Information Security Policy

This Policy establishes minimum security requirements applicable to KryzerHub, its technology environments, and people who have access to information, systems, credentials, source code, infrastructure or data processed by the operation. It applies to employees, administrators, contractors and authorized third parties according to their responsibilities.

Security controls must follow confidentiality, integrity, availability, traceability, need-to-know access, least privilege, separation of responsibilities and protection proportionate to risk. Critical data and systems must receive enhanced controls.

Access to systems and data must be granted only to authorized people and services according to job function and operational need. Administrative permissions must be restricted, reviewed when responsibilities change or relationships end, and removed when no longer required. Accounts must not be shared between users.

Passwords must be strong, unique and protected against improper sharing. Multi-factor authentication must be used for administrative and critical services whenever available. Sessions, devices and company endpoints must use screen locking and controls appropriate to risk. Integration credentials and secrets must not be stored in public source code.

Production environments, external services and databases must use access controls and logical segmentation made available by their providers. Public exposure of services must be limited to what is required for operation. Network rules, authentication, permissions, endpoints and integrations must be reviewed whenever material architecture changes occur.

Information must be handled according to its sensitivity. Personal data, credentials, tokens, secrets, financial information and restricted operational data are considered sensitive for internal purposes and require enhanced protection. External communications and traffic containing protected information must use encrypted channels such as HTTPS/TLS. Data at rest must use protection and encryption capabilities offered by infrastructure providers where applicable.

Devices used to administer Kryzer environments must keep operating systems and applications updated, maintain active anti-malware or antivirus protection when supported, use screen locking and protected access. Installation of software from untrusted sources must be avoided.

Software changes must seek to reduce risks involving improper authentication, data exposure, injection, excessive permissions and secret leakage. API keys, tokens, passwords and credentials must be stored in appropriate configuration or secret-management mechanisms and must not be deliberately included in public repositories, logs, messages or documentation without a legitimate need.

Relevant authentication, administration, integration, failure and critical-action events must be logged where technically feasible. Logs must be protected against unauthorized alteration and used for diagnosis, audit, incident investigation and improvement of controls.

Dependencies, configurations, exposed components and provider security advisories must be reviewed periodically and after material changes. Identified vulnerabilities must be classified by risk and addressed within a timeframe appropriate to their severity. Emergency remediation may be prioritized when there is a risk of active exploitation or data exposure.

Suspected or confirmed security incidents must be recorded and assessed. The response process must include, as applicable: identification, containment, evidence preservation, eradication, recovery, root-cause analysis, preventive remediation and communication with affected parties.

Where an incident involves personal data or contractual obligations, the need to notify customers, partner platforms and authorities will be evaluated under applicable law and commitments.

Relevant data and configurations must use backup, redundancy or recovery mechanisms appropriate to service criticality and provider capabilities. Restoration and continuity procedures must be reviewed as the platform evolves.

Providers that process or store relevant data must be selected considering technical requirements, security, availability and contractual obligations. Third-party access must be limited to the contracted purpose and revoked when no longer required.

Data and records must be retained only for as long as required for operation, security, legal compliance and exercise of rights. When there is no longer a legitimate need for retention, information must be deleted, anonymized or disposed of in a manner appropriate to its sensitivity, subject to limited backup cycles and legal requirements.

Every person with authorized access to Kryzer environments is responsible for protecting credentials, respecting access controls, reporting suspicious activity and preventing improper data exposure. Guidance and controls must be updated as new risks, services and integrations emerge.

This Policy will be reviewed periodically and whenever there are material changes to architecture, legal requirements, contracts, risks or security processes. Exceptions must be justified, assessed and approved by an authorized responsible person.

Security questions, suspected incidents and vulnerability reports should be submitted through the official support channels available in KryzerHub and on the Kryzer Digital website, with sufficient information to support triage and investigation.