2022 | Confluent Legal

CONFLUENT CLOUDEBA Outsourcing Guidelines
Confluent Cloud Offering MappingThis document is intended to aid ﬁnancial institutions within the scope of the European Banking Authority’s mandate (“institutions”) to
consider the Guidelines on Outsourcing Arrangements (the “EBA Outsourcing Guidelines”) in the context of Confluent’s Cloud offeringand the Confluent Cloud Terms of Service (“ToS”). The main focus is on Section 13, Contractual Phase of the EBA Outsourcing Guidelines.
Below is commentary to support addressing the guidelines. If you have an existing Confluent Cloud agreement and would like tounderstand how this document applies to your agreement, please contact your Confluent account executive.
Note. The EBA Outsourcing Guidelines superseded the Committee of European Banking Supervisors (CEBS) guidelines on outsourcing(2016) and the EBA’s Recommendations on Outsourcing to Cloud Service Providers (2018).
EBA Outsourcing
Guidelines

Confluent Cloud
Commentary

References for Confluent Cloud
Services Agreement

Confluent clearly allocates the rights
and obligations in the ToS and ancillary
information, as set out below.

N/A

1.

13 Contractual phase2.

74. The rights and obligations of theinstitution, the payment institution andthe service provider should be clearly
allocated and set out in a writtenagreement

3.

75. The outsourcing agreement for criticalor important functions should set out
at least:

4.

a. a clear description of the outsourced
function to be provided;

The Cloud services are clearly outlined anddescribed here. Refer to the Cloud Services
Agreement which can be found here

Deﬁnitions

5.

b. the start date and end date, whereapplicable, of the agreement and thenotice periods for the service provider andthe institution or payment institution;

Refer to the ToS.

Term and Termination

6.

c. the governing law of the agreement;

Refer to the Confluent Cloud Services
Agreement.

Governing Law

7.

d. the parties’ ﬁnancial obligations;

Refer to your Confluent Cloud Services
Agreement.

Orders, Fees and Related© 2022 Confluent, Inc. | Confluent.io1

Confluent Legal | EBA Outsourcing Guidelines Confluent Cloud Offering Mapping

EBA Outsourcing
Guidelines

Confluent Cloud
Commentary8.

e. whether the sub-outsourcing of a criticalor important function, or material parts
thereof, is permitted and, if so, theconditions speciﬁed in Section 13.1 thatthe sub-outsourcing is subject to;Please see commentary on Section 13.1 at(rows 21-35).

9.

f. the location(s) (i.e., regions or countries)
where the critical or important function
will be provided and/or where relevant
data will be kept and processed, including
the possible storage location, andthe conditions to be met, including arequirement to notify the institution or
payment institution if the service provider
proposes to change the location(s);.

Locations10.

g. where relevant, provisions regarding theaccessibility, availability, integrity, privacy
and safety of relevant data, as speciﬁedin Section 13.2;

Please see commentary on Section 13.2
(rows 36-40).

11.

h. the right of the institution or payment
institution to monitor the service
provider’s performance on an ongoingbasis;

Customers can monitor Confluent’s
performance of the Services on an ongoingbasis using Confluent Cloud Status link https://status.confluent.cloud/. Customer
can also subscribe for updates.

Customer Content is stored in the available
Cloud Service region(s) determined andselected by Customerin its configuration of
the Cloud service.

References for Confluent Cloud
Services Agreement

Cloud Service Location,
Obligations of the data exporter,
Obligations of the data importer(Cloud Security Addendum andData Processing Agreement)

Service Level Agreement

Please see below regarding Cloud Service
Level Agreement.
12.

i.

the agreed service levels, which should
include precise quantitative andqualitative performance targets for theoutsourced function to allow for timely
monitoring so that appropriate corrective
action can be taken without undue delay
if the agreed service levels are not met;

© 2022 Confluent, Inc. | Confluent.io

For more information regarding Service
Level Agreement, please see: https://www.
confluent.io/confluent-cloud-uptime-sla/

Uptime Service Level Agreement2Confluent Legal | EBA Outsourcing Guidelines Confluent Cloud Offering Mapping

EBA Outsourcing
Guidelines

Confluent Cloud
Commentary

References for Confluent Cloud
Services Agreement

13.

j.

the reporting obligations of theservice provider to the institution or
payment institution, including thecommunication by the service providerof any development that may have amaterial impact on the service provider’sability to effectively carry out the criticalor important function in line with theagreed service levels and in compliancewith applicable laws and regulatory
requirements and, as appropriate, theobligations to submit reports of theinternal audit function of the service
provider;Confluent will provide information
concerning incidents that materially impact
Confluent’s ability to perform the Services
in accordance with the relevant SLAs. For
more information, please see Confluent
Cloud Status — https://status.confluent.
cloud/.

Uptime Service Level Agreement,
Availability and Disaster
Recovery

14.

k. whether the service provider should takemandatory insurance against certain
risks and, if applicable, the level of
insurance cover requested;

Confluent maintains insurance coverageagainst a number of identiﬁed risks. This is
not explicitly referenced in the ToS, but asummary of Confluent’s insurance coveragecan be made available to customers on
a confidential basis following a written
request.

N/A

15.

l.

the requirements to implement and test
business contingency plans;

Confluent has implemented a business
continuity plan for the Services, review andtest the plan at least annually, and ensure
the plan remains current with industry
standards.

Availability and Disaster
Recovery16.

m. provisions that ensure that the datathat are owned by the institution or
payment institution can be accessed in
the case of the insolvency, resolution or
discontinuation of business operations of
the service provider;

Customers retain all intellectual property
rights in their data. Confluent will enable
customers to access and export their data
throughout the duration of the Agreement.
Please see commentary on Section 13.4
(row 75).

Intellectual Property Ownership,
Term and Termination

N.B. Neither of these commitments are
disapplied in the event of Confluent’s
insolvency. Confluent does not havethe right to terminate for Confluent’s
own insolvency but customers can electto terminate. In the unlikely event ofConfluent’s insolvency, customers can referto these commitments when dealing withthe appointed insolvency practitioner.
17.

n. the obligation of the service provider tocooperate with the competent authorities
and resolution authorities of the institution
or payment institution, including otherpersons appointed by them;© 2022 Confluent, Inc. | Confluent.io

Confluent will cooperate with competentauthorities and resolution authorities
exercising their audit, information, andaccess rights.

Cooperation with supervisory
authorities3

Confluent Legal | EBA Outsourcing Guidelines Confluent Cloud Offering Mapping

EBA Outsourcing
Guidelines

Confluent Cloud
Commentary

References for Confluent Cloud
Services Agreement18.

o. for institutions, a clear reference tothe national resolution authority’s
powers, especially to Articles 68 and
71 of Directive 2014/59/EU (BRRD),
and in particular a description of the‘substantive obligations’ of the contract
in the sense of Article 68 of that
Directive;

To the extent that customers are
institutions (as defined above) and thus are
subject to the EBA Outsourcing Guidelines,
Confluent will to the extent necessary
include additional terms in Customer
agreements providing that Confluent
will continue to provide Services duringresolution as required by the national
resolution authority (BRRD), subject toCustomer’s continued compliance withthe terms of the agreement (including
continued payment of fees).

S9.3 DPA or 11.3 ToS

19.

p. the unrestricted right of institutions,payment institutions and competentauthorities to inspect and audit theservice provider with regard to, in
particular, the critical or important
outsourced function, as speciﬁed in
Section 13.3;

Please see commentary on Section 13.3
(rows 41-66).

20. q. termination rights, as speciﬁed in
Section 13.4.

Please see commentary on Section 13.4
(rows 67-77).

21.

13. 1 Sub-outsourcing of critical or important functions

22.

76. The outsourcing agreement should
specify whether or not sub-outsourcingof critical or important functions, ormaterial parts thereof, is permitted.

Confluent will provide customers withinformation about the organizations thatassist with subprocessing arrangements
in regards to Services. Please seecommentary on Section 13.1 (row 26).

Subprocessing

Confluent may engage subprocessors
to process Customer data. Confluent
maintains a list of its authorized
subprocessors on its website at https://www.confluent.io/sub-processors/.
Please see Section 4 of the Confluent
Customer DPA.
23.

77. If sub-outsourcing of critical or importantfunctions is permitted, institutions andpayment institutions should determine
whether the part of the function to be
sub-outsourced is, as such, critical orimportant (i.e. a material part of thecritical or important function) and, if so,record it in the register.

© 2022 Confluent, Inc. | Confluent.io

Confluent determines if a subprocessing
function is a critical or important function.
Confluent will provide all the information
required in the subprocessing register forour subcontractors.

Subprocessing

4Confluent Legal | EBA Outsourcing Guidelines Confluent Cloud Offering Mapping

EBA Outsourcing
Guidelines

Confluent Cloud
Commentary

References for Confluent Cloud
Services Agreement24.

78. If sub-outsourcing of critical or importantfunctions is permitted, the writtenagreement should:

25.

a. specify any types of activities that are
excluded from sub-outsourcing;Please see commentary on Section 13.1
(row 22).

26.

b. specify the conditions to be complied within the case of sub-outsourcing;

Confluent will provide information
concerning subprocessors, advance noticeof changes to subprocessors, and give
Customers the ability to terminate their
Agreement over concerns about a new
subprocessor.

Subprocessing

27.

c. specify that the service provider isobliged to oversee those services thatit has subcontracted to ensure that allcontractual obligations between theservice provider and the institution or
payment institution are continuously met;

Confluent will oversee the performanceof all subprocessor obligations and ensure
subprocessors comply with respective
Customer Agreements.

Subprocessing, Disclosure of
subprocessor agreements

28.

d. require the service provider to obtain priorspeciﬁc or general written authorisationfrom the institution or payment
institution before sub-outsourcing data;

Confluent will comply with obligations
under the GDPR regarding authorization
for subprocessing.

Subprocessing

29.

e. include an obligation of the service
provider to inform the institution or
payment institution of any planned suboutsourcing, or material changes thereof,in particular where that might affect theability of the service provider to meet its
responsibilities under the outsourcing
agreement. This includes planned
signiﬁcant changes of subcontractors andto the notiﬁcation period; in particular,
the notiﬁcation period to be set should
allow the outsourcing institution or
payment institution at least to carryout a risk assessment of the proposedchanges and to object to changes before
the planned sub-outsourcing, or materialchanges thereof, come into effect;

Customers will be informed of a
subprocessor change in order to allow a risk
assessment to be performed before thechange comes into effect. Confluent will
provide Customers with reasonable priornotice on its website if it intends to makeany changes to its subprocessors.

Subprocessor Updates© 2022 Confluent, Inc. | Confluent.io5

Confluent Legal | EBA Outsourcing Guidelines Confluent Cloud Offering Mapping

EBA Outsourcing
Guidelines
30. f. ensure, where appropriate, that theinstitution or payment institution has
the right to object to intended suboutsourcing, or material changes thereof,or that explicit approval is required;

Confluent Cloud
Commentary

References for Confluent Cloud
Services Agreement

Customers may object in writing toConfluent’s appointment of a new
subprocessor, provided that such objection
is based on reasonable grounds relating
to data protection. In such an event, theparties will discuss such concerns in goodfaith with a view to achieving resolution.

Subprocessor Updates

N.B., The European Banking Authority
acknowledges that explicit consent is“overly burdensome” in the context of cloud
outsourcing.
Customers may suspend or terminate theirrespective Agreement if a resolution cannot
be met.

Subprocessor Updates

a. comply with all applicable laws,
regulatory requirements and contractual
obligations; andConfluent contractually requires
subprocessors to follow the standard
required EU Data Protection Laws tofacilitate Confluent’s compliance with its
obligations to its customers.

Subprocessor Obligations

b. grant the institution, payment institution
and competent authority the same
contractual rights of access and audit as
those granted by the service provider.

Subprocessing does not diminish
Customers’ ability to oversee the service
or the competent authority’s ability tosupervise the Customer. Confluent will
ensure subprocessors comply with theinformation, access, and audit rights
provided to Customers and competentauthorities.

Subprocessing

31.

g. ensure that the institution or payment
institution has the contractual right toterminate the agreement in the case ofundue sub-outsourcing, e.g. where thesub-outsourcing materially increases
the risks for the institution or payment
institution or where the service provider
sub-outsources without notifying theinstitution or payment institution.

32.

79. Institutions and payment institutions
should agree to sub-outsourcing only if
the subcontractor undertakes to:

33.

34.

© 2022 Confluent, Inc. | Confluent.io6

Confluent Legal | EBA Outsourcing Guidelines Confluent Cloud Offering Mapping

EBA Outsourcing
Guidelines

Confluent Cloud
Commentary

35.

80. Institutions and payment institutions
should ensure that the service provider
appropriately oversees the sub-service
providers, in line with the policy deﬁned
by the institution or payment institution.
If the sub-outsourcing proposed could
have material adverse effects on theoutsourcing arrangement of a critical orimportant function or would lead to amaterial increase of risk, including where
the conditions in paragraph 79 would
not be met, the institution or payment
institution should exercise its right toobject to the sub-outsourcing, if such aright was agreed, and/or terminate
the contract.

Please see commentary on Section 13.1 (row27, 30-31).

36.

13.2 Security of data and systems

37.

81. Institutions and payment institutions
should ensure that service providers,
where relevant, comply with appropriate
IT security standards.

References for Confluent Cloud
Services Agreement

Confluent hires accredited third parties
to perform audits and to attest to various
compliance standards and certifications
annually including:- SSAE 18 SOC 1 Type II, SOC 2 Type II, and
SOC 3- Payment Card Industry Data Security
Standards (PCI-DSS) – Confluent can
support PCI data that is message-levelencrypted by Customer- CSA Star Level 1 Attestation- ISO 27001 certification
Further details can be found on the
Confluent Trust and Security Compliance
Page here.

© 2022 Confluent, Inc. | Confluent.io7

Confluent Legal | EBA Outsourcing Guidelines Confluent Cloud Offering Mapping

38.

EBA Outsourcing
Guidelines

Confluent Cloud
Commentary

References for Confluent Cloud
Services Agreement

82. Where relevant (e.g. in the context
of cloud or other ICT outsourcing),
institutions and payment institutions
should deﬁne data and system security
requirements within the outsourcing
agreement and monitor compliance withthese requirements on an ongoing basis.

Confluent implements layered security
controls designed to protect and secure
Confluent Cloud customer data. We
incorporate multiple logical and physicalsecurity controls including accessmanagement, least privilege, strong
authentication, logging and monitoring,vulnerability management, bug bounty
programs, and many others. To learn more
about our security controls for Confluent
Cloud, please see:Privacy and Security- Confluent Cloud Security Addendum- Confluent Cloud whitepaper- Confluent Cloud public documentation
83. In the case of outsourcing to cloudservice providers and other outsourcing
arrangements that involve the handlingor transfer of personal or conﬁdential
data, institutions and payment
institutions should adopt a risk-based
approach to data storage and dataprocessing location(s) (i.e. country
or region) and information security
considerations.

Content is stored in the available Cloud
Service region(s) specified by Customers intheir setup and configuration of the Cloud
service.

40. 84. Without prejudice to the requirements
under the Regulation (EU) 2016/679,
institutions and payment institutions,when outsourcing (in particular to third
countries), should take into accountdifferences in national provisions
regarding the protection of data.
Institutions and payment institutions
should ensure that the outsourcing
agreement includes the obligationthat the service provider protects
conﬁdential, personal or otherwise
sensitive information and complies withall legal requirements regarding theprotection of data that apply to theinstitution or payment institution (e.g.
the protection of personal data andthat banking secrecy or similar legal
conﬁdentiality duties with respect toclients’ information, where applicable,
are observed).

Confluent implements layered security
controls designed to protect and secure
Confluent Cloud customer data. Please seecommentary on Section 13.2 (rows 37-38).

39.

© 2022 Confluent, Inc. | Confluent.io

Cloud Service Location

Please see commentary on Section 13(row 9).

Privacy and Security, Confluent
Cloud Customer Data Processing
Addendum and Security
AddendumSee our Confluent Customer Data
Processing Addendum here for more
information.
Please also see the Confluent Cloud Trustand Security Page.

8

Confluent Legal | EBA Outsourcing Guidelines Confluent Cloud Offering Mapping

EBA Outsourcing
Guidelines

Confluent Cloud
Commentary

References for Confluent Cloud
Services Agreement41.

13.3 Access, information and audit rights

42.

85. Institutions and payment institutions
should ensure within the written
outsourcing arrangement that theinternal audit function is able to review
the outsourced function using a riskbased approach.

To the extent that customers are
institutions (as defined above) and thus are
subject to the EBA Outsourcing Guidelines,
Confluent will to the extent necessary
include additional terms in Customer
agreements to ensure that the institution
has the ability to review reasonable
documentation relating to any outsourced
function within our Services.

Obligations of data importer,
Cooperation with supervisory
authority

43.

86. Regardless of the criticality or importanceof the outsourced function, the written
outsourcing arrangements between
institutions and service providers shouldrefer to the information gathering andinvestigatory powers of competentauthorities and resolution authorities
under Article 63(1)(a) of Directive
2014/59/EU and Article 65(3) of Directive
2013/36/EU with regard to service
providers located in a Member Stateand should also ensure those rights withregard to service providers located inthird countries.

Confluent accepts the information
gathering and investigatory powers ofcompetent authorities under the relevant
EU Directives.

Cooperation with supervisory
authority

44.

87. With regard to the outsourcing of criticalor important functions, institutions andpayment institutions should ensure within
the written outsourcing agreement thatthe service provider grants them andtheir competent authorities, including
resolution authorities, and any otherperson appointed by them or thecompetent authorities, the following:

To the extent that customers are
institutions (as defined above) and thus are
subject to the EBA Outsourcing Guidelines,
Confluent will to the extent necessary
include additional terms in Customer
agreements to grant audit, access,and information rights to institutions,competent authorities (including resolution
authorities), and both their appointees inrespect of Confluent’s premises.

Obligations of data importer,
Cooperation with supervisory
authority

a. full access to all relevant businesspremises (e.g. head ofﬁces and operation
centres), including the full range of
relevant devices, systems, networks,
information and data used for providing
the outsourced function, including related
ﬁnancial information, personnel andthe service provider’s external auditors(‘access and information rights’); andPlease see commentary on Section 13.3
(row 44).

45.

© 2022 Confluent, Inc. | Confluent.io

Confluent Cloud Security
Addendum

9Confluent Legal | EBA Outsourcing Guidelines Confluent Cloud Offering Mapping

EBA Outsourcing
Guidelines

Confluent Cloud
Commentary46.

b. unrestricted rights of inspection andauditing related to the outsourcing
arrangement (‘audit rights’), to enable
them to monitor the outsourcing
arrangement and to ensure compliancewith all applicable regulatory andcontractual requirements.

Please see commentary on Section 13.3
(row 44).

47.

88. For the outsourcing of functions thatare not critical or important, institutions
and payment institutions should ensure
the access and audit rights as set out inparagraph 87 (a) and (b) and Section 13.3,
on a risk-based approach, considering thenature of the outsourced function andthe related operational and reputationalrisks, its scalability, the potential impact
on the continuous performance of its
activities and the contractual period.
Institutions and payment institutions
should take into account that functions
may become critical or important
over time.

Please see commentary on Section 13.3
(row 42).

48. 89. Institutions and payment institutions
should ensure that the outsourcing
agreement or any other contractual
arrangement does not impede or limit theeffective exercise of the access and audit
rights by them, competent authoritiesor third parties appointed by them toexercise these rights.

Please see commentary on Section 13.3
(row 42).

49.

Institutions will determine the audit
frequency and scope. Confluent can discuss
further details with institutions.

90. Institutions and payment institutions
should exercise their access and audit
rights, determine the audit frequency
and areas to be audited on a risk-based
approach and adhere to relevant,commonly accepted, national andinternational audit standards.

© 2022 Confluent, Inc. | Confluent.io

References for Confluent Cloud
Services Agreement

Obligations of data importer,
Cooperation with supervisory
authority
Confluent DPA Section 7

10

Confluent Legal | EBA Outsourcing Guidelines Confluent Cloud Offering Mapping

EBA Outsourcing
Guidelines

Confluent Cloud
Commentary

References for Confluent Cloud
Services Agreement

Obligations of data importer,
Cooperation with supervisory
authority

50. 91. Without prejudice to their ﬁnal
responsibility regarding outsourcing
arrangements, institutions and payment
institutions may use:
51.

a. pooled audits organised jointly with otherclients of the same service provider, andperformed by them and these clients orby a third party appointed by them, touse audit resources more efﬁciently andto decrease the organisational burden on
both the clients and the service provider;

Confluent can discuss further details withinstitutions around pooled audits.

52.

b. third-party certiﬁcations and third-party
or internal audit reports, made available
by the service provider.

Please see commentary on Section 13.2
(row 37).

53.

92. For the outsourcing of critical orimportant functions, institutions andpayment institutions should assess
whether third-party certiﬁcations andreports as referred to in paragraph 91(b)are adequate and sufﬁcient to comply
with their regulatory obligations andshould not rely solely on these reports
over time.

This is an institution responsibility.

54.

93. Institutions and payment institutions
should make use of the method referred
to in paragraph 91(b) only if they:55.

a. are satisﬁed with the audit plan for theoutsourced function;

Please see commentary on Section 13.2
(row 37).

56.

b. ensure that the scope of the certiﬁcation
or audit report covers the systems (i.e.
processes, applications, infrastructure,
data centres, etc.) and key controls
identiﬁed by the institution or payment
institution and the compliance with
relevant regulatory requirements;

Please see commentary on Section 13.2
(row 37).

57.

c. thoroughly assess the content of thecertiﬁcations or audit reports on an
ongoing basis and verify that the reports
or certiﬁcations are not obsolete;

Please see commentary on Section 13.2
(row 37).

58. d. ensure that key systems and controls
are covered in future versions of thecertiﬁcation or audit report;© 2022 Confluent, Inc. | Confluent.io

Please see commentary on Section 13.2
(row 37).

11

Confluent Legal | EBA Outsourcing Guidelines Confluent Cloud Offering Mapping

EBA Outsourcing
Guidelines

Confluent Cloud
Commentarye. are satisﬁed with the aptitude of thecertifying or auditing party (e.g. withregard to rotation of the certifying
or auditing company, qualiﬁcations,expertise, reperformance/veriﬁcation of
the evidence in the underlying audit ﬁle);Please see commentary on Section 13.2
(row 37).

60. f. are satisﬁed that the certiﬁcations areissued and the audits are performed
against widely recognised relevant
professional standards and include a testof the operational effectiveness of the
key controls in place;

Please see commentary on Section 13.2
(row 37).

61.

g. have the contractual right to request
the expansion of the scope of thecertiﬁcations or audit reports to otherrelevant systems and controls; thenumber and frequency of such requests
for scope modiﬁcation should bereasonable and legitimate from a risk
management perspective; andInstitutions can request an expansion of
the scope of the relevant certifications andaudit reports.

62.

h. retain the contractual right to perform
individual audits at their discretion withregard to the outsourcing of critical orimportant functions.

Please see commentary on Section 13.3
(row 44).

63.

94. In line with the EBA Guidelines on ICT risk
assessment under the SREP, institutions
should, where relevant, ensure that they
are able to carry out security penetration
testing to assess the effectiveness of
implemented cyber and internal ICT
security measures and processes. Taking
into account Title I, payment institutions
should also have internal ICT control
mechanisms, including ICT security
control and mitigation measures.

Confluent contracts with professional
penetration testing service providers
at least twice per year for this service
and we make a summary of the reportavailable upon request. Additionally, we
have implemented a bug bounty programand have invited a number of individuals
to perform security testing against theservices on a continual basis.

59.

© 2022 Confluent, Inc. | Confluent.io

References for Confluent Cloud
Services Agreement

Confluent Security Compliance,
Certifications, and Third-party
Attestations, Obligations of thedata exporter

Vulnerability Management andPenetration Testing

In the event that institutions would like
additional assurance, we are happy to
discuss an off-cycle penetration test.

12Confluent Legal | EBA Outsourcing Guidelines Confluent Cloud Offering Mapping

64.

65.

EBA Outsourcing
Guidelines

Confluent Cloud
Commentary

References for Confluent Cloud
Services Agreement

95. Before a planned on-site visit,
institutions, payment institutions,competent authorities and auditors
or third parties acting on behalf of
the institution, payment institution orcompetent authorities should provide
reasonable notice to the service provider,unless this is not possible due to an
emergency or crisis situation or would
lead to a situation where the audit would
no longer be effective.

Reasonable notice enables Confluent todeliver an effective audit to any institution(as defined above) which is subject to the
EBA Outsourcing Guidelines.

Obligations of the data exporter

96. When performing audits in multi-client
environments, care should be taken to
ensure that risks to another client’s
environment (e.g. impact on service
levels, availability of data, conﬁdentiality
aspects) are avoided or mitigated.

It is extremely important to Confluentthat what we do with one customer should
not put any other customers at risk. Thisapplies when you perform an audit. It also
applies when any other customer performs
an audit.

Confluent DPA Section 7

Notice also enables Confluent to plan theaudit so that it does not create undue risk
to a customer’s environment or that of any
other Confluent customer.
Confluent recognizes that in some cases
extended notice may not be possible. In
these cases, we will work with the auditing
party to address their needs.
Obligations of the data exporter

When an institution performs an audit,
we will work with them to minimize thedisruption to our other customers. Just
as we will work with another auditing
customer to minimize the disruption to theinstitution. In particular, we will be careful
to comply with our security commitments
at all times.
66.

97. Where the outsourcing arrangement
carries a high level of technicalcomplexity, for instance in the caseof cloud outsourcing, the institution
or payment institution should verify
that whoever is performing the audit– whether it is its internal auditors, thepool of auditors or external auditors
acting on its behalf – has appropriate andrelevant skills and knowledge to perform
relevant audits and/or assessments
effectively. The same applies to any staffof the institution or payment institution
reviewing third-party certiﬁcations or
audits carried out by service providers.

© 2022 Confluent, Inc. | Confluent.io

This is an institution responsibility.

13Confluent Legal | EBA Outsourcing Guidelines Confluent Cloud Offering Mapping

EBA Outsourcing
Guidelines

Confluent Cloud
Commentary

References for Confluent Cloud
Services Agreement

68. 98. The outsourcing arrangement should
expressly allow the possibility for the
institution or payment institution
to terminate the arrangement, in
accordance with applicable law, includingin the following situations:

Institutions may discontinue its use ofServices at any time for any reason byfollowing the process in the Confluent
website interface to “Delete” anInstitution’s purchased Cloud Service.

Term and Termination

69.

a. where the provider of the outsourced
functions is in a breach of applicable law,regulations or contractual provisions;

Please see commentary on Section 13.4
(row 68).

70.

b. where impediments capable of altering
the performance of the outsourced
function are identiﬁed;

Please see commentary on Section 13.4
(row 68).

71.

c. where there are material changes
affecting the outsourcing arrangement or
the service provider (e.g. sub-outsourcing
or changes of sub-contractors);

Please see commentary on Section 13.4
(row 68).

72.

d. where there are weaknesses regarding
the management and security of
conﬁdential, personal or otherwise
sensitive data or information; andPlease see commentary on Section 13.4
(row 68).

73.

e. where instructions are given by theinstitution’s or payment institution’scompetent authority, e.g. in the case thatthe competent authority is, caused by
the outsourcing arrangement, no longer
in a position to effectively supervise theinstitution or payment institution.

Please see commentary on Section 13.4
(row 68).

74.

99. The outsourcing arrangement should
facilitate the transfer of the outsourced
function to another service provider or its
re-incorporation into the institution or
payment institution. To this end, thewritten outsourcing arrangement should:

75.

a. clearly set out the obligations of theexisting service provider, in the case ofa transfer of the outsourced function
to another service provider or back to
the institution or payment institution,
including the treatment of data;

67.

13.4 Termination rights

Customer is solely responsible forexporting Content from the Cloud Service
prior to expiration or termination of thisAgreement. Customer acknowledges that
following termination it will have no further
access to any Content. For assistancewith exporting Content, please submit aSupport ticket or reach out to your AccountExecutive.

Term and Termination, Data
Export (Confluent Customer
Data Processing Addendum
and Confluent Cloud Security
Addendum)

Please see the Confluent Cloud Exit
Assistance Document on our Confluent
Cloud Trust and Security Page
© 2022 Confluent, Inc. | Confluent.io

14

Confluent Legal | EBA Outsourcing Guidelines Confluent Cloud Offering Mapping

EBA Outsourcing
Guidelines

Confluent Cloud
Commentary76.

b. set an appropriate transition period,
during which the service provider, after
the termination of the outsourcing
arrangement, would continue to provide
the outsourced function to reduce the riskof disruptions; andPlease see commentary on Section 13.4
(row 75).

77.

c. include an obligation of the service
provider to support the institution
or payment institution in the orderlytransfer of the function in the eventof the termination of the outsourcing
agreement.

Please see commentary on Section 13.4
(row 68).

References for Confluent Cloud
Services Agreement

Prepared by Confluent Legal and InfoSec | Updated 2022

© 2022 Confluent, Inc. | Confluent.io15