The Cloud Sign-in licensing portion of CSI products is provided and hosted by a third-party licensing vendor. Cloud Licensing Vendor, further referred to as the 'Vendor', is a third-party entity Oracle NetSuite who manages the cloud licensing platform that CSI utilizes in its products.
Cloud Sign-in Licensing Service, further referred to as the 'Service', is the cloud licensing platform utilized inside CSI products.
...
Where is the Service hosted?
The service is hosted on Oracle Cloud Infrastructure and is physically located in the United States.
What To which security standards are is your Vendor certified to?
Information on Oracle NetSuite’s certifications can be found on their website: https://www.netsuite.com/portal/platform/infrastructure/operational-security.shtml
...
Does your Vendor have an Information Security Policy or Program addressing confidentiality, integrity, and availability of their facilities, systems and the information in their possession and control?
Oracle NetSuite has extended the ISO 27001 Information Security Management System to include the ISO 27018 control set, demonstrating protection and adequacy for processing Personal Information as a Public Cloud Hosting Provider.
Is Are user data, extracts or summaries used for any other purpose other than providing Service?
No, customer data is not used for anything other than providing Service.
Is there a Business Continuity plan for the Service with Recovery Point Objective (RPO) and Recovery Time Objective (RTO) metrics?
There is no formal Business Continuity plan with ROP RPO and RTO objectives.