Korven One Incident Response Policy

Korven One is committed to maintaining the security, availability, confidentiality, and integrity of its systems and services. This Incident Response Policy establishes the procedures for detecting, responding to, investigating, containing, recovering from, and documenting security incidents.

This Policy applies to:

• Korven One Infrastructure
• Applications
• APIs
• Databases
• Wallet Systems
• Payment Systems
• Treasury Systems
• Developer Platforms
• Cloud Infrastructure
• Employees
• Contractors
• Third-Party Providers

Korven One aims to:

• Protect customers
• Protect funds
• Protect sensitive information
• Minimize operational disruption
• Restore services quickly
• Meet legal obligations
• Improve security posture

Security Incidents

• Unauthorized Access
• Credential Compromise
• Privilege Escalation
• Account Takeover

Data Incidents

• Data Breach
• Data Exposure
• Unauthorized Disclosure
• Information Leakage

Fraud Incidents

• Fraudulent Transactions
• Account Abuse
• Synthetic Identity Activity
• Payment Fraud

API Incidents

• API Key Exposure
• Webhook Compromise
• Abuse of Developer Services
• Unauthorized API Activity

Treasury Incidents

• Unauthorized Transfers
• Settlement Irregularities
• Reserve Discrepancies
• Liquidity Events

Infrastructure Incidents

• Service Outages
• DDoS Attacks
• Cloud Service Failures
• Network Disruptions

Severity 1 – Critical

• Active Data Breach
• Major Treasury Risk
• Large Scale Fraud
• Production System Compromise

Target Response: Immediate · 24/7 Escalation

Severity 2 – High

• Significant Service Disruption
• Security Control Failure
• Major API Incident

Target Response: Within Hours

Severity 3 – Medium

• Limited Service Impact
• Isolated Fraud Events
• Individual Account Compromise

Target Response: Business Day Review

Severity 4 – Low

• Minor Security Events
• Monitoring Alerts
• Informational Findings

Target Response: Scheduled Review

Korven One follows six phases:

• Preparation
• Detection
• Containment
• Investigation
• Recovery
• Post-Incident Review

Korven One shall maintain:

• Monitoring Systems
• Logging Systems
• Security Controls
• Incident Procedures
• Escalation Contacts
• Response Tools

Periodic testing may be conducted.

Incidents may be detected through:

• Monitoring Systems
• Security Alerts
• Fraud Detection Systems
• User Reports
• Employee Reports
• Third-Party Notifications

All incidents must be documented.

Korven One may take actions including:

• Account Restrictions
• Transaction Holds
• API Key Revocation
• Service Isolation
• Infrastructure Segmentation

Containment actions should prioritize customer protection.

Korven One may investigate:

• Root Cause
• Scope of Impact
• Affected Systems
• Affected Data
• Financial Exposure

Investigations shall be documented.

Recovery activities may include:

• Restoring Systems
• Revalidating Security Controls
• Reissuing Credentials
• Restoring Services
• Reconciliation of Financial Records

Systems shall be verified before returning to normal operations.

Korven One may communicate with:

• Customers
• Merchants
• Developers
• Partners
• Service Providers
• Legal Counsel
• Regulatory Authorities

Communication shall be coordinated and documented.

Fraud incidents may trigger:

• Transaction Reviews
• Account Freezes
• Enhanced Verification
• Risk Assessments
• Escalation Reviews

Fraud investigations may involve compliance personnel.

Where a data breach is suspected, Korven One may:

• Contain exposure
• Investigate affected records
• Assess legal obligations
• Notify affected parties when required
• Implement remediation measures

Treasury-related incidents may require:

• Immediate Review
• Dual Approval Verification
• Settlement Suspension
• Reserve Verification
• Executive Escalation

Treasury discrepancies shall be investigated immediately.

Korven One may:

• Rotate API Credentials
• Revoke API Access
• Restrict Endpoints
• Increase Monitoring

Developers may be contacted regarding impacted integrations.

Where third-party providers are involved, Korven One may:

• Coordinate investigations
• Assess operational impact
• Implement contingency measures

Third-party risks shall be reviewed periodically.

Korven One shall maintain records of:

• Incident Reports
• Investigation Results
• Corrective Actions
• Recovery Activities
• Lessons Learned

Records shall be retained in accordance with applicable requirements.

Following significant incidents, Korven One may conduct:

• Root Cause Analysis
• Risk Assessments
• Security Reviews
• Process Improvements

Lessons learned shall be incorporated into future controls.

Korven One may conduct:

• Incident Response Training
• Security Exercises
• Tabletop Simulations
• Recovery Testing

Testing may occur periodically.

Korven One management shall oversee:

• Incident Reporting
• Incident Escalation
• Incident Reviews
• Risk Management

Significant incidents may be escalated to executive leadership.

Korven One may update this Policy periodically. Updated versions will be published through Korven One services and website.

Korven One Security Operations

Email: security@korvenone.com

Email: incident@korvenone.com

Support: support@korvenone.com

Website: https://korvenone.com

The official version of this Incident Response Policy is the English version. Translations may be provided in:

• Haitian Creole
• French
• Spanish

In case of conflict, the English version shall prevail.