Compliance — Summary (2)

• HIPAA. Status: BAA on request. What that means for you: Contact support@rowfold.com; store PHI only once it is signed. • FedRAMP. Status: Not authorized. What that means for you: Not available for US federal use. • SOC 2. Status: No report. What that means for you: No Type I or Type II audit has been performed. • ISO 27001. Status: Not certified. What that means for you: No certification, no Statement of Applicability. • PCI DSS. Status: Out of scope. What that means for you: Card details go to Stripe and never reach RowFold. • GDPR / UK GDPR. Status: Obligations apply. What that means for you: We act as processor for workspace content; see section 05.