Company: MFON
Filing Date: 2025-04-07
Form Type: 10-K
Source: 0001641172-25-002942
Chunk: 427

Company: MOBIVITY HOLDINGS CORP.
Filing Date: 2025-04-07
Form: 10-K
Item: Item 1C
Chunk 427
---
Over
the past year, our team has implemented, optimized, and matured our cybersecurity practices, aiming to meet all major industry benchmarks.
Our goal is to safeguard our information systems and protect the confidentiality, integrity, and availability of both our and our customers’
data. This includes measures related to cybersecurity incidents, risk management, management roles, and governance.

 1) Cybersecurity incidents: Our public-facing website complies with WCAG 2.2 level AA standards for accessibility. We manage various databases, including those on Amazon and Google Clouds, each with three sets of development, testing, and production environments. Our main data warehousing solutions is Amazon Redshift, complemented by Amazon S3 for object storage.

    a)
    To
    prevent unauthorized access, we have established a series of security gates across all production environments and instances

    b)
    Only
    two individuals have update access to production database instances, and a limited number of individuals have read-only access to
    personally identifiable information (PII) data

    c)
    In
    our cloud environments, 2-3 members of our Platform Engineering team have access to production and test instances, and logs are generated
    for any changes made

2)
Risk Management: We maintain multiple AWS and Google Cloud environments, each with three sets of development, testing, and production
environments. Our primary data warehousing solution is Amazon Redshift, while we use Amazon S3 Glacier for archival storage and Amazon
S3 for object storage. We also employ Amazon Sagemaker for machine learning tasks and internally host Apache Superset on the AWS platform
for data visualization.

    a)
    All
    environments are isolated using credentials and accounts

    b)
    We
    are following a plan to ensure scheduled patching, upgrades, and other maintenance occur every quarter. This includes updates for
    SQL databases and cloud instances

    c)
    We
    have the capability to search our logs for security incidents

    d)
    We
    are on schedule to monitor every public endpoint using a Web Application Firewall (WAF), ensuring that all traffic is logged with
    patterns to detect any suspicious behavior

    e)
    We
    aim to enable automatic processes to ensure no production data is changed without systematic audits

    f)
    The
    data visualization tool has login credentials with role-based access

-12-

Table of Contents

 3) Management’s Role: Our board of directors has ultimate oversight of cybersecurity risk.