Medallia has a designated Data Privacy Officer responsible for overseeing data protection strategy and compliance.

All employees complete privacy training to ensure awareness of data protection obligations.

Medallia and customer assets are monitored by Site Reliability Engineering and the Trust and Assurance Group (TAG); all relevant user activities, system exceptions and security events are logged and stored locally and in a centralized log management system to prevent tampering. Privileged access is also monitored using a centralized log management solution. Access to logging facilities and log information is restricted to authorized personnel only. System administrator actions are logged and reviewed by TAG as part of risk assessments or as otherwise necessary.

Privileged Access Logs must contain the following information:

• Information about the event (e.g., files accessed, functions performed)
• Success/failure of the event
• Time the event occurred
• Information about the event (e.g., files handled) or failure
• Account or administrator involved and processes that were involved

Customer data access is restricted and monitored, with all access logged and auditable.

Strong password policies and multi-factor authentication protect access to systems and data.

Bring Your Own Device policies ensure personal devices meet security requirements before accessing corporate resources.

The experiences you provide your customers and employees never stop, and neither do we. Our Production Services & Engineering teams utilize internal and external services to perform continuous scanning and monitoring of our network and application to ensure world-class availability of our SaaS platform.

Endpoint protection solutions deployed across all corporate devices.

Full disk encryption enabled on all corporate devices and servers.

Advanced threat detection systems monitor for security events and anomalies.

Medallia uses robust load balancing, malware detection and prevention, and on-demand DoS and DDoS detection and prevention systems.

Medallia has established a Business Continuity Plan to support continued delivery of its products and services after a disaster event that impacts the resources required (i.e., people, technology, physical assets and/or relationships) to support the performance of its critical business processes.

As a cloud-based SaaS provider, Medallia platforms are accessed over the Internet. Medallia's Experience Cloud and Digital platforms are hosted out of colocation facilities, located in North America, Asia, Australia, and Europe.

Medallia uses an internal NTP to ensure all systems have a common time reference.

DXA is built on a robust cloud-based infrastructure that can efficiently scale to handle huge data sets, including seasonal traffic and unexpected visitor surges.

Medallia uses separate environments for development and production, with segmentation ensuring isolation between environments.

Comprehensive asset management ensures all hardware and software assets are tracked and secured.

Medallia has an extensive Security Champions program. Development teams have one or more representatives that take part in an intensive 6-month certified security training program. This ensures that secure development scales as we scale and is part of the DNA and culture of how we build our applications.

Established incident response procedures for timely detection, containment, and remediation of security incidents.

Data protection is a top priority for Medallia. We build our platform using the following core principles: We treat all customer data as private and sensitive. We do not share customer data with third parties without approval of the customer. Our customers are in control of their data with standard, industry compliant policies for deletion and retention. We have architected our platform from the ground up with security and privacy by default. Customer data is labeled as Confidential by Medallia.

Medallia provides application adapters, connectors, and integrations including our Auto Importer (ETL tools for automated data transfer), pre-built connectors at medallia.com/xchange, developer APIs at developer.medallia.com, and batch file transfers via SFTP.

Medallia uses multi-factor authentication for system-level access to our application and backend infrastructure. Support teams must use two-factor authentication to access the application remotely, and employees connect through SSH tunneling (VPN) with public/private key (PKI) two-factor authentication.

User authentication and authorization determines who can access information based on their privileges and role.

Service availability is defined and agreed to within the Master Services Agreement.

Medallia takes access management seriously, granting access with the least privilege needed for the specific role and only to the personnel that need it. We review and update access rights annually and after any change in a user's role. Access to systems that store client data is severely restricted and carefully logged, monitored, and audited.

Any media containing client data will be sanitized or physically destroyed, in accordance with NIST SP 800-88 rev 1 Guidelines for Media Sanitization, before the media is reused or disposed.

Data at rest is encrypted using 256-bit AES encryption.

Data in transit is encrypted using TLS 1.2.

All Medallia access to customer data is audited and logged, including an annual review of all employee access rights.

Medallia has placed appropriate countermeasures in place to protect its office facilities from any physical damage. In addition, Medallia's colocation data centers inherit physical security and environmental controls from the colocation providers. All facilities hosting our services provide the robust physical security and fault-tolerant, highly resilient, redundant support infrastructure necessary to ensure reliable service.

Sensitive data fields can be masked to protect personally identifiable information during session replays and analytics.

Video and media data retention policies ensure content is managed according to customer requirements.

Medallia recognizes the ongoing research into quantum computing and its potential future impact on cryptography. Your trust and data security remain our highest priority.

Current Security Protocols Today, Medallia secures client data by protocols proven resilient against all current threats:

• Data in Transit: We utilize TLS 1.2+ for all data transmitted outside our corporate network, protecting against conventional eavesdropping.
• Data at Rest: All stored data is encrypted using AES-256 (Advanced Encryption Standard with a 256-bit key), a standard considered computationally infeasible to break by current classical computers.

Our Quantum Preparedness While a universal, fault-tolerant quantum computer capable of breaking current public-key cryptography (Shor's algorithm threat to TLS) is a speculative, long-term threat, we are proactively addressing it:

1. AES Resilience: In alignment with the National Institute of Standards and Technology’s (NIST) Post-Quantum Cryptography (PQC) standardization process, our use of AES-256 (category 5 security strength) for data storage offers strong quantum resistance. While quantum algorithms like Grover's could theoretically reduce the security level, the resulting 128-bit security equivalent remains robust.
2. Monitoring and Strategy: We are actively monitoring the development of PQC standards led by the National Institute of Standards and Technology (NIST).
3. Crypto-Agility: Our system architecture is designed with crypto-agility in mind, enabling us to seamlessly integrate future NIST-finalized PQC standards into our platform before any credible quantum threat materializes.

In summary: Your data is safe with our current, state-of-the-art encryption. We are strategically preparing our systems for the transition to quantum-safe standards to ensure continuous, future-proof security.

Medallia’s production data backup schedule runs daily using write-ahead-logging (WAL) with full weekly backups of the entire database. The backup script runs hourly, checking the timestamp of the last successful base backup. If the timestamp of a database is over a week old, it will run the base backup for the particular database and replace the oldest weekly backup (14 day retention). The backup is encrypted at the same level as the production environment, AES-256-bit.

Customer data is always backed up to disk — never to external media (i.e. tape). Backup data is also stored within the databases using write-ahead logging (WAL) to minimize data loss. Medallia also takes snapshots of the entire database system as an additional backup measure.

Medallia's Engineering and Product Security teams conduct extensive development and post-development testing to be certain our applications are secure. This includes static and dynamic code analysis and manual penetration testing. All deployed software undergoes a post-deployment vulnerability scan.

Medallia has an extensive Security Champions program. Development teams have one or more representatives that take part in an intensive 6-month certified security training program. This ensures that secure development scales as we scale and is part of the DNA and culture of how we build our applications.

Medallia uses an agile methodology for development. Our software feature development process has five clearly defined lanes or stages: Ready Lane, Development Lane, Code Review Lane, Checkpoint Lane and Merged Lane. Medallia also follows its internal SDLC policy and associated procedures.

Medallia's vulnerability management process includes regular and ad hoc vulnerability scanning. We monitor for vulnerabilities listed in the CVE database and frequently test for threats on the OWASP Top 10 list. Any vulnerabilities identified are analyzed and remediated in accordance with our Vulnerability Management Standard.

Medallia implements secure credential management practices. Passwords and secrets are properly stored using industry-standard encryption, regularly rotated, and access is restricted to authorized personnel only.

Medallia has firewall systems in place to monitor and filter unauthorized inbound network traffic from the Internet, maintain segregation between internal and external networks, and maintain separation between internal wired, wireless, and protected network segments, including Demilitarized Zones (DMZs). With default deny rules in place and deny any type of network connection that is not explicitly authorized, firewall rules are reviewed on an annual basis to ensure firewalls are appropriately configured.

Medallia has electronic intrusion detection systems installed within data server locations to monitor, detect, and automatically alert appropriate personnel of security incidents.

Security Information and Event Management systems aggregate and analyze security events across the infrastructure.

Medallia maintains a list of authorized subprocessors for data processing activities. To receive updates to this list, please sign up at medallia.com/subprocessors.

Comprehensive cyber insurance coverage for data breach and security incident response.

Standard DPA available for customers requiring data processing agreements.

Medallia Digital Experience Analytics (DXA) provides insight into how users interact with websites and applications, enabling organizations to identify friction points and improve digital journeys. Because DXA records interaction data, customers sometimes ask how tools of this kind relate to state privacy and communications laws, particularly the California Invasion of Privacy Act (CIPA) and the Florida Security of Communications Act (FSCA).

Medallia can provide an attestation of data deleted to any client upon request. For physical hardware destruction our Data Center Services (DCS) team follows the procedure outlined below:

• Retired and defective media with confidential customer information is stored in a secured environment until destruction.
• When we have sufficient media collected to destroy, we request that one of our media destruction vendors comes on site to pickup the media.
• When we hand over the media, we get a receipt for the number of drives handed over.
• The media is either degaussed or physically shredded by the vendor.
• The vendor provides Medallia a certificate of hard drive destruction which includes serial numbers of the hard drives destroyed.
• The certificate of hard drive destruction is forwarded to Medallia's Trust and Assurance Group (TAG).
• The secure media destruction policy does not apply to drives that have hardware full disk encryption enabled at the time of disposal or failure.

Medallia's security and privacy is an embedded priority as it relates to our data privacy principles. We work to adhere to the most stringent data protection regulations globally keeping in mind the adaptation of the ever changing landscape that is data privacy.

Medallia’s cloud-native SaaS platform is designed with EU AI Act alignment at its core. Based on our current functionality and intended use, and as of the time of writing, our AI capabilities are assessed as low risk under the EU AI Act’s risk-based framework.

Medallia proactively established an AI Moderation Council, anticipating the need for industry leadership for emerging AI trends. This included enabling members of Medallia’s Product, Data Science, Security Engineering, and Legal teams to review proposed use cases for AI models within Medallia Products as well as our internal infrastructure, and to address requirements of the Act. Most importantly, it applies to both providers and deployers of the AI systems. Customers retain full control of how they use Medallia’s features and products.

The ultimate risk is determined by the customer's specific use case. We stress to our customers to perform internal assessments to ensure they do not deploy our tools in a manner that's considered “high-risk” under the regulation. We require human in the loop feedback to ensure compliance and the responsible use of any AI system. We do not currently depend on external generative AI services for processing or training.

All AI workloads run within our own managed and trusted infrastructure, in support of security and an attested compliance posture as regulatory guidance continues to evolve. Medallia ensures that inputs are protected to its highest capability when ingested into our models within the Medallia environment by instilling de-identification and aggregation mechanisms, HTIL, prompt engineering, and customer data is not used to train the third party foundational model. To maintain this standard, our data processing architecture follows a security-first initiative, ensuring customer data is never vulnerable and used to train the foundational third-party models.

GenAI & SDLC (Software Development Lifecycle) As a cloud-native SaaS provider, our AI platform follows a risk-based governance approach and, as of the time of writing, our AI capabilities are internally assessed as low risk based on their intended use and system design, subject to ongoing review.

We distinguish our models between shared/models and customer-specific. Shared customer models consist of large scale, fine-tuned models used for general language understanding, feedback experience analysis and reasoning capabilities. Models act as a processing engine, not a storage point, therefore, client data is never retained beyond the contractual limitation period.

Capabilities such as Smart Response, Root Cause Assist, Intelligent Summaries and Coaching Intelligence are all cross-customer models. Customer-specific models are dedicated components allowing the AI to understand your unique business context and use case. These assets are logically isolated within your tenant boundary, ensuring privacy and making it inaccessible to any other Medallia client. Themes with GenAI is the sole GenAI capability that inhibits customer-specific models per tenant. Together, this approach reduces operational complexity, limits unintended and uncontrolled data flows, and provides enterprises with a secure and transparent foundation for responsible AI adoption.

Security By Design at Medallia Medallia in addition to our expanded secure SDLC for generative AI, applies secure system prompt engineering practices aligned with industry standard security frameworks such as OWASP for Large Language Model Applications and relevant SANS secure AI guidance at this time. These controls include strict PII minimization (in adherence to GDPR Article 5), structured input validation, and robust code injection protections through escaping and sanitization mechanisms. Human-in-the-loop (HITL) controls are incorporated where appropriate to provide oversight, exception handling, and controlled decision points for higher-risk interactions.

To mitigate common GenAI attack vectors, we extend our existing SaaS security controls to address risks such as LLM model manipulation and prompt-based exploitation, human process weaknesses, overly permissive GenAI feature configurations. These protections are informed by OWASP and SANS threat models and are continuously reviewed as new GenAI-specific risks emerge.

We further strengthen our security posture through ongoing GenAI internal and external red teaming and product security reviews , to validate model behavior, control effectiveness, and operational resilience against realistic attack techniques. In parallel, our vendor risk and supply chain management program applies defined risk mitigation criteria—aligned with OWASP and SANS best practices—when selecting and managing third-party technologies, ensuring that all supporting components meet our security, compliance, and operational standards.

Medallia also protects its compatible solution offerings at the presentation layer, deploying runtime application self-protection (RASP) controls that continuously monitor and inspect common attack vectors such as XSS, Injection attempts as well as now our GenAI interactions in real time. These controls are evolving to detect and mitigate common Generative AI attack vectors, including prompt manipulation, injection attempts, and anomalous input or output patterns. By enforcing protective actions at runtime, RASP enables immediate response to emerging GenAI vulnerabilities without disrupting application availability or user experience.

Within the Medallia landscape, hosting of data as well as processing AI compute stays enclosed to enhance our security. GenAI results are stored within the Medallia ecosystem alongside your other data, whereas processing occurs within the GPU farm uniquely linked to hosting facilities via an HPC link. The solution is built on closed LLM models deployed within controlled, private environments, ensuring predictable behavior, strong operational oversight, and clear data boundaries.

Most AI workloads are executed within our own infrastructure and with some relying on public cloud privately hosted LLM models (e.g. AWS Bedrock which is also used as our public cloud failover service). There are no current reliances on external generative AI processing services.

A private enterprise licensing model complements this architecture by enforcing tenant isolation, role-based access controls, HITL (human in the loop) processes, and contractual accountability, while also offering GenAI features with the ability of shared and non-shared model usage. Together, this limits unintended and uncontrolled data flows, and provides enterprises with a secure and transparent foundation for responsible AI adoption.

With Generative AI rapidly evolving, Medallia understands the importance of governance, security and accountability when building out capabilities to further enhance customer insights. Here at Medallia, we've instilled many factors that come into play of being ISO 42001 compliant including a dedicated AI Moderation Council (AIMC) that reviews AI use cases, assesses risks, and addresses ethical, legal, and security considerations before deployment. Furthermore, Medallia's commitment to responsible AI ensures data protection, compliance, and reliability, with all models undergoing regular review for security, performance, and ethical standards.. The memo attached stipulates how we adhere to the framework and the what the future holds to be fully compliant with framework.

Medallia has instituted a comprehensive code of business conduct and ethics consistent with the highest standards of legal and ethical business conduct. This code covers compliance with applicable laws, rules, and regulations, including anti-bribery and anti-corruption laws; principles of ethical behavior and fair dealing; and confidentiality and privacy.

Medallia has instituted a comprehensive code of business conduct and ethics consistent with the highest standards of legal and ethical business conduct. This code covers compliance with applicable laws, rules, and regulations, including anti-bribery and anti-corruption laws; principles of ethical behavior and fair dealing; and confidentiality and privacy.