Lucit Content Security Overview

This document is a general overview of the processes by which Lucit obtains data, text and photos, how they are stored, and how they are transported through our API’s

Purpose of this document This document relates specifically to the security of Lucit’s integrations with various 3rd party data systems for eCommerce, CMS, Automotive and Real Estate as well as user generated content within the Lucit App

Audience This document is intended for out of home operator teams, technical staff, and security professionals.

Data Sources There are various eCommerce, automotive and real estate data systems in use that are designed to tie inventory into CRM, Invoicing, Billing, Contract and Online Marketing systems. Lucit has built connectivity to a large number of these data providers in order to retrieve data and photos in real-time from the middleware that acts as a conduit from the local inventory system out to the internet. For some types of inventory, we interface with infrastructure that was initially built for another purpose which was to post vehicles and homes to online marketplaces such as Autotrader, Car Gurus, Zillow, Realtor.com, etc. In addition to the data-fed content, users have the ability to modify the content (Photos, Text) from within the Lucit App.

Data Flow Data flows from within the local entity in a process that looks something like this (using Automotive as an example)

1. A new vehicle is added to the lot. This vehicle is added to the dealers DMS (Dealer Management System) including basic information such as make, model, vin etc.

2. The local marketing person in charge of taking photos, shoots photos of the vehicle and then uploads those photos to the DMS provided application adding images to inventory.

3. This data then flows out from the DMS into 1 or more middleware providers that enhance the data with manufacturer options, stock photography (if needed), and other things like carfax reports, etc.

4. The middleware provider then prepares a data set for consumption by

   1. The dealer’s own website

   2. 3rd parties such as Autotrader, Cargurus, Facebook, and Lucit

5. When data changes at the DMS (e.g a Price Drops) or a primary photo changes. This change flows back through this system and updates the data feed.

Data Security for Data-Fed Photos When a photo is loaded into a dealership’s DMS. This photo is instantly available to all of the salespeople, principles and marketing people within the dealership. Once this photo moves out into the middleware provider and is re-processed for sites like Autotrader, Facebook, CarGurus, etc., it hits another round of security checks and image recognition systems An inappropriate photo would :

• Most likely be identified before it ever pushed out of the DMS system to the middleware provider

• Would be auto-flagged by the Machine Learning algorithms at the Middleware Provider (e.g. CDK Global, Homenet, COX Automotive, etc.)

• If it passed that filter, it will be flagged down by the AI Filters in the Lucit Moderation Engine

Once images and creatives hit the Lucit system, we re-process them, and re-store them in our own Amazon S3 buckets. We also have the following protections in place:

1. We serve all content over HTTPS

2. S3 buckets immutable and locked for image overwrites

3. We generate a secure hash of every image and we send this hash along with the pull request so it can be validated

4. The data set, including URL’s for images, is stored and hashed. This hash is checked on every request to ensure that the data has not been tampered with.

5. Data flows through the Lucit Moderation Engine and Ad Approval System

Data Security Policies

Data within Lucit is stored as objects with "Deny First" data policies. Access to any specific data is then controlled by User Roles and User Policies.

All data that is fed into Lucit via API's or, via our Data Source Feeds, is automatically attached to the account to which this data belongs, and this data inherits the policy structure of the account.

Application Policies

When attaching third-party apps to your Lucit account, for feeding data in, or feeding data out, applications are scoped with a specific set of policies, in order to control access to data.

These permissions are enumerated by the app developer and are exposed to the user adding the app when authorizing the app for your account

Lucit Moderation and Approvals Operators (Media Owners) may elect to enable pre-approvals of Lucit generated images within the Lucit application. This option allows designated users at an operator to approve images before they are eligible to be presented to the down-level players. This option helps to reduce skips and to provide a unified experience for the end user. With Lucit Approvals, operators can view, in real-time, any creative updates made to campaigns that are running on their boards. We provide flexible options to automate the workflows. For instance, an operator may elect to approve all creatives that are generated by specific data feeds, but then require approvals for ads that have been updated by a human, or, ads that were generated by a human interaction. Alternatively, a user may elect to trust specific app users and allow their creatives through without approval.

Approval Run State Each operator can set an “Approval Run” state to be one of the following

• Team Approved : Only ads that have been manually approved by a member of your team will be able to run. All other ads will queue until they are either manually approved or rejected. Use this setting only if you have notifications enabled, and you are always available to approve ads.

• Team Approved+Auto Approver : In addition to team member approvals, any ads that have been approved by the Lucit Auto Approver will also be able to run. All other ads will queue until they are either approved or rejected. Use this setting to reduce the amount of manual labor involved in approving ads by allowing the auto approver to identify and approve ads that meet a high enough quality threshold.

• Let the Lucit Auto Approver Decide : Let the auto approver make the decision to approve or reject ads automatically. Use this setting if you do not wish to review ads manually and you trust the auto approver to make the right decisions. If the auto approver rejects an ad, it will notify the user that their ad has been rejected, but it will not provide a reason, nor will it notify you that an ad has been rejected.

• Run All Ads : All ads that are posted by users, will automatically start running unless a member of your team reviews and manually rejects them. Use this setting if you trust the Lucit users who are posting ads to your screens and want their ads to start running automatically with no delays. You will still have the ability to reject ads manually after they are posted if you wish.

Lucit Moderation Engine The Lucit Moderation engine powered by SightEngine, uses Text and Image recognition to identify the following core areas

• Profanity

• Offensive Imagery / Phrases

• Weapons

• Alcohol

• Drugs

• Nudity

• Partial Nudity

• Offensive Imagery / Hate Symbols

Our integration SightEngine provides a world-class platform for image recognition and content moderation Based on machine learning algorithms, every creative image is evaluated and scored based on these areas, and an image is grouped into one of “Good” (passing), “Questionable” or “Bad”

User Trust Lucit also introduces the concept of “User Trust”. We track all users that have a hand in all parts of a creative and present this list of users on each image. Operators have the ability to “trust” specific users in order to train the AI Auto Approval engine to auto-approve images for trusted users. NOTE: Images from trusted users will ONLY be approved if the Moderation Score is Good. In all other cases, it will be queued for human approval.