Rapid7, Inc.
Supplier Codeof Conduct®Rapid7 2022

Introduction
Rapid7 maintains principles to promote honest and ethical conduct, safe working
conditions, the protection of sensitive information, and the treatment of workers
with respect and dignity. This Supplier Code of Conduct (the “Code”) describes
Rapid7’s expectations for how our suppliers, contractors, service providers, andother business partners (each, a “Supplier”) will implement and adhere to thoseprinciples when conducting business with or on behalf of Rapid7. We expect thatSuppliers will embrace the values embedded in this Code and conduct business withintegrity, fairness, and respect. This Code should be viewed as the minimum
standards that we expect from our Partner community and is not intended to reduce,replace, or limit any other legal or contractual obligations that Suppliers have toRapid7. This Code is not intended to cover every applicable law or topic; for further
guidance, please contact Rapid7’s Legal Dept. Rapid7 may update this code at anytime.

Compliance with the Law
Rapid7 believes in acting ethically and obeying the law. Suppliers are expected tounderstand the legal and regulatory requirements governing their area ofresponsibility, including federal, state, and other applicable laws. While conducting
business with or on behalf of Rapid7, all Suppliers will act in full compliance with allapplicable laws and regulations of the jurisdictions in which they operate.

Anti-Corruption and Anti-Bribery
Exchanging gifts and extending hospitality can be a legitimate part of building
business relationships, when done in accordance with the law and this Code.
Suppliers must ensure that gifts and hospitality are not intended to be, or perceived
to be, bribes, kickbacks, or other forms of inappropriate influence to obtain or retain
business or to gain or appear to gain an improper business advantage. Rapid7
strictly prohibits any and all forms of bribery, corruption, kickbacks, extortion, andembezzlement whether directly or through a third party. This applies both indealings with public officials and individuals in the private sector.
Suppliers are also prohibited from all forms of money laundering, including
disguising transactions, channeling unlawfully obtained money, or transformingsuch money into legitimate funds. Suppliers will understand and comply with allapplicablelaws

andregulations,including those related to anti-bribery,anti-corruption, and anti-money laundering.
2Conflicts of Interest
Suppliers must refrain from engaging in actual or apparent conflicts of interest.
Conflicts of interest occur when personal interests or activities may influence theability to act objectively in connection with the promotion, sale, or distribution of
Rapid7’s products or services. Suppliers must immediately disclose all conflicts ofinterests with Rapid7 to their knowledge (both personal and organizational)
including, but not limited to, a familial or close personal relationship with any Rapid7
employees, officers, or other representatives who have an influence over theirengagements with us.

Insider Trading
Supplier must comply with all applicable insider trading and securities laws
governing transactions in Rapid7 securities. Suppliers who obtain material,
nonpublic information about Rapid7, as a result of their business relationshipwith Rapid7, are prohibited by law from trading Rapid7 stock or any other security
based on that information. Suppliers are also prohibited from communicating(called “tipping”) such information to others who might trade on the basis of thatinformation.

Protection of Intellectual Property | Privacy
Suppliers will respect intellectual property rights and comply with privacy rules
and regulations. Suppliers will respect the intellectual property ownership rightsof Rapid7 and all third parties. Suppliers will only use information technology andsoftware that has been legitimately acquired and licensed. Suppliers will comply
with all applicable privacy, data protection, and information security laws andregulations, including but not limited to national, federal, state, local, and industryor sector-specific laws or regulations.

Books, Records, and Public Reports |Compliance/Business Records + Accounting
Books, records, and other public reports must be full, fair, accurate, and timely.
Information regarding Supplier labor, health and safety, environmental practices,business activities, structure, financial situation, and performance is to be3

disclosed in accordance with applicable legal, accounting, and regulatory
requirements and prevailing industry practices, including those transactions orexpenditures of Rapid7-related business. In connection with Rapid7’s business,there cannot be any unrecorded funds, assets, or any other type of “off thebooks” accounts, no matter the reason for such accounts. Falsification ofrecords and/or misrepresentation of conditions or practices are unacceptable.

Fair Competition and Antitrust
Rapid7 supports vigorous, open and fair competition. Suppliers will comply withall applicable competition and antitrust laws and regulations. In addition toadherence to applicable laws and regulations, Suppliers must not discuss oragree with any competitors to (1) fix or control prices; (2) coordinate during a
bidding process; (3) divide or allocate markets, territories, products, customers,
or suppliers; or (4) limit the production or sale of products or product lines.
Suppliers must not make false, misleading, deceptive, or fraudulent statements
regarding Rapid7 products and services. Suppliers must not take unfair
advantage of anyone through manipulation, concealment, abuse of privileged
information, misrepresentation, or any other unfair-dealing practice. Suppliers will
only use legal means to gather information about sellers of products thatcompete with Rapid7 products. Any activity in violation of these laws isprohibited.

Trade Compliance
All suppliers will strictly comply with applicable trade laws, including the export
control laws of the United States that control the import, export, and re-export of
Rapid7 products. Supplier will not export, re-export, transfer, divert, release,
import or disclose any Rapid7 products or any direct product thereof, technicaldata relating to such products, or Rapid7 confidential information to anotherperson or entity except under license or as otherwise permitted under such laws
and regulations. Suppliers must comply with economic sanctions and tradeembargoes imposed or approved by the United States Government. This
includes, but is not limited to, the EAR administered by the Department ofCommerce, designed to ensure that transfers of products, services andtechnology are accomplished in a manner that is consistent with national
security and foreign policy goals. These controls include the trade and economic
sanctions administered by OFAC.

4

Public Sector Dealings
Activities that may be appropriate when dealing with non-public sector ornon-government customers may be improper and even illegal when dealing withgovernment entities, government-owned entities, government-controlled entities,
or entities subject to government procurement rules (“Government Customers”).
Suppliers that do business with any Government Customers are responsible forknowing and complying with all laws, rules, and procurement regulations that
relate to government contracting and interaction with Government Customer
employees and officials, whether such action is direct or indirect. Examples
include, but are not limited to the following: (1) Suppliers must not attempt toobtain, directly or indirectly, from any source procurement-sensitive informationthat is not publicly available or otherwise authorized for disclosure by theGovernment Customer, (2) Suppliers must ensure the submission of accurate
invoices to the government and comply with all laws regarding invoicing andpayments, (3) Suppliers must not give or offer any gratuity, gift, favor, or anythingof value to any Government Customer employee or official except as is permitted
by applicable law, (4) Suppliers are required to establish and maintain appropriate
internal controls to ensure compliance with all applicable local country and U.S.
laws concerning Government Customer employees or officials, and (5) Suppliers
are responsible for ensuring compliance with all laws related to lobbying andpolitical contributions, and such activities must only be undertaken in compliancewith law and never with the intent of obtaining any improper or illegal benefit for
Supplier or Rapid7.

Human Rights and Labor Standards
Rapid7 is committed to promoting a work environment inclusive of all people thatis free of harassment, bullying, discrimination, inhumane treatment, and threatsof physical violence.
Suppliers must provide a safe and healthy work environment, fully compliant withall employment, health and safety laws. Suppliers must to follow all safety rules
and practices, cooperate with officials who enforce these rules and practices,and, as quickly as practicable, report all accidents, injuries, and unsafe practices
or conditions as required by law.
Suppliers must abide by local minimum wage, overtime pay, benefits, andmaximum working hour requirements. Suppliers are required to comply withapplicable laws supporting fair labor and antislavery practices that allow for
freely chosen employment, absent of forced, bonded or involuntary labor. Rapid7
expects suppliers to observe and conform to international principles, including
5

but not limited to, the UK Modern Slavery Act of 2015. The use of child labor isstrictly prohibited. Partners are expected to adhere to minimum age provisions
set forth in local laws and regulations and should not use workers that are under
the legal age for employment. Suppliers must, prior to employing any worker,review and validate all relevant documentation to ensure that such worker has
the legal right to work in that jurisdiction. Rapid7 recognizes employee rights tofreedom of association and collective bargaining and asks Suppliers to do thesame. Suppliers are expected to respect the legal rights of employees to join or
to refrain from joining worker organizations, including trade unions.

Non-Discrimination
Rapid7 is an equal opportunity employer. We are committed to a workplace freeof harassment and unlawful discrimination and we hold our suppliers to commit
to the same. Suppliers will not discriminate based on age, ancestry, color, genderor sex (including pregnancy), gender identity or expression, genetic information,
marital status, medical condition, mental or physical disability, national origin,family care or medical leave status, race, religion (including beliefs and practices
or the absence thereof), sexual orientation, military or veteran status, or any otherfederal, state, or local protected class.

Environmental Standards
As a global company, Rapid7 is dedicated to supporting country-level climate
goals. We believe that environmental sustainability is critical both as a businessand a community and we expect suppliers to share in this commitment, as set
forth in our Rapid7 Environmental Sustainability Policy and responding tochallenges posed by climate change and working toward protecting theenvironment. Supplier shall develop, implement, and maintain environmentally
responsible business practices and take measures to ensure in manufacturing
operations, adverse effects on the community, environment andnaturalresources are to be minimized while safeguarding the health and safety of thepublic. We expect suppliers to operate in compliance with all environmental laws,regulations, and standards, including requirements for chemical and waste
management and disposal, recycling, industrial wastewater treatment anddischarge, air emissions controls, environmental permits, and environmentalreporting.
Rapid7 encourages its Suppliers to take all reasonable measures to reduce their
negative impact to the environment through adoption and promotion of programs
such as recycling, waste reduction and conservation of natural resources. Rapid7

6

further encourages its Suppliers to establish publicly visible science-basedtargets in line with the objectives of the Paris Climate Agreement.

Raising Concerns/Reporting Violations(No Retaliation)
Rapid7 shall protect whistleblower confidentiality. Rapid7 will not retaliate andwill prohibit retaliation taken against any individual who has in good faith raisedquestions, sought advice, cooperated in any investigation regarding improper
conduct, or reported misconduct, questionable behavior, or a possible violation oflaw or policy. One may anonymously report these concerns by either (i) leaving
an anonymous message via a toll free telephone call at 1-800-341-7686, (ii)leaving a comment online at https://rapid7.alertline.com, or (iii) sending amessage from an anonymous email address to compliance@rapid7.com.

Compliance with Supplier CodeIn addition to reviewing this Code, it is Supplier’s obligation to seek guidance oncompliance issues as they arise and report suspected or actual violations of thisCode or of applicable laws to Rapid7 promptly. Failure to comply with applicablelaws may result in civil and/or criminal fines, as well as significant harm to
goodwill and business reputation. Any violation of this Code may result in
remedial action(s) up to and including termination of contracts or status as asupplier of materials, products, software, and/ or services to Rapid7. However,this Code is not intended to create new or additional rights, or any additional
obligations, in favor of Suppliers, Supplier personnel, or any third parties. It
supplements, but does not supersede, the contracts between Rapid7 andSupplier.

For any questions about this Code, please contact the Legal Teamat notices@rapid7.com.

7