Contractual: Bandwidth relies on SCCs, both intracompany and with any third party vendor involved in an onward transfer. As a customer, you will also benefit from our Bandwidth standard DPA with new SCCs included as of September 27, 2021. The new SCCs contain specific provisions on notification and handling government data requests in accordance with the expectations of the EDPB.
If your customer agreement is still based on a DPA template signed before September 27, 2021 either with Bandwidth Inc. or with Voxbone SA, or you are unsure about it, we will be pleased to amend it to refer to the new Standard Contractual Clauses. Please feel free to reach out to your Bandwidth representative or contracts@bandwidth.com to execute an updated DPA.
Technical: Security is a high priority for Bandwidth, which has a comprehensive Information Security Management System (ISMS) based on ISO 27001 requirements and ISO 27001:2013 certified.  In addition to protecting its network and software, Bandwidth is committed to protecting all access points to that network and Customer information. All Bandwidth desktops, laptops, and mobile devices are centrally managed and fully encrypted. All end user computers have anti-virus and anti-malware protections. Access to Bandwidths production systems and services by employees is on a need-to-know model with least privileges. Bandwidth continuously monitors user accounts using security analytics and anomaly detection. Bandwidth requires two-factor authentication for all remote access to Bandwidth networks and systems.  You may review the Bandwidth Security Fact Sheet for more details.
Organizational:
Bandwidth reviews and reinforces our internal policies to respond to government access requests of personal data. Our regulatory operations teams implement and enforce a tailored review process for government access requests to ensure appropriate responsiveness in applicable jurisdictions and the protection of the personal data of our customers and their end users; more information is available at. Information on law enforcement requests may be found at the Law Enforcement Guide. Bandwidth publishes a transparency report related to access requests on an annual basis as part of its Corporate Responsibility Report, a current copy of which may be found at https://investors.bandwidth.com