Terms of Service
This Master Subscription Agreement (“Agreement”) is entered into by and between Mezmo, Inc., a Delaware corporation with a business address at 2059 Camden Ave #297, San Jose, CA 95124 and Customer (defined below) and governs the Customer’s use of the Services (each as defined below).
“Customer” means a person or entity that accepts and agrees to the terms of this Agreement as of the earlier date (“Start Date”) where such person or entity either clicks a box indicating acceptance of this Agreement or uses the Services. Mezmo reserves the right to modify or update this Agreement in its sole discretion, the effective date of such updates and/or modifications will be the earlier of: (i) 30 days from the date of such update or modification; or (ii) Customer’s continued use of the Service.
IF YOU DO NOT ACCEPT THIS AGREEMENT, YOU MAY NOT ACCESS OR USE THE SERVICES. THE SERVICES ARE INTENDED FOR THE CUSTOMER AND ITS AUTHORIZED USERS ONLY AND ARE NOT FOR USE BY CHILDREN UNDER 13 YEARS OF AGE. IF AN INDIVIDUAL IS ENTERING INTO THIS AGREEMENT ON BEHALF OF A LEGAL ENTITY, SUCH PERSON REPRESENTS AND WARRANTS THAT IT HAS THE LEGAL AUTHORITY TO BIND SUCH LEGAL ENTITY TO THIS AGREEMENT AND THIS AGREEMENT APPLIES TO SUCH ENTITY WHICH IS DEEMED THE CUSTOMER.
If Customer and Mezmo have executed a written agreement governing Customer’s access to and use of the Services as a Mezmo customer, then the terms of such signed agreement will govern and will supersede this Agreement.
1.1. Provision of the Services. Mezmo offers various online, software-as-a-service products and services (collectively, “Services”). The specific Services ordered by Customer shall be as set forth in on an “Order Form.”
1.2. Access to the Services. Mezmo will make the Services available to Customer in accordance with this Agreement and the end user documentation made available to Customers via the Mezmo website (“Documentation”). As part of the registration process, Customer will identify an administrative username and password for Customer’s Mezmo account. Customer shall require that its permitted users keep this log-in information confidential and shall be responsible for all actions taken using its account credentials.
1.3. Support Services. Subject to the terms hereof, Mezmo will provide Customer with a reasonable level of technical support services, through available support channels, in accordance with Mezmo’s standard practices.
1.4. Professional Services. To the extent set forth in an Order Form or Statement of Work, Mezmo will provide Customer with professional services in support of the implementation and use of the Services (“Professional Services”). Such Professional Services will be provided in a professional manner in accordance with all applicable terms and conditions set forth in the relevant Order Form or Statement of Work.
2.1. “Customer Data” means electronic data and information submitted by or for Customer to the Services. Customer grants Mezmo and its licensors a non-exclusive, worldwide, royalty-free, paid-up, transferable right and license to use, process and display such Customer Data for the purpose of providing the Service. Customer is solely responsible for the content and accuracy of Customer Data. Customer acknowledges and agrees that Customer Data submitted to the “Pipeline” Service (as set forth in the Order Form and as defined further in the Documentation) is not stored or cached within the Service.
2.2. Mezmo will maintain administrative, physical, and technical safeguards at a level not materially less protective than as described on Mezmo’s Compliance/Security page (located here: https://www.mezmo.com/compliance-security). Those safeguards will include measures for preventing unauthorized access, use, modification, deletion, and disclosure of Customer Data by Mezmo’s personnel. Mezmo will process all Customer Data for the purposes set forth in this Agreement and in accordance with: (a) the DPA (located here: https://www.mezmo.com/dpa) and “Security Protocols” set forth in Annex II thereto; and (b) the BAA (located here: https://www.mezmo.com/baa).
2.3. Mezmo uses certain subprocessors to provide infrastructure services and to assist Mezmo in providing the Services. A list of current subprocessors utilized by Mezmo can be found at https://Mezmo.com/sub-processor/. Mezmo will ensure that all such Subprocessors maintain, at a minimum, reasonable data practices for maintaining the confidentiality and security of Customer Data and preventing unauthorized access.
2.4. Customer (and not Mezmo) bears sole responsibility for security, protection and backup of Customer Data when in Customer’s or its representatives’ or agents’ possession or control.
3.1. This is a contract for Services and any software that is provided (regardless of the premises location) will be installed, accessed and maintained only by or for Mezmo and no license is granted thereto. Customer will not, directly or indirectly: (a) rent, lease, copy, provide access to or sublicense the Services (or any part thereof) to any third party; (b) reverse engineer, decompile, disassemble or otherwise attempt to discover the source code, object code or underlying structure, ideas, know-how or algorithms relevant to the Services or any software, documentation or data related to the Services (“Software”); (c) modify, translate, or create derivative works based on the Services or any Software (except to the extent expressly permitted by Mezmo or authorized within the Services); or (d) remove any proprietary notices or labels.
3.2. Customer represents, covenants, and warrants that Customer will use the Services only in compliance with applicable laws and regulations and any standard Mezmo published policies. Although Mezmo has no obligation to monitor Customer’s use of the Services, Mezmo may do so and may prohibit any use of the Services it believes may be (or alleged to be) in violation of the foregoing.
3.3. Customer shall be responsible for obtaining and maintaining any equipment and ancillary services needed to connect to, access or otherwise use the Services, including, without limitation, modems, hardware, server, software, operating system, networking, web servers, long distance and local telephone service (collectively, “Equipment”). Customer shall also be responsible for maintaining the security of the Equipment, Customer account, passwords (including but not limited to administrative and user passwords) and files, and for all uses of Customer account or the Equipment with or without Customer’s knowledge or consent.
3.4. Customer shall be responsible for the configuration of its account, including configuration of archival storage options and any fees or costs which may be incurred due to inaccuracies within such Customer configuration.
Mezmo does not store customer log data for more than 30 days. For longer retention, we provide an archiving service that automatically exports older logs to customer preferred cloud storage service. Mezmo offers 7/14/30 days searchable log data plans, and our systems are configured to automatically purge the logs securely after 30 days.
Non-Log Production data are replicated among discrete operating environments to protect the availability of Mezmo's service in the event of catastrophic events. Mezmo performs restoration testing annually to ensure the completeness and accuracy of backup data. The available Mezmo data archiving service provides the mitigation of data loss for customer logs in the event of catastrophic events.
Mezmo utilizes intrusion detection and prevention systems to detect and/or prevent intrusions into the environment. Active monitoring, alerts, and tools are in place to ensure action is taken by the appropriate on-duty teams if any intrusion and/or security events exceed predetermined thresholds.
Mezmo utilizes third-party security scanning tools to perform continuous vulnerability scans. Our dedicated security team reviews and responds to the security vulnerabilities in a timely manner. Annually, we engage independent third-party security experts to perform detailed penetration tests on the Mezmo application and network.
Mezmo has established policies and procedures for responding to potential security incidents. All incidents are managed by Mezmo's dedicated Incident Response Team. Mezmo defines the types of events that must be managed via the incident response process. Incidents are classified by severity. Incident response procedures are tested and updated at least annually.
Mezmo transmits data over public networks using strong encryption. This includes data transmitted between Mezmo clients and the Mezmo service. Mezmo supports the latest recommended secure cipher suites to encrypt all traffic in transit, including the use of TLS protocols, encryption, and hashing algorithms, as supported by the clients. This applies to all types of data at rest within Mezmo's systems.
Secure by Design - Application Security
Mezmo's products and capabilities have been designed to be foundationally secure.
Mezmo assesses the security risk of each software development project according to our Secure Development Lifecycle. Before completion of the design phase, Mezmo undertakes an assessment to qualify the security risk of the software changes introduced. This risk analysis leverages the OWASP Top 10. Based on this analysis, Mezmo creates a set of requirements that must be met before the resulting change may be released to production. All code is checked into a version-controlled repository. Code changes are subject to peer review and continuous integration testing. Annually, engineers are required to participate in secure code training covering the OWASP top 10 security risks, common attack vectors, and security controls.
Mezmo leverages modern and secure frameworks with security controls to limit exposure to OWASP Top 10 security risks. These inherent controls reduce our exposure to SQL Injection (SQLi), Cross Site Scripting (XSS), Buffer Overflows, Broken Authentication/Session, and Cross Site Request Forgery (CSRF), among others.
Testing and staging environments are logically separated from the Production environment. No Production Data is used in our development or test environments.
Organizational Security
Mezmo has established a security program dedicated to ensuring customers have the highest confidence in our custodianship of their data. Our security program is aligned with the SOC 2, ISO 27001:2013, HIPAA and PCI standards and is regularly audited and assessed by third parties.
All employees complete the latest available Security and Awareness training modules during onboarding and annually thereafter.
Mezmo's personnel practices apply to all members of the Mezmo workforce. All workers are required to understand and follow internal policies and standards. Upon termination of work at Mezmo, all access to Mezmo systems is removed immediately.
Mezmo maintains a set of policies, standards, procedures, and guidelines (“security documents”) that provide the Mezmo workforce with the “rules of the road” for operating. Our security documents help ensure that Mezmo customers can rely on our workers to behave ethically and for our service to operate securely. These policies are living documents, they are regularly reviewed and updated as needed, and made available to all workers to whom they apply.
Mezmo performs background checks on all new employees in accordance with local, federal and state laws applicable to our business.
All employee contracts include a confidentiality agreement.
Compliance
The Health Insurance Portability and Accountability Act of 1996 Title II (HIPAA) addresses safeguards to secure electronically protected health information (ePHI), including log management and audit requirements. Mezmo's systems and processes are fully compliant with HIPAA, and we are audited for HIPAA and HITECH compliance every year by a third-party qualified security assessor. For customers on our HIPAA-compliant logging plan, Mezmo will sign a Business Associate Agreement (BAA) and take on the associated legal liability of handling your sensitive data.
To ensure compliance, Mezmo provides a secure and convenient archiving service for logs older than the retention period of your Mezmo plan.Please contact your account manager or outreach@mezmo.com to request Mezmo's most recent report.
Mezmo Inc. achieves ISO 27001:2013 Certification San Jose, CA – November 2, 2022 – Mezmo Inc., the industry leader in centralized log management today announced that it has received ISO 27001:2013 certification for its Information Security Management System (ISMS).
ISO 27001:2013 is an information security standard published by the International Organization for Standardization (ISO), the world’s largest developer of voluntary international standards, and the International Electrotechnical Commission (IEC). Mezmo Inc.’s certification was issued by A-lign, an independent and accredited certification body based in the United States on successful completion of a formal audit process. This certification is evidence that Mezmo Inc. has met rigorous international standards in ensuring the confidentiality, integrity, and availability of the defined scope.
Mezmo is committed to ensuring the highest level of privacy protection. As a General Data Protection Regulation (GDPR) compliant organization, Mezmo has standardized user data privacy across the EU nations, regardless of where the organizations themselves are located.
The SOC 2 Report demonstrates Mezmo's commitment to meeting the most rigorous security, availability, and confidentiality standards in the industry. It verifies that Mezmo's security controls are in accordance with the AICPA Trust Services Principles and Criteria.
Please contact your account manager or outreach@mezmo.com to request Mezmo's most recent report.
Mezmo has been audited by an independent PCI-DSS Qualified Security Assessor (QSA) and is certified as a PCI-DSS Level 1 Service Provider. This is the most stringent level of certification available in the payments industry.
Please contact your account manager or outreach@mezmo.com to request Mezmo's most recent report.
To comply with EU data protection requirements Mezmo complies with Data Privacy Framework (DPF). This enacts protections for the personal data of EU individuals when it is transferred to the United States.
Learn more about 's approach to DPF.
Learn more about Mezmo’s Active Participant Detail with DPF.
Mezmo complies with the California Consumer Privacy Act (CCPA) and supports our customers’ compliance with the CCPA. As a provider of enterprise log management tools, Mezmo is primarily a service provider under the CCPA. You can read more about Mezmo's commitment to compliance in our Privacy Policy.
In accordance with the Digital Services Act, we have appointed a representative to handle compliance matters. You can contact our DSA representative at:
Name: Data Protection Representative Limited (trading as DataRep)
Postal Address: DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland
Email: digitalrequest@datarep.com
Telephone: +353 (1) 919 8899
The Cloud Security Alliance (CSA) STAR Level 1 certification recognizes our commitment to cloud security best practices. This certification demonstrates that our organization adheres to the rigorous requirements of the CSA's Cloud Controls Matrix (CCM), which covers key areas such as data security, risk management, and compliance for cloud environments.
By achieving CSA STAR Level 1, we provide customers with assurance that we are committed to maintaining high standards of security and transparency in our cloud-based services.
Please view our listing here.