Korven One Information Security Policy

Korven One is committed to protecting the confidentiality, integrity, availability, and security of customer information, financial data, systems, infrastructure, and services. This Information Security Policy establishes the security principles, controls, and responsibilities governing Korven One operations.

This Policy applies to:

• Employees
• Contractors
• Developers
• Merchants
• Partners
• Service Providers
• Infrastructure Systems
• Applications
• APIs
• Databases
• Cloud Services

Korven One follows the following principles:

• Security First
• Least Privilege
• Defense in Depth
• Zero Trust
• Continuous Monitoring
• Auditability
• Compliance by Design

Information may be classified as:

Public

Information approved for public release.

Internal

Information intended for internal use.

Confidential

Sensitive business information.

Restricted

Highly sensitive information requiring enhanced protection. Examples:

• Financial Records
• Customer Data
• KYC Data
• Treasury Information
• Security Credentials

Korven One shall implement:

• Role-Based Access Control (RBAC)
• Multi-Factor Authentication (MFA)
• Password Security Controls
• Session Management
• Access Reviews
• Privileged Access Controls

Access shall be granted only when necessary for business purposes.

Korven One may require:

• MFA
• Device Verification
• Session Validation
• Strong Password Requirements

Administrative and privileged accounts must use MFA.

Korven One shall implement:

Encryption In Transit

TLS 1.2 or higher. Preferred standard: TLS 1.3.

Encryption At Rest

AES-256.

Sensitive Data Protection

Sensitive information must be encrypted where appropriate.

Korven One shall implement:

• API Authentication
• API Authorization
• Rate Limiting
• API Key Rotation
• Webhook Security
• Request Validation
• Abuse Detection

API credentials must be protected.

Korven One shall maintain secure software development practices. Security controls may include:

• Code Reviews
• Dependency Scanning
• Vulnerability Scanning
• Security Testing
• Secure Deployment Practices

Korven One shall maintain:

• Network Security Controls
• Firewall Protection
• DDoS Protection
• Cloud Security Controls
• Infrastructure Monitoring
• Secure Configuration Standards

Infrastructure shall be regularly reviewed.

Korven One shall maintain:

• Audit Logs
• Security Logs
• Application Logs
• Infrastructure Logs

Monitoring systems may be used to identify:

• Unauthorized Access
• Fraud
• Security Events
• Operational Risks

Korven One shall implement:

• Double Entry Ledger Controls
• Transaction Audit Trails
• Settlement Controls
• Treasury Controls
• Approval Workflows
• Fraud Monitoring

All financial events must be auditable.

Korven One may implement:

• Transaction Monitoring
• Risk Scoring
• Behavioral Analytics
• Device Analysis
• Fraud Detection Systems
• Velocity Controls

Suspicious activity may be investigated.

Korven One shall maintain processes for:

• Vulnerability Identification
• Risk Assessment
• Remediation
• Verification

Critical vulnerabilities should be addressed promptly.

Employees, contractors, and partners must report suspected security incidents immediately. Examples include:

• Unauthorized Access
• Credential Exposure
• Malware
• Data Exposure
• Fraud Events

Korven One may assess third-party providers based on:

• Security Practices
• Compliance Standards
• Operational Reliability
• Risk Exposure

Third-party access shall be reviewed periodically.

Korven One shall maintain controls designed to support:

• Service Availability
• Disaster Recovery
• Data Protection
• Operational Resilience

Business continuity procedures may be tested periodically.

Employees and contractors may receive periodic training regarding:

• Security Practices
• Fraud Prevention
• Compliance Requirements
• Data Protection

Korven One may maintain controls supporting:

• AML Programs
• KYC Programs
• Data Protection Requirements
• Financial Compliance Requirements
• Security Audits

Violations of this Policy may result in:

• Access Restrictions
• Account Suspension
• Contract Termination
• Legal Action

as appropriate.

Korven One management shall maintain oversight of:

• Security Programs
• Risk Management
• Compliance Activities
• Security Monitoring

Periodic reviews may be conducted.

Korven One may update this Policy periodically. Updated versions will be published through Korven One Services and website.

Korven One Security Team

Email: security@korvenone.com

Email: compliance@korvenone.com

Support: support@korvenone.com

Website: https://korvenone.com

The official version of this Security Policy is the English version. Translations may be provided in:

• Haitian Creole
• French
• Spanish

In case of conflict, the English version shall prevail.