Information Security

1. Scope

This page applies to the Company’s public-facing Website and related business communications. Security controls
for customer environments may vary based on contractual requirements, deployment model, and customer configuration.

2. Security Governance

The Company maintains an Information Security Management System (ISMS) designed to identify, assess, and mitigate
security risks. Security responsibilities are assigned to dedicated personnel and are reviewed as part of
ongoing operational governance and management reviews.

3. Risk Management

The Company uses risk-based practices to prioritize security controls and remediation efforts. Risk reviews
are conducted periodically to consider factors such as threat activity, system exposure, business impact,
and regulatory obligations.

4. Technical Safeguards

The Company implements technical safeguards aligned with industry best practices, including:

• Encryption: Data is encrypted in transit (TLS 1.2+) and at rest using industry-standard AES-256 encryption.
• Network Security: Web Application Firewall (WAF) protections to help mitigate malicious traffic and application-layer attacks.
• Monitoring: Continuous monitoring and security scanning of public-facing assets to detect vulnerabilities.
• Access Control: Multi-factor authentication (MFA) and role-based authorization for administrative functions.
• Patch Management: Routine security updates and vulnerability remediation processes for all system components.

5. Physical & Cloud Security

The Company utilizes ISO-certified cloud service providers. Physical access to data centers is strictly
controlled by our providers using biometric identification, professional security staff, and video surveillance.

6. Incident Management

The Company maintains an Incident Response Plan to manage security events, including triage, containment,
investigation, and remediation. Where required by law or contract, the Company provides appropriate
notifications regarding security incidents.

7. Third-Party Security

Service providers undergo a security evaluation and are subject to contractual obligations, including
Data Processing Agreements (DPAs) where applicable.

8. Continuous Improvement

As part of our commitment to security, we perform periodic internal audits and management reviews to
address emerging threats and evolving compliance requirements.

9. Contact Information

Questions regarding this Information Security summary may be submitted on our Contact Us page via:
https://friendly-tech.com/contact-us/

Or message our Data Protection Officer (DPO) directly at:
Dmitry.lockshtanov@friendly-tech.com