Policies

6. Information & Data Security Practices

At Corazont Technologies, we prioritize a robust and mature security program that delivers exceptional service quality while safeguarding customer and company data. Our comprehensive information security program is designed to guarantee the confidentiality, integrity, and availability of client and customer data, leveraging effective security management practices and controls.

This document aims to provide transparency and assurance to our prospective and existing customers, addressing any questions or concerns they may have about our commitment to security.

Corazont Technologies employs a robust and integrated risk management framework that incorporates industry-recognized best practices in cybersecurity, data protection, and privacy. Our approach encompasses:

• Proactive cybersecurity measures
• Vigilant data protection and privacy stewardship
• Strategic simplification of technology infrastructure
• Ongoing evaluation and auditing, conducted internally and by independent third-party experts

This comprehensive framework enables us to identify, assess, and mitigate risks, ensuring the security, integrity, and confidentiality of our users’, employees’, and customers’ data.

CyberSecurity

Under the leadership of our Chief Information Security Officer (CISO), Corazont Technologies’ Information Security department has implemented a comprehensive cybersecurity framework across the enterprise. This framework standardizes six critical pillars:

• Foundational (“Table Stakes”) security
• Advanced endpoint protection
• Real-time threat monitoring
• Proactive vulnerability management
• Employee security awareness and education
• Automated employee onboarding and offboarding processes

This unified approach ensures a robust and consistent cybersecurity posture across our organization.”

Table Stakes Security

Corazont Technologies’ Corporate Security Policy outlines stringent security requirements to ensure the delivery of secure and high-quality services to our customers. Key components of this policy include:

• Uniform password policies for composition, rotation, management, and storage
• Mandatory encryption for workspaces, databases (at rest and in transit), and data
• Multi-factor authentication for all supported systems
• Rigorous access control and regular reviews
• Thorough hardening and vetting of systems before connecting to our network

These measures safeguard data protection and privacy, maintaining the trust and confidence of our customers

Advanced Endpoint Generation

All workstations and product environments (including development, quality assurance, staging, and production) are required to have endpoint protection agents installed. These agents not only detect known malware but also continuously monitor system activity for potential threats.

Our endpoint protection software is configured to:

• Automatically terminate suspicious processes that deviate from expected system behavior
• Provide real-time threat detection and response

This solution is uniformly deployed across the enterprise, ensuring comprehensive security coverage for all Corazont Technologies brands. All Business Units are required to utilize the designated endpoint protection solution, with all generated data fed into a centralized security repository for analysis, reporting, and executive-level dashboards.

Real-time Threat monitoring

All Corazont Technologies systems are mandated to host agents that collect and transmit activity logs to a centralized command center, powered by our threat stream analysis vendor. This enables 24/7 monitoring by our vendor-managed Security Operations Center (SOC) team, who:

• Analyze potential security events and false positives
• Identify and surface high-priority alerts for our in-house InfoSec analysts

Our team then:

• Responds to and escalates alerts as necessary
• Provides remediation directives to relevant Business Units, outlining process and timeline

All threat stream data is integrated into our central security intelligence repository for comprehensive analysis and executive-level reporting, ensuring seamless threat detection and response.

Proactive Vulnerability Management

Corazont Technologies employs a multi-faceted vulnerability management strategy across the enterprise, comprising:

• Internal Scanning: Partnering with a third-party service to conduct regular internal scans of production and corporate networks, identifying potential vulnerabilities in end-of-life software, exposed ports, and platform weaknesses.
• External Penetration Testing: Rotating external penetration testing for each Business Unit, executed by an independent third-party, to uncover vulnerabilities and provide recommendations for remediation.
• Ethical Hacking: Conducting regular “White Hat” ethical hacking exercises by our Application Security team to identify and address potential issues.

Results from these efforts are shared with relevant Business Units, along with tailored remediation recommendations. Metrics data is automatically aggregated into our central security intelligence platform, ensuring comprehensive vulnerability management and rapid remediation.

Employee Awareness

Corazont Technologies prioritizes employee education and awareness through regular, mandatory training sessions, utilizing third-party educational resources. These sessions focus on:

• Best practices in Information Security and Data Protection
• Identifying warning signs of malicious activity, including phishing, spear-phishing, and ransomware
• Compliance with key regulations, such as GDPR, CCPA & CASL

Targeted training is provided to specific departments or brands to ensure compliance obligations are met. To reinforce employee knowledge, we conduct random, unannounced simulated phishing attacks across business units and the company, assessing our workforce’s ability to respond effectively to potential threats.

Employee Onboard / Offboard Automation

Corazont Technologies has implemented a unified employee management system, integrating all global enterprise platforms with a single source of truth for employee status. This dynamic environment enables Business Units to easily verify employee status through a simple API request.

To further streamline access management, we are introducing a single-sign-on (SSO) solution, consolidating all system access for employees into a single control point.

Currently, our automated systems notify regional IT and technology managers, who grant or revoke access based on real-time employee status updates from HR. As we complete the rollout, the majority of access management tasks will be automated, ensuring seamless and secure access control aligned with HR-verified employee status.

Data Protection and Privacy

Corazont Technologies has a long-standing commitment to data privacy, predating the implementation of GDPR. We conducted a thorough series of Privacy Impact Analyses (PIAs) across all business units, with guidance from an independent third-party expert.

Following the PIAs, we appointed a Data Privacy Officer and developed a systematic approach to handling Data Subject Access Requests (DSARs). This effort culminated in a fully automated process, ensuring the rights of our employees and users are protected across all business units.

A centralized platform was established to manage DSARs, featuring an API layer that enables each business unit to respond programmatically. We adhere to the most stringent interpretations of both CCPA and GDPR, responding to each request in accordance with these standards and demonstrating our dedication to data privacy and compliance.

Information Security Incident Response

Corazont Technologies has established a dedicated management team and process for responding to information security incidents, guided by a comprehensive Information Security Incident Response Plan. This plan outlines clear roles and responsibilities, step-by-step procedures, and industry best practices for incident response.

In addition to information security incidents, our crisis management framework engages relevant teams, including legal, internal audit, technology, security, HR, and C-level executives, as needed. This structured approach ensures effective response, escalation, and resolution.

For critical incidents requiring elevated attention, our framework allows for further escalation to the Board of Directors, ensuring timely and informed decision-making at the highest level.

Simplification of Technology Infrastructure

Corazont Technologies’ technological strategy focuses on developing processes that drive synergies and enhance our products. To achieve this, we’re strategically transitioning the management of our technology infrastructure, financial software, CRM systems, HR platforms, and communication tools to trusted third-party Software-as-a-Service (SaaS) providers.

Our Legal and InfoSec teams conduct thorough due diligence on potential vendors, assessing their compliance with critical frameworks such as SOX and PCI. Identified risks are meticulously documented, communicated to relevant business units and vendors, and integrated into our risk profile.

By outsourcing key business processes to SaaS providers, we’re simplifying our internal IT and Legal landscapes, significantly reducing complexity and risk.