best practices, provided such updates do not materially diminish the overall security of the Services.

  1. Authentication and Access Controls

    1. Administrative Access. Laneful requires secure authentication methods for administrative access to production environments, including support for multi-factor authentication (MFA) or passkey-based authentication.

    2. Credential Restrictions. Laneful’s platform supports the ability for Customer to restrict API keys and credentials by IP range (allowlisting) as a configurable feature.

    3. Interface Access. Laneful supports the ability for Customer to restrict dashboard (web interface) access by IP range as a configurable feature.

    4. Access Logging. Laneful maintains audit trails logging API and web interface access, which are searchable and filterable by Customer for their respective environment.

  2. Data Security and Isolation

    1. Transmission Security. Laneful enforces HTTPS (TLS 1.2 or higher) for all endpoints, including tracking, unsubscribe, redirect URLs, and webhook endpoints. Where Laneful offers custom domain functionality, Laneful manages certificate issuance and renewal to ensure secure transmission.

    2. Logical Segregation. Laneful logically segregates Customer Data from other customers’ data within the production environment to ensure that Customer Data is accessible only to the authorized Customer tenant or users associated with Customer.

  3. Application Security

    1. Webhook Security. Laneful signs webhook payloads to allow Customer to verify the origin and integrity of requests. Laneful provides documentation regarding signature verification best practices.

    2. Suppression Management. Laneful maintains automatic suppression mechanisms for unsubscribes and hard bounces to reduce repeated delivery attempts and protect sender reputation.

  4. Vulnerability and Threat Management

    1. Vulnerability Scanning. Laneful performs regular vulnerability scans of infrastructure and applications and applies critical patches in accordance with industry standard timelines based on risk severity.

    2. Penetration Testing. Laneful conducts periodic third-party penetration tests of the Services. Laneful may make a summary of the penetration test findings available to Customer upon request, subject to Laneful’s confidentiality obligations.

    3. Security Incident Response. Laneful maintains documented incident response procedures to detect, respond to, and contain Security Incidents. Laneful will notify Customer of a Security Incident affecting Customer Data in accordance with the notice provisions set forth in the Data Protection Addendum located at https://joylabs.com/legal/data-protection-addendum ("DPA").

  5. Resilience and Availability

    1. Backup and Recovery. Laneful maintains backup or replication mechanisms designed to enable restoration of Customer Data in the event of a system failure.

    2. Business Continuity. Laneful maintains business continuity and disaster recovery plans designed to maintain the availability of the Services in the event of a significant disruption.

  6. Subprocessor and Data Lifecycle Management

    1. Subprocessor Oversight. Laneful contractually requires Subprocessors to adhere to data protection obligations at least as restrictive as those contained in the DPA.

    2. Data Deletion. Upon termination of the Terms of Service or Customer’s written request (where required by law), Laneful will delete or anonymize Customer Data in accordance with the data retention and deletion provisions set forth in the DPA.

  7. Shared Responsibility. Customer acknowledges that the effectiveness of certain security controls depends on Customer’s configuration and use of the Services. Customer remains solely responsible for the following:

    1. configuring authentication settings, IP restrictions, and API key permissions appropriately for its use case;

    2. securing Customer’s own account credentials and administrative access;

    3. implementing appropriate protections for Customer’s webhook endpoints (including signature verification, rate limiting, and idempotency handling); and

    4. complying with all applicable laws regarding the collection and processing of Customer Data prior to submission to the Services.