Purchasing, Privacy and Security Terms and Conditions
These Purchasing, Privacy and Security Terms and Conditions (the "Terms") apply to each purchase order, statement of work, order form, or other ordering document issued by Intact Insurance Group USA LLC or any of its direct or indirect affiliates (collectively, "Intact") that incorporates these Terms by reference (each, an "Order"). The vendor identified in the Order is referred to as "Vendor." The Order and these Terms constitute the "Agreement." These Terms take precedence over any conflicting or inconsistent provision of the Order, without exception.
PART I. PURCHASING TERMS AND CONDITIONS
1. AGREEMENT
The Agreement is a binding contract. Vendor accepts the Agreement by acknowledging the Order, beginning performance, shipping goods, or providing services. Any additional or different terms proposed by Vendor, including terms contained in a quotation, acknowledgment, invoice, click-through agreement, website, or other document, are rejected and will not modify the Agreement unless expressly agreed to in a writing signed by an authorized representative of Intact.
2. PRICE AND PAYMENT
Unless otherwise stated in the Order, the stated prices include all discounts and all charges for packing and shipping. Taxes must be separately stated and will be paid only to the extent legally applicable and properly invoiced. Intact will pay undisputed amounts within thirty (30) days after receipt of a correct invoice and Intact's acceptance of the applicable goods or services.
3. CHANGES
Intact may request changes to the Order by written notice to Vendor. Vendor must notify Intact in writing within ten (10) days, and before implementing the change, if the requested change will affect price, timing, or performance. No adjustment will be effective unless agreed to in writing by Intact. Vendor may not make material changes to the goods or services without Intact's prior written approval.
4. WARRANTY
Vendor warrants that: (a) the goods and services will conform to the Agreement and all applicable specifications, drawings, documentation, samples, and representations; (b) the goods will be new, merchantable, of good quality, free from defects in design, materials, and workmanship, and fit for their intended purpose; (c) Vendor has good and clear title to the goods, free of liens and encumbrances; and (d) the services will be performed professionally, timely, and in a workmanlike manner by qualified personnel. If any goods or services fail to conform to these warranties, Intact may require prompt repair, replacement, or re-performance; reject the nonconforming goods or services; accept them subject to an equitable price reduction; or terminate the affected Order. Vendor will bear all related costs. These rights are cumulative and in addition to all rights and remedies available under the Uniform Commercial Code or other applicable law.
5. TITLE AND RISK OF LOSS
Unless otherwise stated in the Order, shipping terms are F.O.B. Intact's delivery location. Title and risk of loss will pass to Intact only after delivery, inspection, testing, and acceptance by Intact. Payment does not constitute acceptance.
6. INDEMNITY
Vendor will indemnify, defend, and hold harmless Intact, its affiliates, and their respective directors, officers, employees, and agents from and against all third-party claims, actions, liabilities, damages, losses, costs, and expenses, including reasonable attorneys' fees, arising out of or relating to: (a) actual or alleged infringement, misappropriation, or violation of any patent, copyright, trademark, trade secret, license, or other intellectual-property or proprietary right by the goods, services, or deliverables; (b) bodily injury, death, or damage to tangible property caused by Vendor or its personnel; (c) Vendor's breach of the Agreement; or (d) the acts or omissions of Vendor or its employees, subcontractors, or agents. These obligations are cumulative and survive expiration or termination.
7. COMPLIANCE WITH LAWS AND STANDARDS OF CONDUCT
Vendor will comply with all applicable federal, state, local, and foreign laws, regulations, and governmental requirements. Vendor personnel performing services at an Intact site or accessing Intact systems will comply with applicable Intact policies communicated to Vendor, including safety, security, privacy, and acceptable-use requirements.
8. FORCE MAJEURE
Vendor will promptly notify Intact in writing of any actual or anticipated delay, describe its cause and expected duration, and use commercially reasonable efforts to mitigate the delay. If Vendor cannot perform by the required delivery date, regardless of cause, Intact may obtain substitute goods or services, suspend the affected Order, or cancel all or part of the affected Order without further liability, except for conforming goods or services previously accepted by Intact.
9. TERMINATION
Intact may terminate an Order, in whole or in part, for convenience upon written notice and without liability except for conforming goods or services accepted before the effective date of termination and reasonable, documented, noncancelable costs expressly authorized in advance by Intact. Either party may terminate the Agreement for the other party's material breach if the breach remains uncured thirty (30) days after written notice, except that no cure period is required for a breach that cannot reasonably be cured, a Security Breach, or a breach of confidentiality, privacy, or data-security obligations that presents material risk to Intact.
10. ASSIGNMENT AND SUBCONTRACTING
Vendor may not assign, delegate, transfer, or subcontract any material obligation under the Agreement without Intact's prior written consent. Any approved assignment or subcontracting does not relieve Vendor of its obligations or liability. Intact may assign the Agreement to an affiliate or in connection with a merger, reorganization, sale of assets, or similar transaction.
11. INSURANCE REQUIREMENTS
Vendor will maintain, at its sole cost, insurance issued by financially sound insurers and in types and limits reasonably appropriate for the goods and services and satisfactory to Intact. Upon request, Vendor will provide certificates of insurance and other reasonable evidence of coverage. Vendor will provide prompt notice of cancellation or material reduction in coverage and, where commercially available, at least thirty (30) days' prior written notice.
12. LIMITATION OF LIABILITY
Except for Vendor's indemnification obligations, breaches of confidentiality, privacy, or data-security obligations, infringement or misappropriation of intellectual-property rights, fraud, gross negligence, willful misconduct, or amounts covered by insurance required under the Agreement, neither party will be liable to the other for special, indirect, incidental, exemplary, punitive, or consequential damages, including lost profits, loss of use, or business interruption, even if advised of the possibility of such damages.
13. GOVERNING LAW AND VENUE
The Agreement will be governed by the laws of the State of New York, without regard to conflict-of-laws principles. The state and federal courts located in New York County, New York will have exclusive jurisdiction, and each party consents to personal jurisdiction and venue in those courts.
14. PUBLICITY
Vendor may not use Intact's or any Intact affiliate's name, trademarks, logos, or the existence of the parties' relationship in advertising, publicity, customer lists, case studies, press releases, or other public statements without Intact's prior written consent.
15. GENERAL PROVISIONS
If any provision of the Agreement is held invalid or unenforceable, the remaining provisions will remain in effect and the invalid provision will be enforced to the maximum extent permitted by law. No amendment or waiver is effective unless in writing and signed by authorized representatives of the parties. A waiver of one breach is not a waiver of any other breach. Vendor is an independent contractor and has no authority to bind Intact. Provisions that by their nature should survive will survive expiration or termination, including warranties, confidentiality, privacy and security, indemnification, limitations of liability, and governing law. Electronic notices and signatures are effective to the extent permitted by applicable law.
PART II. PRIVACY AND SECURITY TERMS
This Part II applies whenever Vendor or any person acting on Vendor’s behalf accesses, receives, creates, hosts, stores, transmits, maintains, uses, discloses, or otherwise Processes Confidential Information or accesses Intact Systems in connection with the Agreement. If this Part II conflicts with Part I or an Order, this Part II controls with respect to confidentiality, privacy, cybersecurity, Artificial Intelligence Technology, Security Breaches, and the Processing of Personal Information.
Definitions. As used herein, the following terms have the meanings set forth below:
“Applicable Law” means any statute, law, ordinance, regulation, rule, code, order, constitution, treaty, common law, judgment, decree, directive or other requirement, guideline or rule of law of any governmental authority.
"Artificial Intelligence Technology" means technologies related to image recognition, audio processing, data classification, virtual agents, machine learning, deep learning, large language models, generative AI, and any other similar technologies (or evolutions of such technologies).
“Authorized Vendor Personnel” means Vendor’s employees who have a need to know or otherwise access Confidential Information to enable Vendor to perform its obligations under this Agreement.
“Authorized Persons” means (i) Vendor’s Authorized Vendor Personnel; and (ii) Vendor’s contractors, agents, service providers and auditors who have a need to know or otherwise access Confidential Information in connection with the Agreement, and who are bound in writing by confidentiality and other obligations sufficient to protect Confidential Information in accordance with the terms and conditions of this Agreement.
“Confidential Information” means all information of the Intact or its Affiliates that is furnished by or on behalf of the Intact, in whole or in part, together with all notes, analyses, compilations, studies, interpretations or other documents to the extent containing or otherwise reflecting, in whole or in part, any such information. Additionally, “Confidential Information” includes (i) Personal Information; (ii) the fact that such information has been or will be so furnished and (iii) the terms and existence of this Agreement and the content.
“Intact Systems” means information technology infrastructure, including the computers, software, databases, electronic systems (including database management systems), and networks, of Intact or any of its designees.
“Personal Information” means information Vendor Processes under the Agreement that: (i) that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, or (ii) is otherwise identified as protected personal information under Applicable Law.
“Processing, processes, or process” means any activity that involves the use of Confidential Information. It includes obtaining, creating, accessing, recording, or holding the data, or carrying out any operation or set of operations on the data including, but not limited to, organizing, amending, retrieving, using, disclosing, erasing, encrypting, decrypting, or destroying it. Processing also includes transferring Confidential Information to third parties.
“Representatives” means, with respect to any party, any of the person or entity’s Affiliates, directors, officers, managers, employees, agents or professional advisers, to whom the party discloses Confidential Information.
“Security Breach” means any act or omission that compromises the security, confidentiality, availability or integrity of Confidential Information or the physical, technical, administrative, or organizational safeguards put in place to protect it. The loss of or unauthorized access, disclosure, or acquisition of Confidential Information is a Security Breach whether or not the incident rises to the level of a security breach under Applicable Law.
16. INFORMATION SECURITY.
16.1 WISP. Vendor shall implement and maintain a written information security program, including appropriate policies, procedures, and risk assessments that are reviewed at least annually.
16.2 Safeguards. Without limiting Vendor’s obligations under Section 3.1, Vendor shall implement administrative, physical, and technical safeguards to protect Confidential Information from unauthorized access, acquisition, or disclosure, destruction, alteration, accidental loss, misuse, or damage that are no less rigorous than accepted industry practices, and shall ensure that all such safeguards, including the manner in which Confidential Information is Processed, comply with Applicable Law and the terms and conditions of this Agreement.
16.3 PCI. If Vendor Processes credit, debit, or other payment cardholder information in the course of Vendor’s engagement by Intact, Vendor shall at all times remain in compliance with current Payment Card Industry Data Security Standard ("PCI DSS") requirements, including remaining aware at all times of changes to the PCI DSS and promptly implementing all procedures and practices and self-assessments as may be necessary to remain in compliance with the PCI DSS, in each case, at Vendor’s sole cost and expense.
16.4 Minimum Safeguards. At a minimum, Vendor’s safeguards for the protection of Confidential Information and information systems shall include:
a. limiting access to Confidential Information to extent required by Applicable Law;
b. securing business facilities, data centers, paper files, servers, scheduled and verified backup systems, and computing equipment, including, but not limited to, all mobile devices and other equipment with information storage capability;
c. implementing network, application, database, and platform security;
d. securing information transmission, storage, and disposal;
e. implementing commercially reasonable authentication and access controls within media, applications, operating systems, commercial software and equipment;
f. implementing multi-factor authentication (MFA) for any individual accessing Vendor Systems;
g. encrypting Confidential Information stored at rest;
h. encrypting Confidential Information transmitted over public or wireless networks;
i. strictly segregating Confidential Information from information of Vendor or Vendor’s other customers so that Confidential is not commingled with any other types of information;
j. no less than annually, conducting risk assessments and penetration testing and promptly implementing, at Vendor’s sole cost and expense, a corrective action plan to correct any issues that are reported as a result;
k. no less than monthly, conducting vulnerability scans and promptly implementing, at Vendor’s sole cost and expense, a corrective action plan to correct any significant issues that are reported as a result of the monitoring and testing, ensuring that vulnerabilities are remedied and patches installed on an accelerated basis for zero-day, critical and high vulnerabilities. For zero-day vulnerabilities, implementing appropriate mitigation measures promptly on notification of the zero-day vulnerability. Remediating zero-day, high and critical vulnerabilities through patching, decommission, or compensating controls. Patching critical vulnerabilities within 24 hours or less of discovery; high vulnerabilities within 15 days or less of discovery and patch medium vulnerabilities within 30 days or less of discovery;
l. implementing appropriate personnel security and integrity procedures and practices, including, but not limited to, conducting background checks consistent with Applicable Law; and
m. providing appropriate privacy and information security training to Vendor’s employees and to any Authorized Person;
n. maintaining commercial off-the-shelf software in accordance with manufacturer recommendations, including applying all security patches and hotfixes no later than the next release of patches and hotfixes from the manufacturer;
o. maintaining all hardware in accordance with the manufacturer’s recommended guidelines, including patching of all Firmware / BIOS levels no later than the next release of firmware and BIOS Levels unless other circumstances impacting the business prevent this action;
p. implementing endpoint controls including appropriate use of malware detection, whitelisting, encryption, and media protections;
q. maintaining a formalized crisis response plan, a formalized disaster recovery plan along with proof of test results, and a formalized business continuity plan.
16.5 Authorized Persons. During the term of each Authorized Person’s employment by Vendor, Vendor shall at all times cause such Authorized Person to abide by Applicable Law and to strictly abide by Vendor’s obligations under this Agreement and Vendor’s standard policies and procedures. Vendor shall maintain a disciplinary process to address any unauthorized access, use, or disclosure of Confidential Information by any of Vendor’s officers, partners, principals, employees, agents, or contractors.
16.6 Network Diagram. Upon Intact's written request, Vendor shall provide Intact with a network diagram that outlines Vendor’s information technology network infrastructure and all equipment used in relation to fulfilling its obligations under this Agreement, including, without limitation: (i) connectivity to Intact and all third parties who may access Vendor’s network to the extent the network contains Confidential Information; (ii) all network connections, including remote access services and wireless connectivity; (iii) all access control measures (for example, firewalls, packet filters, intrusion detection and prevention services, and access-list-controlled routers); (iv) all backup or redundant servers; and (v) permitted access through each network connection.
16.7 Hosting. Vendor agrees to host, store, and Process Confidential Information only in the United States or Canada, unless otherwise expressly authorized in writing by Intact.
16.8 Vendor Systems. Vendor shall be solely responsible for the information technology and Security infrastructure, including but not limited to all computers, software, databases, electronic systems (including database management systems, storage devices and cloud services), and networks used by or for Vendor (including third party systems and services) to deliver the services (“Vendor Systems”) and shall monitor, patch and prevent unauthorized access to the Intact Systems through the Vendor Systems. Vendor will take action to mitigate exposure when new vulnerabilities are found based on severity, especially for zero-day exploits.
16.9 Subcontractors. Vendor shall immediately disclose to the Intact the use of subcontractors that may have access to or use of Intact Systems or Confidential Information. Intact shall have the ability to reject the use of any subcontractors for work on Intact Systems or Confidential Information at any time. Notwithstanding the foregoing, Vendor shall remain responsible and liable for all subcontractors, sub-processors, downstream service providers or other third parties used by Vendor in the provision of Vendor’s services. Vendor shall conduct and document risk-based due diligence and ongoing oversight of all subcontractors, sub-processors, downstream service providers and third parties that access or Process Confidential Information or Intact Systems to verify the adequacy of their cybersecurity practices, including but not limited to controls relating to access management, encryption, incident response, and vulnerability management.
17. SECURITY INCIDENTS.
17.1 Contact. Vendor shall provide Intact with the name and contact information of one of Vendor’s employees who shall serve as Intact's primary security contact and shall be available to assist Intact 24 hours per day, 7 days per week as a contact in resolving obligations associated with a Security Breach.
17.2 Notification to Intact. Vendor shall notify Intact of a Security Breach as soon as practicable, but no later than 24 hours after Vendor becomes aware of it by email at privacyandsecurity@intact.com with a copy by email to Vendor’s primary business contact within Intact.
17.3 Breach Response. Immediately following Vendor’s notification to Intact of a Security Breach, Vendor shall coordinate with Intact to investigate the Security Breach. Vendor agrees to cooperate with Intact in Intact’s handling of the matter, including, without limitation: (i) assisting with any investigation; (ii) providing Intact (or its designated representative) with physical access to the facilities and operations affected; (iii) facilitating interviews with Vendor’s employees and others involved in the matter; and (iv) making available all relevant records, logs, files, archives, data reporting, and other materials required to comply with Applicable Law, regulation, industry standards, or as otherwise required by Intact.
17.4 Containment. Vendor shall at Vendor’s own expense use best efforts to immediately contain and remedy any Security Breach and prevent any further Security Breach, including, but not limited to taking any and all action necessary to comply with Applicable Law.
17.5 Indemnity. In addition to any indemnification obligations contained in the Agreement, Vendor shall reimburse Intact for the expenses incurred by Intact with respect to a cybersecurity incident involving its information system that impacts Intact’s data, including but not limited to all costs of notice and/or remediation. If Intact reasonably determines that Vendor has breached any material term of this Schedule, Intact shall have the right, at its sole discretion, to require timely remediation and/or terminate the underlying Agreement early with no penalty to Intact.
17.6 Notification to Third Parties. Vendor agrees that Vendor shall not inform any third party of any Security Breach without first obtaining Intact's prior written consent, other than to inform a complainant that the matter has been forwarded to Intact's legal counsel. Further, Vendor agrees that Intact shall have the sole right to determine: (i) whether notice of the Security Breach is to be provided to any individuals, regulators, law enforcement agencies, consumer reporting agencies, or others as required by law or regulation, or otherwise in Intact's discretion; (ii) the contents of such notice; and (iii) whether any type of remediation may be offered to affected persons, and the nature and extent of any such remediation.
17.7 Records. Vendor agrees to maintain and preserve all documents, records, logs, backups and other data related to any Security Breach indefinitely or until otherwise instructed.
17.8 Cooperation. Vendor agrees to fully cooperate at Vendor’s own expense with Intact in any litigation, investigation, or other action deemed necessary by Intact to protect its rights relating to the use, disclosure, protection, and maintenance of Confidential Information.
18. OVERSIGHT OF SECURITY PROCEDURES. Upon Intact's written request to confirm Vendor’s compliance with this Agreement, Applicable Law and industry standards, Vendor grants Intact or, upon Intact’s election, a third party on Intact's behalf, permission to perform an assessment, audit, examination, or review of all controls in Vendor’s physical and/or technical environment in relation to all Confidential Information Vendor Process. Vendor shall fully cooperate with such assessment by answering all questions and inquiries and by providing access to knowledgeable personnel, physical premises, documentation, infrastructure, and application software that processes, stores, or transports Confidential Information for Intact pursuant to this Agreement. In addition, upon Intact's written request, Vendor shall provide Intact with the written results of any audit performed by Vendor or on Vendor’s behalf that assesses the effectiveness of Vendor’s information security program as relevant to the security and confidentiality of Confidential Information shared during the course of this Agreement.
19. ARTIFICIAL INTELLIGENCE TECHNOLOGY.
19.1 Unless Intact provides written consent in advance in a separate written agreement, Vendor shall not use any data obtained from Intact (including Intact Confidential Information or any Personal Information) to train, enhance, evaluate, fine-tune, or develop any Artificial Intelligence Technology. Upon request, Vendor shall promptly provide Intact with particulars of all Artificial Intelligence Technology utilized by Vendor (and its subcontractors) to provide the Services and/or deliverables, including the AI component inventory described in the AI / Generative AI Safeguards Section 6.2 below.
19.2 AI/GenAI Minimum Safeguards. To the extent Vendor uses any Artificial Intelligence Technology to provide the Services or to process Intact Data, Vendor shall: not use Intact Data (including prompts, chat logs, outputs, embeddings, or telemetry) to train, fine-tune, evaluate, or improve any model except as necessary to provide the Services and only with Intact’s prior written consent (opt-in); implement administrative, technical, and physical controls to protect Intact Data within AI Systems, including access controls, least-privilege tool permissions, and protections against prompt injection, sensitive data disclosure, insecure output handling, and abusive/unbounded consumption; maintain transparency of AI sub-processors/model providers (an AI component inventory) and provide notice of material changes to AI components that affect Intact Data processing; retain AI interaction data (prompts/outputs/logs/embeddings) only for the minimum period necessary for the Services and as otherwise required by law, and protect such data as Confidential Information; ensure these obligations pass down to all AI-related sub-processors, subcontractors and third parties and remain responsible for their performance, acts and omissions; and treat AI-related security events (including data leakage via prompts/outputs/logs, unauthorized tool actions, or model supply chain compromise) as Security Incidents subject to Section 4.
20. DELETION & DISPOSAL. Upon termination and after Intact has retrieved any required data (or as otherwise instructed by Intact) Vendor will delete or destroy all of Intact’s data in accordance with standard best practices such as NIST 800-88 Guidelines for media sanitation; provided however, that Vendor will not be required to remove copies of Intact data from Vendor’s backup media and servers until such time as the backup copies are scheduled to be deleted in the normal course of business; provided further that in all cases Vendor will continue to protect the Intact data. All Confidential Information of Intact stored on any Systems shall be rendered unrecoverable prior to the disposal of such Systems.
21. USE OF PERSONAL INFORMATION. For purposes of this Section, capitalized terms not previously defined shall have the meanings given to such terms in the California Consumer Privacy Act of 2018, Cal. Civil. Code 1798.100 et seq., as amended by the California Privacy Rights and Enforcement Act of 2020, and any regulations promulgated thereunder (“CCPA”). “Intact Personal Information” shall mean Personal Information that Vendor receives from or on behalf of Intact as part of the provision of Services under the Agreement. “Contracted Business Purposes” shall mean the Services described in the Agreement for which Vendor receives or accesses Intact Personal Information.
21.1 Vendor shall process Intact Personal Information in furtherance of the Business Purposes under applicable law only. Vendor shall not sell or share the Intact Personal Information, nor retain, use, or disclose Intact Personal Information for any purpose other than performing Vendor’s obligations pursuant to this Agreement. Vendor shall not combine the Intact Personal Information with personal information received from another party or directly from the individual unless permitted by regulation.
21.2 Vendor shall notify Intact if Vendor receives a CCPA request regarding Intact Personal Information. Vendor shall provide reasonable assistance to Intact to meet its response obligations under applicable law. As required by applicable law, Vendor shall comply with deletion and access requests for Intact Personal Information.
21.3 Both parties will comply with all applicable requirements of the CCPA when collecting, using, retaining, or disclosing personal information. Vendor certifies that it understands this Agreement's and the CCPA's restrictions and prohibitions on selling personal information and retaining, using, or disclosing personal information outside of the parties' direct business relationship, and will comply with them.
21.4 Vendor warrants that it has no reason to believe any CCPA requirements or restrictions prevent Vendor from providing any of the Contracted Business Purposes or otherwise performing under this Agreement. Vendor must promptly notify Intact of any changes to the CCPA's requirements that may adversely affect Vendor’s performance under the Agreement or Vendor’s ability to comply with the CCPA.
21.5 Vendor grants Intact the right to (1) take reasonable and appropriate steps to help ensure that Vendor is using the Intact Personal Information in a manner consistent with the Intact's CCPA obligations (including but not limited to monitoring contract compliance through administrative measures); and (2) upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Intact Personal Information.
PART III. GUIDELINES FOR REMOTE IT WORKERS
22. INTERVIEW REQUIREMENTS (IN-PERSON OR VIDEO)
22.1 All Vendors who provide remote IT workers must verify candidate location via in-person or video interview only — no voice-only or chat-based interviews.
23. VIDEO INTERVIEW PROTOCOL
Before the Interview
Obtain a copy of the candidate’s government-issued ID.
Review the candidate’s digital profile (e.g., LinkedIn) to verify experience.
During the Interview
Ensure screen filters are disabled.
Ask targeted questions to verify location and background.
Have the candidate present their original ID on camera to cross-check with the electronic copy.
Confirm the candidate’s right to work in the jurisdiction.
Conduct live problem-solving and technical assessments relevant to the role.
Apply safeguards to detect deepfake usage (e.g., delayed responses, unnatural eye movement, lip-sync issues, mechanical voice, scripted answers).
Sample Targeted Interview Questions
Camera & Work Setup Validation: Ask for live views of daylight, electrical outlets, clocks, or work furniture.
Location Anchoring: Ask about local landmarks, restaurants, sports teams, weather, etc.
Courier & Delivery Validation: Ask about delivery services used and return processes.
Work Schedule & Environment: Ask about daily routines, workspace setup, and handling of internet outages.
Red Flag Escalation: If concerns persist, consider asking about political topics (e.g., North Korean leadership) — impostors may avoid answering.
Mailing Address Verification. Service providers must send documents and equipment only to the address listed on the hire’s ID. If a different address is requested, obtain supporting documentation.
24. CREDENTIAL VERIFICATION
Verify credentials (e.g. educational and employment history and geographical affiliations, including ties to sanctioned entities or regions of concern) directly with issuing institutions — do not rely on contact information provided by the applicant.
Scrutinize documents and PII for forgery or inconsistencies.
Cross-check personal and professional details across platforms and documents.
25. PAYMENT SAFEGUARDS
Do not allow cryptocurrency payments.
Verify banking information against the hire’s ID.
Do not permit payments to third-party accounts.
