Orange County NC Website
Browse       Search
<br />7. Is the Cloud provider obligated to inform the County of all locations in which the data is <br />stored (including backups) and to continually keep the County informed of any changes <br />to those locations? <br />a. Yes <br /> <br />If No, Explain: <br /> <br />8. What are the Cloud provider’s contractual obligations with respect to litigation holds on <br />County data? <br />a. We don’t hold our client data hostage. At any point the County will be able to pull <br />down your files. <br /> <br />9. What are the Cloud provider’s contractual prohibitions on disclosing data to individuals, <br />groups or organizations making record requests, unless so directed by an authorized <br />County official? <br />a. PhotoShelter does not release any client data to anyone outside of the client <br />organization. <br /> <br />10. Does the contract obligate the Cloud provider to allow third-party audits and/or <br />certifications related to infrastructure and security, including penetration testing and <br />vulnerability assessment, as requested by the County? <br />a. No. <br /> <br />If No, Explain: Not contractually. Regarding the security of the system, we already <br />employ two separate outside scanning vendors called Comodo and Nessus. These <br />two services scan our system both daily and monthly for vulnerabilities at the OS, <br />Network, and Application levels as well as across our two data centers and <br />corporate environment. PhotoShelter could happily provide a copy of the latest <br />certification. <br /> <br />11. Does the contract obligate the Cloud provider to allow third party onsite inspections of <br />the Cloud provider’s infrastructure and security practices on a specified basis? <br />a. No. <br /> <br />If No, Explain: Not contractually. We also would consider this to be a security risk to the <br />infrastructure. The two datacenters - one with Tel’x in the Google Building in <br />New York and one on the West Coast with Layer42 in Santa Clara - have state-- <br />of--the--art security including 24x7 guards, video surveillance, biometric entry <br />systems and servers housed in cages under lock and key. Take a tour of our <br />infrastructure with our VP of Network Operations: <br />https://librisblog.photoshelter.com/behind-the-scenes-with-libris-powering-a- <br />secure-reliable-network/ <br /> <br /> <br />12. Does the contract obligate the Cloud provider to provide security documentation upon <br />DocuSign Envelope ID: 576DD5DB-E4A9-406B-8F7C-CC4EF3C2484FDocuSign Envelope ID: 79107112-9BB9-477B-B662-FF2F869640FC