Certificate of Registration

CLOUD SECURITY MANAGEMENT SYSTEM - CSA STAR CERTIFICATION 2014

This is to certify that: Demandware, Inc. 5 Wall Street Burlington Massachusetts 01803 USA

Holds Certificate No: STAR 632483 and operates a Cloud Security Management System which complies with the requirements of CSA STAR CERTIFICATION 2014 for the following scope:

The provision of a the Commerce Platform and includes development practices, security and monitoring of the platform services performed, managed and hosted globally in Demandware offices and 3rd party data centers and in the cloud. This is in accordance with the Statement of Applicability version 1.2 April 2015and CCM_v3.0.1_Demandware_V 2_APR_10_2015-2.

For and on behalf of BSI: Reg Blake, VP Regulatory Affairs, BSI Group America Inc.

Original Registration Date: 08/04/2015 Effective Date: 08/04/2015 Latest Revision Date: 09/23/2015 Expiry Date: 06/17/2018

Page: 1 of 4

This certificate remains the property of BSI and shall be returned immediately upon request. An electronic certificate can be authenticated online. Printed copies can be validated at www.bsigroup.com/ClientDirectory To be read in conjunction with the scope above or the attached appendix.

Americas Headquarters: BSI Group America Inc., 12950 Worldgate Drive, Suite 800, Herndon, VA 20170-6007 USA A Member of the BSI Group of Companies. Certificate No: STAR 632483

Location Registered Activities

Demandware, Inc. The provision of a the Commerce Platform and includes 5 Wall Street development practices, security and monitoring of the Burlington platform services performed, managed and hosted globally in Massachusetts Demandware offices and 3rd party data centers and in the cloud. This is in accordance with the Statement of 01803 Applicability version 1.2 April 2015and USA CCM_v3.0.1_Demandware_V 2_APR_10_2015-2. Demandware, Inc. The provision of a the Commerce Platform and includes 1166 West Newport Center Drive development practices, security and monitoring of the Suite 210 platform services performed, managed and hosted globally in Deerfield Beach Demandware offices and 3rd party data centers and in the cloud. This is in accordance with the Statement of Florida Applicability version 1.2 April 2015and 33442 CCM_v3.0.1_Demandware_V 2_APR_10_2015-2. USA Demandware, Inc. 3rd Party Data Center. c/o Equinix Data Center Elk Grove Village Illinois USA Demandware, Inc. 3rd Party Data Center. c/o Equinix Data Center Ashburn Virginia USA Demandware, Inc. 3rd Party Data Center. c/o Equinix Data Center San Jose California USA Demandware, Inc. 3rd Party Data Center. c/o Equinix Data Center Atlanta Georgia USA Demandware, Inc. 3rd Party Data Center. c/o Equinix Data Center Secaucus New Jersey USA

Original Registration Date: 08/04/2015 Effective Date: 08/04/2015 Latest Revision Date: 09/23/2015 Expiry Date: 06/17/2018

Page: 2 of 4 This certificate remains the property of BSI and shall be returned immediately upon request. An electronic certificate can be authenticated online. Printed copies can be validated at www.bsigroup.com/ClientDirectory To be read in conjunction with the scope above or the attached appendix.

Americas Headquarters: BSI Group America Inc., 12950 Worldgate Drive, Suite 800, Herndon, VA 20170-6007 USA A Member of the BSI Group of Companies. Certificate No: STAR 632483

Location Registered Activities

Demandware, Inc. 3rd Party Data Center. c/o Equinix Data Center Dallas Texas USA Demandware, Inc. 3rd Party Data Center. c/o Equinix Data Center Seattle Washington USA Demandware, Inc. 3rd Party Data Center. c/o Navisite Data Center Andover Massachusetts USA Demandware, Inc. 3rd Party Data Center. c/o Sungard Data Center Scottsdale Arizona USA Demandware, Inc. 3rd Party Data Center. c/o Equinix Data Center Amsterdam Demandware - The provision of a the Commerce Platform and includes Leutragraben 2-4 development practices, security and monitoring of the Jena platform services performed, managed and hosted globally in 07743 Demandware offices and 3rd party data centers and in the cloud. This is in accordance with the Statement of Germany Applicability version 1.2 April 2015and CCM_v3.0.1_Demandware_V 2_APR_10_2015-2. Demandware, Inc. 3rd Party Data Center. c/o Equinix Data Center Düsseldorf Germany Demandware, Inc. 3rd Party Data Center. c/o Equinix Data Center Frankfurt Germany

Original Registration Date: 08/04/2015 Effective Date: 08/04/2015 Latest Revision Date: 09/23/2015 Expiry Date: 06/17/2018

Page: 3 of 4 This certificate remains the property of BSI and shall be returned immediately upon request. An electronic certificate can be authenticated online. Printed copies can be validated at www.bsigroup.com/ClientDirectory To be read in conjunction with the scope above or the attached appendix.

Americas Headquarters: BSI Group America Inc., 12950 Worldgate Drive, Suite 800, Herndon, VA 20170-6007 USA A Member of the BSI Group of Companies. Certificate No: STAR 632483

Location Registered Activities

Demandware, Inc. 3rd Party Data Center. c/o Equinix Data Center Munich Germany Demandware, Inc 3rd Party Data Center. c/o Equinix Data Centre Slough Berkshire SL1 4AX Demandware, Inc. 3rd Party Data Center. c/o Equinix Data Centre Birmingham B30 2BD United Kingdom Demandware, Inc. 3rd Party Data Center. c/o Equinix Data Center Alexandria Demandware The provision of a the Commerce Platform and includes c/o Equinix development practices, security and monitoring of the 1/F Global Gateway 3 platform services performed, managed and hosted globally in Shing You Street Kwai Chung Demandware offices and 3rd party data centers and in the cloud. This is in accordance with the Statement of New Territories Applicability version 1.2 April 2015and CCM_v3.0.1_Demandware_V 2_APR_10_2015-2.

Original Registration Date: 08/04/2015 Effective Date: 08/04/2015 Latest Revision Date: 09/23/2015 Expiry Date: 06/17/2018

Page: 4 of 4 This certificate remains the property of BSI and shall be returned immediately upon request. An electronic certificate can be authenticated online. Printed copies can be validated at www.bsigroup.com/ClientDirectory To be read in conjunction with the scope above or the attached appendix.

Americas Headquarters: BSI Group America Inc., 12950 Worldgate Drive, Suite 800, Herndon, VA 20170-6007 USA A Member of the BSI Group of Companies.