INFORMATION SECURITY &
CYBER SECURITY POLICY

This Policy establishes the information-security and cyber-security framework for protecting CYBERVED AI PRIVATE LIMITED's systems, applications, APIs, customer information, transaction data, voucher information and business operations against unauthorised access, misuse, alteration, disclosure, disruption and cyber threats.

• Protect confidentiality, integrity and availability of information.
• Reduce cyber-security and technology risks.
• Secure customer, payment, voucher and partner data.
• Establish access, monitoring, vulnerability and incident controls.
• Support secure operation of APIs and third-party integrations.
• Promote security awareness and accountability.

This Policy applies to employees, contractors, systems, applications, cloud services, APIs, endpoints, networks, databases, third-party services and information assets used for Company operations.

• Least privilege
• Need-to-know access
• Defence in depth
• Secure-by-design
• Risk-based controls
• Logging and accountability
• Data minimisation
• Continuous improvement

Material information assets shall be identified and assigned an owner. Where appropriate, assets shall be classified according to sensitivity, business criticality and regulatory/contractual requirements.

Access shall be granted based on role and business need. Privileged access shall be restricted and reviewed periodically.

• Strong authentication shall be used where appropriate.
• Administrative and privileged accounts shall receive enhanced protection.
• Shared credentials shall be avoided.
• Credentials shall be stored and handled securely.

1. Approve access request.
2. Create access according to role.
3. Review access periodically.
4. Modify access upon role change.
5. Promptly disable access on exit or when no longer required.

Passwords, API keys, tokens, secrets and other authentication credentials shall be protected against disclosure and unauthorised reuse. Sensitive secrets shall not be stored in insecure locations.

Applications and APIs shall use appropriate authentication, authorisation, input validation, rate controls, secure error handling, logging and secure development practices.

• Sensitive data shall be protected during storage and transmission where appropriate.
• Access to customer and transaction data shall be restricted.
• Data exports shall be controlled.
• Unauthorised copying or disclosure is prohibited.

Networks, servers, workstations and other endpoints shall be protected through appropriate security configuration, patching, malware protection and monitoring measures.

Security vulnerabilities shall be identified, risk-assessed and remediated according to severity and business impact. Critical issues shall receive prompt attention.

Operating systems, applications, libraries and infrastructure shall be patched within risk-based timelines, subject to testing and operational requirements.

• Authentication and access events
• Administrative activity
• Important transaction/system events
• Security alerts
• API and application errors
• Material configuration changes

Suspected or confirmed cyber-security incidents shall be escalated under the Cyber Incident Response & Cyber Fraud Policy.

Relevant logs, alerts, system records and other evidence shall be preserved to support investigation, remediation, partner coordination and applicable reporting.

Critical information and systems shall be backed up according to business requirements. Backup access shall be restricted and recovery procedures periodically tested where appropriate.

Material changes to production systems, APIs, infrastructure and security controls shall follow documented change-management and approval procedures.

• Code review where appropriate
• Dependency and vulnerability management
• Secure configuration
• Input validation
• Authentication and authorisation testing
• Security testing before material production release

Third parties handling sensitive data or critical technology shall be subject to appropriate security due diligence, contractual requirements and monitoring.

Cloud and hosted environments shall use appropriate identity, access, configuration, logging, backup and security controls consistent with the risk of the service.

Information shall be retained only for applicable legal, regulatory, contractual and business requirements and securely disposed of when no longer required, subject to preservation obligations.

Relevant personnel shall receive security awareness training covering phishing, credential protection, social engineering, data handling, incident reporting and acceptable use.

Company systems and information shall be used only for authorised business purposes. Security controls shall not be bypassed without documented authorisation.

Remote access shall be restricted to approved users and systems and protected through appropriate authentication, secure connectivity and device controls.

Physical access to offices, systems, devices and sensitive records shall be appropriately restricted and monitored according to risk.

Security controls may be assessed through vulnerability scanning, configuration reviews, access reviews, penetration testing or other appropriate assurance activities.

Security matters affecting PPI, banking, payment or other regulated partners shall be escalated through agreed channels and handled according to applicable requirements.

Security exceptions shall be documented, risk-assessed, time-bound where appropriate and approved by authorised management.

Security records, access reviews, incidents, vulnerability findings, testing results, approvals and material changes shall be retained according to applicable requirements.

This Policy shall be reviewed at least annually and whenever there is a material change in systems, threats, products, partner arrangements, technology or applicable requirements.