FINZOOPAY SOLUTIONS LLP

This Policy establishes the governance framework for protecting FINZOOPAY SOLUTIONS LLP's information, technology resources, applications, APIs, customer information, transaction information, business records and digital services against unauthorised access, misuse, disclosure, alteration, loss, destruction and cyber threats.

• Protect confidentiality, integrity and availability of information.
• Establish clear security ownership and accountability.
• Prevent, detect and respond to information-security and cyber-security incidents.
• Protect customer, transaction, payment and business information.
• Maintain secure technology operations and appropriate auditability.
• Support business continuity, recovery and applicable contractual or legal security obligations.

This Policy applies to employees, contractors, consultants, partners, systems, applications, APIs, websites, cloud services, databases, endpoints, networks, payment integrations, transaction systems, customer channels and third-party technology services used for the Company's business.

Management shall provide appropriate oversight, resources and accountability for information security. Security responsibilities shall be assigned to appropriate personnel and periodically reviewed.

• Public – information approved for public disclosure.
• Internal – information intended for authorised business use.
• Confidential – customer, transaction, financial, security, partner and business information requiring controlled access.
• Restricted – highly sensitive information requiring enhanced controls and limited access.

• Access shall be authorised according to business need and least privilege.
• User access shall be periodically reviewed.
• Privileged access shall be restricted and monitored.
• Access shall be modified or revoked when roles change or personnel leave.

Appropriate authentication controls shall be implemented based on system risk. Strong passwords, multi-factor authentication where supported, secure credential storage and protection against credential sharing shall be maintained.

Devices, networks and communications shall be protected through appropriate security configuration, access controls, security updates, malware protection, encryption, firewalls and monitoring based on risk.

• Secure application development and change management.
• Authentication and authorisation controls.
• Input validation and protection against common application threats.
• API authentication, access restrictions and abuse controls where appropriate.
• Security logging and monitoring.

Customer, payment, voucher, transaction and business information shall be protected against unauthorised access, alteration, disclosure, loss or destruction. Sensitive information shall be protected in transit and, where appropriate, at rest. Payment and transaction systems shall use appropriate authentication, access control, monitoring and reconciliation controls.

Material systems shall maintain appropriate security and audit logs. Security vulnerabilities shall be identified, assessed and remediated according to severity and business risk. Security updates shall be applied within appropriate timelines considering system criticality.

Critical information and systems shall have appropriate backup and recovery arrangements. Backups shall be protected against unauthorised access, corruption and accidental deletion and tested where appropriate.

Security incidents shall be managed under the Company's Cyber Incident Response & Cyber Fraud Management Policy, including identification, containment, investigation, evidence preservation, escalation, recovery and post-incident improvement.

Technology, payment, hosting, API, KYC, communication and other material service providers shall be assessed according to risk. Appropriate contractual security, confidentiality and incident-notification requirements shall be established where relevant.

• Protect credentials and Company devices.
• Do not share passwords, tokens or confidential information without authorisation.
• Use only authorised remote-access methods.
• Report phishing, malware, credential compromise or security incidents promptly.
• Do not bypass security controls or access unauthorised systems.

Material changes to production systems, applications, APIs, payment integrations and security controls shall follow an authorised change process. Security assessments, vulnerability testing or penetration testing shall be performed according to system criticality, risk and applicable requirements.

Information shall be retained according to applicable requirements. When no longer required, information shall be securely deleted, destroyed, anonymised or otherwise rendered appropriately inaccessible.

Relevant personnel shall receive periodic security awareness. Employees, contractors and relevant partners shall promptly report suspected security incidents, data exposure, credential compromise, malware, phishing or unauthorised access through designated channels.

Security exceptions shall be documented, risk-assessed and approved by authorised management and shall not override mandatory requirements. Management may receive reports on incidents, vulnerabilities, access reviews, testing, training, third-party risks and remediation.

This Policy shall be reviewed at least annually and following material cyber incidents, significant technology changes, changes in business operations or applicable security requirements.