DocuSign Envelope ID: 63AC5BCC-395A-4E89-925C-C7DAB7142924

Certificate
Certificate number: 2020-026
Certified by EY CertifyPoint since: November 6, 2020

Based on certification examination in conformity with defined requirements in ISO/IEC

17021-1:2015, the Cloud Security Management System as defined and implemented by

Amazon Web Services, Inc.*

and its affiliates (collectively referred to as Amazon Web Services (AWS)) are compliant
with the requirements as stated in the standard:

CSA STAR CCM v4.0

Issue date of certificate: November 18, 2022
Re-issue date of certificate: May 23, 2023
Expiration date of certificate: November 30, 2025
Last certification cycle expiration date: November 30, 2022

EY CertifyPoint will, according to the certification agreement dated April 1, 2022,

perform surveillance audits and acknowledge the certificate until the expiration date
noted above, or the expiration of the corresponding ISO/IEC 27001:2013 certification
with certificate number 2013-009.

*With regard to the specific requirements for information security as stated in the Statement of
Applicability, version 2022.01 dated October 10, 2022, this certification is applicable to (a) the services
and their associated assets and locations as described in the scoping section of this certificate, and (b) any
affiliates that are responsible for, or that contribute to, the provision of such services and their associated
assets and locations.

J. Sehgal | Director, EY CertifyPoint

This certificate is not transferable and remains the property of Ernst & Young CertifyPoint B.V, located at Antonio Vivaldistraat 150, 1083 HP, Amsterdam, the Netherlands. Any dispute relating to this certificate
shall be subject to Dutch law in the exclusive jurisdiction of the court in Rotterdam. The content must not be altered and any promotion by employing this certificate or certification body quality mark must adhere
to the scope and nature of certification and to the conditions of contract. Given the nature and inherent limitations of sample-based certification assessments, this certificate is not meant to express any form of
assurance on the performance of the organization being certified to the referred ISO standard. The certificate does not grant immunity from any legal/ regulatory obligations. All rights reserved. © Copyright

Page 1 of 6 Digital version

DocuSign Envelope ID: 63AC5BCC-395A-4E89-925C-C7DAB7142924

Amazon Web Services, Inc.

Scope for certificate 2020-026

The scope of this CSA STAR CCM 4.0 certification is bounded by specified services of
Amazon Web Services, Inc. and specified facilities. The Cloud Security Framework is
centrally managed out of Amazon Web Services, Inc. headquarter in Seattle,
Washington, United States of America.

The in-scope applications, systems, people, and processes are globally implemented and
operated by teams out of an explicit set of facilities that comprise Amazon Web Services,
Inc. and are specifically defined in the scope and bounds.

The Amazon Web Services, Inc. ISMS scope includes the services as mentioned on
https://aws.amazon.com/compliance/iso-certified/, the locations and Supporting
Resources are stated in the following section of this certificate.

The Cloud Security Management System mentioned in the above scope is restricted as
defined in “IIMS Manual” version 2023.02, dated May 15, 2023.

This scope is only valid in connection with certificate 2020-026.

Page 2 of 6 Digital version

DocuSign Envelope ID: 63AC5BCC-395A-4E89-925C-C7DAB7142924

Amazon Web Services, Inc.

Scope for certificate 2020-026

Locations in scope:

AWS Services are offered and available across multiple geographic regions around the
world. The scope of AWS infrastructure includes corporate headquarters, data center
facilities, network and server hardware, and resources which support the datacenter
operations. AWS data centers house the hardware supporting the AWS Services listed
above.

AWS Data center Locations in:

► Africa (Cape Town) ► Europe (Ireland)

► Asia Pacific (Hong Kong) ► Europe (London)
► Asia Pacific (Hyderabad) ► Europe (Milan)
► Asia Pacific (Jakarta) ► Europe (Paris)
► Asia Pacific (Melbourne) ► Europe (Spain)
► Asia Pacific (Mumbai) ► Europe (Stockholm)
► Asia Pacific (Osaka) ► Europe (Zurich)
► Asia Pacific (Seoul) ► Middle East (Bahrain)
► Asia Pacific (Singapore) ► Middle East (UAE)
► Asia Pacific (Sydney) ► South America (São Paulo)
► Asia Pacific (Tokyo) ► US East (Northern Virginia)
► AWS GovCloud (US-East) ► US East (Ohio)
► AWS GovCloud (US-West) ► US West (Northern California)
► Canada (Central) ► US West (Oregon)
► Europe (Frankfurt)

AWS Edge Locations in:

► Alexandria, Australia ► Barcelona, Spain

► Amsterdam, Netherlands ► Bekasi, Indonesia
► Anyang-si, Republic of Korea ► Berlin, Germany
► Ashburn, United States ► Bhubaneswar, India
► Athens, Greece ► Billerica, United States
► Atlanta, United States ► Birmingham, United Kingdom
► Auckland, New Zealand ► Bogota, Colombia
► Ballerup, Denmark ► Boston, United States
► Bangalore, India ► Brentford, United Kingdom
► Bangkok, Thailand ► Brussels, Belgium
► Bannmai, Thailand ► Bucharest, Romania
► Banqiao District, New Taipei City, ► Budapest, Hungary
Taiwan ► Buenos Aires, Argentina

This scope is only valid in connection with certificate 2020-026.

Page 3 of 6 Digital version

DocuSign Envelope ID: 63AC5BCC-395A-4E89-925C-C7DAB7142924

Amazon Web Services, Inc.

Scope for certificate 2020-026

► Caba, Argentina ► Jakarta, Indonesia

► Canberra, Australia ► Jersey City, United States
► Cape Town, South Africa ► Johannesburg, South Africa
► Changodar, India ► Kansas City, Missouri, United
► Chennai, India States
► Chicago, United States ► Khlong Nueng, Thailand
► Christchurch, New Zealand ► Kolkata, India
► Clonshaugh, Ireland ► Koto City, Japan
► Columbus, United States ► Kropia, Greece
► Copenhagen, Denmark ► Kuala Lumpur, Malaysia
► Dallas, United States ► Las Vegas, United States
► Denver, United States ► Lisbon, Portugal
► Dubai, United Arab Emirates ► London, United Kingdom
► Dublin, Ireland ► Los Angeles, United States
► Dusseldorf, Germany ► Madrid, Spain
► Eden Prairie, United States ► Manama, Bahrain
► El Segundo, United States ► Manchester, United Kingdom
► Elk Grove Village, United States ► Manila, Philippines
► Estación Terrena, Peru ► Marseille, France
► Frankfurt, Germany ► Melbourne, Australia
► Fujairah, United Arab Emirates ► Memphis, United States
► Garland, United States ► Miami, United States
► General Pacheco, Argentina ► Milan, Italy
► Greenwood Village, United ► Milpitas, United States
States ► Milton Keynes, United Kingdom
► Haifa, Israel ► Minneapolis, United States
► Hamburg, Germany ► Montréal, Canada
► Ha Noi, Vietnam ► Mumbai, India
► Helsinki, Finland ► Munich, Germany
► Hillsboro, United States ► Nairobi, Kenya
► Ho Chi Minh, Vietnam ► Nashville, United States
► Hong Kong, SAR ► Neihu District, Taiwan
► Houston, United States ► New Delhi, India
► Huechuraba, Chile ► New York City, United States
► Hull, United Kingdom ► Newark, United States
► Hyderabad, India ► Noord Holland, Netherlands
► Irving, United States ► Norfolk, United States
► Itasca, United States ► North Las Vegas, United States
► Jaipur, India ► Osaka, Japan
► Jacksonville, United States ► Oslo, Norway

This scope is only valid in connection with certificate 2020-026.

Page 4 of 6 Digital version

DocuSign Envelope ID: 63AC5BCC-395A-4E89-925C-C7DAB7142924

Amazon Web Services, Inc.

Scope for certificate 2020-026

► Pakkret, Thailand ► Shinagawa, Japan

► Palermo, Italy ► Singapore, Singapore
► Palo Alto, United States ► Slough, United Kingdom
► Paris, France ► Sofia, Bulgaria
► Parkwest, Ireland ► Southfield, United States
► Patna, India ► Stockholm, Sweden
► Perth, Australia ► Stretford, United Kingdom
► Philadelphia, United States ► Surrey, United Kingdom
► Phoenix, United States ► Sydney, Australia
► Piscataway, United States ► Taipei, Taiwan
► Pittsburgh, United States ► Tallinn, Estonia
► Portland, United States ► Tambon Klong Tamru, Thailand
► Prague, Czech Republic ► Tel Aviv, Israel
► Pueblo Nuevo, Panama ► Tempe, United States
► Rancho Cordova, United States ► Thung Song Hong, Thailand
► Reston, United States ► Tokyo, Japan
► Richardson, United States ► Toronto, Canada
► Rio de Janeiro, Brazil ► Tukwila, United States
► Rome, Italy ► Ultimo, Australia
► Rosedale, New Zealand ► Vancouver, Canada
► San Diego, United States ► Vienna, Austria
► San Jose, United States ► Vienna, United States
► Santiago de Querétaro, Mexico ► Warsaw, Poland
► Santiago, Chile ► West Valley City, United States
► São Paulo, Brazil ► Wiltshire, United Kingdom
► Schiphol-Rijk, Netherlands ► Zagreb, Croatia
► Seattle, United States ► Zurich, Switzerland
► Secaucus, United States
► Seoul, Republic of Korea

Wavelength locations in:

► Alpharetta, United States ► Charlotte, United States

► Annapolis Junction, United ► Daejeon, South Korea
States ► Denver, United States
► Atlanta, United States ► Dortmund, Germany
► Aurora, United States ► Euless, United States
► Azusa, United States ► Houston, United States
► Berlin, Germany ► Las Vegas, United States
► Boston, United States ► London, United Kingdom
► Los Angeles, United States

This scope is only valid in connection with certificate 2020-026.

Page 5 of 6 Digital version

DocuSign Envelope ID: 63AC5BCC-395A-4E89-925C-C7DAB7142924

Amazon Web Services, Inc.

Scope for certificate 2020-026

► Minneapolis, United States ► Southfield, United States

► Munich, Germany ► Tama, Japan
► New Berlin, United States ► Tempe, United States
► Osaka, Japan ► Tokyo, Japan
► Pembroke Pines, United ► Toronto, Canada
States ► Wall Township, United
► Redmond, United States States
► Rocklin, United States ► Westborough, United States

Local zone locations in:

► Atlanta, United States ► Phoenix, United States

► Boston, United States ► Piscataway, United States
► Chicago, United States ► Richardson, United States
► New Delhi, India ► Seattle, United States
► Denver, United States ► Bangkok, Thailand
► El Segundo, United States ► Buenos Aires, Argentina
► Greenwood Village, United States ► Copenhagen, Denmark
► Hillsboro, United States ► Dallas, United States
► Houston, United States ► Hamburg, Germany
► Irvine, United States ► Helsinki, Finland
► Kansas City, United States ► Lima, Peru
► Kolkata, India ► Muscat, Oman
► Las Vegas, United States ► Perth, Australia
► Lee’s Summit, United States ► Queretaro, Mexico
► Los Angeles, United States ► Santiago, Chile
► Miami, United States ► Taipei, Taiwan
► Minneapolis, United States ► Warsaw, Poland
► Philadelphia, United States

This scope is only valid in connection with certificate 2020-026.

Page 6 of 6 Digital version