FINZOOPAY SOLUTIONS LLP

1. PURPOSE

This Policy establishes the information-security framework of FINZOOPAY SOLUTIONS LLP to protect information, systems, applications, infrastructure and technology services against unauthorised access, disclosure, alteration, loss, disruption and misuse.

2. SECURITY OBJECTIVES

• Maintain confidentiality, integrity and availability of information.
• Protect customer, transaction, financial, business and security information.
• Reduce cyber and information-security risks through preventive and detective controls.
• Support secure and reliable operation of business systems.
• Establish responsibilities for information-security governance and incident response.

3. SCOPE

This Policy applies to employees, partners, contractors, vendors and systems handling Company information, including applications, APIs, databases, endpoints, cloud services, networks, payment integrations, voucher systems and supporting infrastructure.

4. INFORMATION SECURITY GOVERNANCE

Management shall establish appropriate security governance, responsibilities, resources and risk-management processes proportionate to the Company's business and technology environment.

5. INFORMATION CLASSIFICATION

• Public
• Internal
• Confidential
• Restricted / Highly Sensitive

Information shall be classified according to sensitivity and business impact, and appropriate safeguards shall be applied.

6. ACCESS CONTROL

• Least-privilege access
• Need-to-know access
• Unique user identification
• Strong authentication where appropriate
• Periodic access review
• Timely access revocation
• Controlled privileged access

7. PASSWORD & AUTHENTICATION

Users shall protect passwords and authentication credentials. Where technically and operationally appropriate, multi-factor authentication shall be used for privileged, remote or sensitive access.

8. PRIVILEGED ACCESS

Administrative and privileged access shall be restricted to authorised personnel, protected using enhanced controls and logged where feasible. Shared privileged accounts should be avoided unless technically necessary and appropriately controlled.

9. ASSET MANAGEMENT

The Company shall maintain appropriate records of critical information assets, applications, infrastructure, devices and relevant third-party services.

10. SECURE CONFIGURATION

Systems shall be configured using reasonable security baselines. Unnecessary services, ports, accounts and privileges should be disabled or restricted where practical.

11. NETWORK SECURITY

• Firewall or equivalent network controls where appropriate
• Network segmentation based on risk
• Secure remote access
• Monitoring of significant network events
• Protection of externally exposed systems

12. ENDPOINT SECURITY

Company-managed endpoints shall use appropriate security controls such as supported operating systems, malware protection, patching, screen locking, encryption where appropriate and controlled software installation.

13. PATCH & VULNERABILITY MANAGEMENT

Security vulnerabilities shall be identified and addressed according to severity, exploitability, asset criticality and available remediation options. Critical systems shall receive priority treatment.

14. SECURE SOFTWARE DEVELOPMENT

Applications and APIs developed or maintained by the Company should incorporate security throughout the development lifecycle, including secure coding, code review, dependency management, testing and controlled deployment.

15. CHANGE MANAGEMENT

Material changes to production systems, security configurations, payment integrations or critical applications shall be authorised, tested where appropriate and documented.

16. LOGGING & MONITORING

Security-relevant events shall be logged and monitored according to risk and system capability. Logs should be protected against unauthorised alteration and retained according to applicable requirements.

17. BACKUP & RECOVERY

Critical data and systems shall have appropriate backup and recovery arrangements. Backups shall be protected against unauthorised access and tested periodically where feasible.

18. ENCRYPTION

Sensitive information shall be protected using appropriate encryption or equivalent safeguards in transit and, where appropriate, at rest.

19. DATA LOSS PREVENTION

Reasonable controls shall be implemented to prevent unauthorised copying, transmission, disclosure or extraction of sensitive information, proportionate to risk.

20. THIRD-PARTY SECURITY

Third parties with access to Company or customer information or critical systems shall be subject to appropriate security due diligence, contractual safeguards and ongoing risk management.

21. CLOUD & HOSTING SECURITY

Cloud and hosting environments shall be configured and monitored according to security requirements, with appropriate identity, access, network, backup and logging controls.

22. CYBER INCIDENT MANAGEMENT

Suspected or confirmed security incidents shall be reported and managed under the Company's Cyber Incident Response & Cyber Fraud Management Policy, including containment, investigation, recovery and appropriate escalation.

23. SECURITY AWARENESS

Relevant personnel shall receive periodic security awareness covering phishing, social engineering, passwords, data handling, device security, fraud indicators and incident reporting.

24. REMOTE WORK & MOBILE SECURITY

Remote access shall use authorised systems and appropriate security controls. Sensitive information should not be stored on personal or unmanaged devices unless specifically authorised and protected.

25. PHYSICAL SECURITY

Where Company systems or information are maintained at physical locations, reasonable controls shall be applied to protect equipment, documents, access areas and supporting infrastructure.

26. BUSINESS CONTINUITY

Information-security controls shall support business continuity and disaster recovery arrangements for critical systems and services.

27. SECURITY TESTING

Security assessments, vulnerability scanning, penetration testing or other testing may be conducted based on risk, system criticality and available resources.

28. RISK ASSESSMENT

Information-security risks shall be identified, assessed, prioritised and treated using reasonable risk-management processes. Material residual risks shall be escalated to authorised management.

29. EXCEPTION MANAGEMENT

Security exceptions shall be documented, risk-assessed, time-bound where appropriate and approved by authorised management. Exceptions shall not knowingly violate mandatory legal or contractual requirements.

30. RECORD KEEPING

Security policies, approvals, access reviews, incidents, risk assessments, testing results and relevant security records shall be maintained according to applicable retention requirements.

31. RESPONSIBILITY MATRIX

32. POLICY VIOLATIONS

Security violations may result in access restriction, investigation, corrective action or other appropriate measures consistent with applicable law, contracts and internal procedures.

33. REVIEW & AMENDMENT

This Policy shall be reviewed at least annually and following material security incidents, significant technology changes, major system deployments or changes in applicable requirements.

34. APPROVAL