TRUST CENTER

Employee Awareness

At Locus Robotics, security resilience starts with people. Our top-down approach to security awareness education creates a holistic culture across all technical and non-technical departments. Employee awareness is the foundation for secure processes, practices, and technologies.

Assurance

Based on a principle of mature foundations, we build security into everything from our cloud customer portal to our robots executing instructions. We leverage the latest methods of encryption (in transmission and at rest). We continuously monitor the effectiveness of our controls, taking a continuous compliance assurance approach to mitigate risk across the product and service lifecycle.

Learn how to Secure Autonomous Mobile Root Deployments in the Workplace

Security Incident Preparedness

Locus Robotics acknowledges and continuously prepares for security incidents through education and awareness efforts, and building security into our work processes and product. Our leadership established and practices Incident Response processes, based on industry standards, to ensure proper decision making steps are known and followed. We analyze and respond to events with the key priority to protect our customers from any impact of an event.

GDPR

CCPA

• Know what personal data is being collected about them.
• Know whether their personal data is sold or disclosed and to whom.
• Say no to the sale of personal data.
• Access their personal data.
• Request a business to delete any personal information about a consumer collected from that consumer.
• Not be discriminated against for exercising their privacy rights.

SOC 2 Type II

Locus Robotics has achieved SOC 2 Type II compliance certification. Our public-facing SOC 3 report can be viewed here. The attestation is a confirmation of the suitability of the design and operating effectiveness of our internal controls stated for the scope of the report. Locus Robotics provides reasonable assurances that our service commitments and system requirements are achieved based on the trust services criteria relevant to security, availability, confidentiality and processing integrity set forth in the TSP 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (AICPA, Trust Services Criteria).

Vendor Risk Management

To ensure a high level of customer service, a strong security foundation, and reliable business continuity, Locus Robotics has implemented a Vendor Risk Management process to evaluate third-party service providers that we partner with.  The evaluation process considers: Cloud Architecture, Authentication, Application Security, Data Security, Privacy, Internal Controls, Certifications, and other security practices that add to a strong security program and dependable customer service. 

It is the policy of Locus Robotics to implement security measures and controls to protect the information systems environment and the privacy and confidentiality of protected information, to include financial, business, or other sensitive information for the Organization. 

By adopting continuous security best practices, Locus Robotics ensures that risks are continuously addressed, evaluated, and mitigated. Our continuous risk assessment process covers the entire lifecycle of the Locus business and operational processes. We consider risks to data, people, processes and technologies.

Ongoing Data Inventory

As part of Locus Robotics compliance and privacy programs, on an annual basis, Locus Robotics reviews all the data that is captured, utilized, and stored.  Our ongoing data inventory process includes the following actions:

• Mapping data processed – illustrating the data actions and associated data elements for systems and services.
• Documenting the categories of individuals (e.g., customers, employees or prospective employees, consumers) whose data are being processed are inventoried.  
• Mapping the data actions of the systems/products/services are inventoried.
• Confirming the data processing environment is identified (e.g., geographic location, internal, cloud, third parties).

Data Governance

Data governance is where data security and privacy converge for a holistic approach to mitigate risk. We enforce the principle of least privilege, giving the least amount of data access to users that they need to complete their job functions. We rigorously monitor user access with regular reviews to ensure comprehensive protection across the entire user identity lifecycle. Our data governance processes and practices cover the entire data lifecycle from creation to destruction.

Data Risk Assessment

A Data Protection Risk Assessment process that determines the threats to your regulatory protected and sensitive data. We identify and categorize your data according to the severity of the risk involved and take the steps required to mitigate the risks and ensure continuous protection and compliance.

CE Mark (EU and Australia)

The CE mark affirms our product’s conformity with European regulations regarding health, safety and environmental protections.

CE Marking on a product is a manufacturer’s declaration that a product meets the applicable health, safety, and environmental requirements outlined in the appropriate European product legislation and has undergone the relevant conformity assessment procedure.  CE marking is compulsory for most products covered under the EU’s New Approach Directives and is necessary for the free movement of products within the European market.

Regulatory Compliance Mark (RCM)

The Regulatory Compliance Mark (RCM) is a trademark owned by the electrical regulator (Regulatory Authorities (RAs). 

The move to one single mark helps reduce red tape for the industry and save costs. This mark represents compliance, and the removal of the need to track and mark equipment with unique approval/certificate numbers saves time and money. 

Sustainability

As a technology leader, we actively support driving sustainability across all aspects of our business – from manufacturing to deployment, support, and maintenance. We are also committed to recycling nearly 100% of components at the end of the useful life of the LocusBots. 

The typical lifespan for a LocusBot would be typically five to seven years, given technology evolution. However, with our refurbishing processes, the life span of our LocusBots extends well beyond this period.

One key aspect of our company is our Robots as a Service (RaaS) model. Since customers do not own the LocusBots, we maintain the robots in the field sustainably. When contracts change or grow, we can quickly refurbish, repurpose, and redeploy robots to new facilities or regions. No robots go to waste.

The four major components in the LocusBots are ABS plastic, metal casings, batteries, printed circuit boards, and related electronics. Because the useful life of each component varies, we work hard to refurbish and repair components vs. replacing them. Recycling is only done when we are unable to refurbish or repurpose a component or part.

Reliability

Locus Robotics Business Continuity and Disaster Recovery (BCDR) program maintains current available business operations and facilitates the efficient restoration of business operations due to a large-scale disruption. The BCDR program helps ensure critical business functions continuously operate and support customer services without disruption.

The BCDR program includes the main three components, as well as annual program testing, including the coordination and monitoring of restoration efforts when activated.

• Business Continuity Plan – The BCP includes a comprehensive set of instructions and tasks that must be completed upon an impactful business disruption. The BCP identifies key stakeholders and their responsibilities, defines communication and documentation requirements, and details plan activation and deactivation steps and authorities.
• Business Impact Analysis –The BIA evaluates the critical business functions and applications that support business operations and customer services.
• Disaster Recovery Plans – For each critical business function identified in the BIA, product and service teams maintain a disaster recovery plan that lists, in order, the technical processes required to bring business operations back into a fully operational state. The two core processes involved in maintaining a recoverable operational environment are backups and redundancy.