TUFIN SOFTWARE TECHNOLOGIES LTD.
VENDOR CODE OF CONDUCT
Tufin Software Technologies Ltd. including its subsidiaries (“Tufin”) believes that the success of our businessand the strength of our relationships are directly related to our actions. For this reason, we’ve established highethical standards and guiding principles for how we operate, and we expect each of our Vendors to meet theseprinciples and standards. This Vendor Code of Conduct (the “Vendor Code”) describes the principles standards
by which our Vendors must operate and to which they will be held accountable.
This Vendor Code applies to all Tufin suppliers of products or services, including consulting firms, andindependent contractors, regardless of their title or the product or services they provide (“Vendors”). In yourcapacity as a Vendor, we expect you to know and follow all domestic and international laws and regulations that
apply to your work and business locations.
While this Vendor Code may serve as a guide, it is not intended to cover every applicable scenario or address
every situation that may arise. You are expected to use good judgement in line with the highest standards of ethics
and integrity to which Tufin has committed. You are expected to raise questions/concerns or seek additional
guidance on appropriate conduct when a particular situation arises that may not be addressed in this Vendor Code.
1.

COMPLIANCE WITH APPLICABLE LAWS, RULES AND REGULATIONS
Tufin expects in Vendors to comply with both the letter and spirit of all laws, rules and regulations applicableto each Vendor’s business as is conducted generally and specifically with Tufin.
Disregard of laws, rules or regulations are not tolerated, and violation of domestic or foreign laws, rules andregulations may subject an individual, Vendor, as well as Tufin, to civil and/or criminal penalties, fines orrestrictions.

2.

ANTI-CORRUPTION COMPLIANCE
We have a zero-tolerance policy toward bribery or any form of corruption. Vendors, or their employees,officers or anyone on their behalf, may not offer, provide, or promise anything of value (including businesscourtesies) to anyone, including government officials or Tufin employees, to improperly obtain or retain
business or to obtain an unfair commercial advantage.
Tufin also prohibits Vendors from making facilitation payments (i.e., payments to a government official toexpedite or secure a routine non-discretionary governmental action) in connection with Tufin business.
All business courtesies provided by Vendors related to its business with Tufin – including gifts (whethermoney or another thing of value), hospitality, entertainment, events, travel, or accommodation – must be
reasonable and appropriate, in strict compliance with relevant laws and recipient policies, have a clearbusiness purpose, and be supported by required documentation.
Bribes, facilitation payments and kickbacks are violations U.S. Foreign Corrupt Practices Act of 1977, theU.K. Bribery Act of 2010, Israeli Penal Law 5737-1977 and other similar international anti-corruption laws.
Penalties for violation of these are severe and may include fines and incarceration.

3.

EXPORT, CUSTOMERS, TRADE CONTROL AND ANTI-MONEY L AUNDERING
Tufin expects its Vendors to fully comply with all applicable export, customs and trade control laws andregulations, including economic and trade sanctions laws and any licensing requirements, as well as Tufin’sexport controls and sanctions policy available at https://lp.tufin.com/rs/769-ICF-145/images/tufin-exportpolicy.pdf.
We also expect our Vendors to comply with all applicable anti-money laundering laws and regulations, andTufin’s Anti Bribery and Corruption Hand Book available at https://lp.tufin.com/rs/769-ICF145/images/Tufin-ABC-Handbook.pdf.

4.

CONFLICT OF INTERESTSVendors must avoid actual or potential business or financial conflicts of interest involving Tufin such as
instances where the Vendor’s personal interests (including interests of the Vendor itself or the Vendor’s
employees, officers, or directors) conflict or appear to conflict with Tufin’s interests. A conflict of interestmay also arise whenever an action you have taken prevents you from objectively and honestly performing
your duties and responsibilities to Tufin. Any actual or potential conflicts of interest must be promptly
reported to Tufin.

5.

INSIDER TRADINGAs a Vendor of Tufin, you may have access to material non-public information about Tufin and its
subsidiaries. The United States and many other countries have insider trading laws that restrict trading of
securities by anyone who is aware of material non-public information.
Vendors may not purchase or otherwise trade in Tufin’s securities, directly or indirectly, while in possessionof “material non-public information” about Tufin. Information is deemed material if it could reasonably beexpected to affect the price of shares or that a reasonable investor would find significantly alters the total
mix of information.
Tufin as well as insider trading laws and regulations also prohibit Vendors from “tipping” others (e.g., familyor friends) regarding material non-public information about Tufin.

6.

ANTI-TRUST, COMPETITION AND FAIR DEALING
Tufin expects its Vendors to comply with applicable antitrust and competition laws designed to protect andpromote free and fair competition, particularly as it relates to Tufin. Vendors must not enter into anyagreements or understandings with competitors in violation of relevant antitrust laws (e.g., fix prices, exclude
competition, bid rig, limit production, etc.). In addition, Vendors may not exchange certain kinds ofinformation, such as pricing and production information with competitors, regardless of how innocent or
casual the exchange may be.
Vendors must also deal fairly with Tufin and others related to the Tufin relationship. Vendors must not takeunfair advantage of anyone through manipulation, concealment, abuse of privileged information (including
but not limited to competitively sensitive information), misrepresentation of material facts, or any otherunfair dealing or practice.

7.

RECORD MANAGEMENT AND RECORDING TRANSACTIONS
Tufin relies in its Vendors books and records to report our financial results, make required legal filings andmake business decisions. As such, Vendors are expected to record and report information related to theirbusiness in general and especially their business with Tufin accurately and honestly, and to make and keep
books, invoices, records and accounts that accurately and fairly reflect their financial transactions inaccordance with standard accounting practices.
Vendors must not falsify documents, transactions, or accounting records related to Tufin and must strive topromote financial integrity throughout their business and financial reporting. Vendors are responsible andshall fully comply with any requirements to file timely reports with government agencies and makedisclosures that are accurate, balanced, complete and understandable.

8.

CONFIDENTIAL INFORMATION
Vendors are required to protect Tufin’s confidential information, as well as the confidential information of
its customers, suppliers, shareholders, employees, or other third parties that disclosed or made information
available in confidence. Confidential information should be interpreted broadly to include any proprietary
information or information not generally available to the public, in any form or any medium and material
non-public information in particular.
Vendors also must not directly or indirectly exploit for personal gain any information or opportunities thatare discovered because of the Vendor’s relationship with Tufin.
Vendors must apply prevailing industry standards with regard to the installation and operation of information
security measures, for both computer systems and portable electronic devices, to protect against malware
and unauthorized disclosure of any proprietary information and other program related information providedby Tufin. If there is a suspicion that a possible data security breach has occurred, it is critical that suchcircumstance be immediately reported in writing to the Tufin.

9.

PRIVACY
Tufin is committed to protecting confidential and sensitive information and expects its Vendors to upholdthat commitment. Vendors must comply with all applicable laws and regulations regarding the protection of
personal information or other sensitive or protected information and assist Tufin in complying with its own
obligations in this regard. Vendors must notify Tufin immediately in the event of an actual or suspected data
breach resulting in the dissemination of personal information relating to Tufin or its subsidiaries management
or employees.

10. HUMAN RIGHTS, EMPLOYEE RELATIONS AND NON-DISCRIMINATION
Vendors must comply with all applicable human rights laws prohibiting child, forced, indentured, orinvoluntary labor.
Tufin expects its Vendors to conduct themselves in a professional manner with courtesy and respect forothers. We do not tolerate harassment by our Vendors in any form, including verbal, physical, or sexualharassment.
Vendors must pay workers at least the minimum compensation required by local law and provide all legally
mandated benefits.
Tufin is committed to providing equal opportunities in employment, development, and advancement for all
qualified persons – and we expect our Vendors to share that commitment. Tufin does not tolerate unlawful
discrimination by its Vendors.
11. ENVIRONMENT, SAFETY AND HEALTH
Vendors must uphold high regard for the safety and well-being of their employees, customers and the generalpublic. We expect our Vendors to operate in compliance with the letter and spirit of applicable environmentaland workplace health and safety laws and regulations.
12. USE AND PROTECTION OF TUFIN ASSETS
Vendors may only use Tufin’s assets for legitimate Tufin business, including both tangible (e.g., computers,vehicles, supplies) and intangible (e.g., know-how, trademarks, patent information) assets. If Tufin provides
Vendor with access to Tufin computers or systems (including e-mail), these devices and accounts are to be
used for appropriate business purposes only and may be monitored/inspected by Tufin.
13. MARKETING MATERIALS AND MEDIA INTERACTIONS
Tufin controls the release of any marketing materials, press releases or media interviews that include areference to Tufin, our subsidiaries, affiliates, customers and partners. Any such release requires advanced
written approval by Tufin’s CFO, General Counsel, or VP Marketing.
14. REPORTING CONCERNS
You are expected to self-monitor your compliance with this Vendor Code and promptly report any integrity
concern involving or affecting Tufin. When requested, you are expected to assist Tufin in investigating
concerns.
15. AMENDMENT
Tufin is committed to continuously reviewing and updating its policies, and Tufin’s management review theVender Code on a regular basis. Therefore, Tufin may amend this Vendor Code at any time and for any
reason. Vendors must comply with the then current version of the Vender Code.

Last Update: November 2020**********************************