INFORMATION SECURITY & CYBER SECURITY POLICY

This Policy establishes the information-security and cyber-security framework of JSR ALL-IN-ONE SOLUTIONS PRIVATE LIMITED for protecting customer information, gift-card/voucher data, transaction records, applications, APIs, infrastructure, credentials, business information and other information assets from unauthorised access, misuse, alteration, disclosure, disruption or destruction.

• Protect confidentiality, integrity and availability of information assets.
• Prevent and detect unauthorised access, cyber attacks, malware, phishing and other security threats.
• Protect customer, transaction, payment and voucher-related information.
• Establish access-control, monitoring, incident-response and recovery requirements.
• Maintain appropriate security governance over employees, contractors, vendors and technology partners.
• Support applicable legal, contractual, regulatory and partner security requirements.

This Policy applies to all employees, directors, contractors, consultants, systems, applications, APIs, databases, cloud services, endpoints, networks, websites, mobile/web applications, gift-card/voucher platforms, payment integrations, third parties and information assets used for or on behalf of the Company.

Management shall provide appropriate oversight, resources and accountability for information security. Security responsibilities shall be assigned to appropriate personnel and material risks shall be escalated to management.

• Public – information approved for public disclosure.
• Internal – routine business information intended for authorised personnel.
• Confidential – customer, commercial, operational, partner or sensitive business information.
• Restricted – highly sensitive information such as credentials, security secrets, sensitive transaction information or security investigation data.

The Company shall maintain an appropriate inventory of material hardware, software, applications, cloud services, databases, APIs, domains, certificates and other critical information assets. Asset ownership shall be assigned where appropriate.

• Access shall be granted based on business need and least privilege.
• User access shall be unique to the individual where practicable.
• Privileged access shall be restricted and monitored.
• Access shall be reviewed periodically.
• Access shall be revoked promptly upon termination, role change or loss of business need.

• Strong authentication controls shall be implemented according to system risk.
• Multi-factor authentication should be used for privileged and sensitive access where technically feasible.
• Passwords and authentication secrets shall not be shared.
• Credentials shall be stored and transmitted securely.

Customer, payment, voucher, authentication, transaction and confidential business information shall be protected through appropriate access controls, encryption or other security safeguards proportionate to risk.

• Firewalls and network security controls shall be implemented where appropriate.
• Critical systems shall be appropriately segregated.
• Unnecessary services and ports should be restricted.
• Security configurations shall be maintained and reviewed.

• Applications and APIs shall follow secure development and deployment practices.
• Authentication and authorisation shall be implemented appropriately.
• Input validation and protection against common application vulnerabilities shall be applied.
• API credentials and secrets shall be securely managed.
• Material vulnerabilities shall be remediated according to risk.

Systems shall be monitored for relevant vulnerabilities and security updates. Critical vulnerabilities shall be prioritised based on exploitability, exposure and business impact.

Security-relevant events shall be logged and monitored according to system criticality. Logs should support investigation of authentication events, administrative activity, transaction anomalies, security incidents and other material events.

• Company-managed devices shall use appropriate security controls.
• Anti-malware or endpoint protection shall be deployed where appropriate.
• Unauthorised software installation shall be restricted.
• Lost or compromised devices shall be reported promptly.

Employees shall exercise caution with suspicious links, attachments, requests for credentials, payment instructions and impersonation attempts. Suspected phishing or social-engineering incidents shall be reported immediately.

Critical business and security-relevant data shall be backed up according to business requirements. Backups shall be protected from unauthorised access and tested periodically where appropriate.

Third parties with access to Company information or systems shall be subject to risk-based security due diligence and appropriate contractual controls, consistent with the Third-Party / Vendor Risk Management Policy.

• Employees shall receive information-security awareness training.
• Confidential information shall only be accessed for authorised business purposes.
• Security incidents shall be reported without undue delay.
• Employees shall follow acceptable-use, access-control and data-handling requirements.

Suspected or confirmed cyber incidents shall be handled under the Company's Cyber Incident Response Policy, including identification, containment, investigation, evidence preservation, recovery, communication and post-incident corrective actions.

Potential data breaches shall be assessed promptly. Required containment, investigation, notification, partner coordination and regulatory actions shall be undertaken by authorised personnel according to applicable requirements.

Critical offices, systems, devices and information storage areas shall receive physical security controls proportionate to risk, including access restrictions where appropriate.

Material technology changes shall undergo appropriate security and risk review. Production changes shall be authorised and traceable. Security testing shall be performed according to system criticality.

Information-security controls shall support business continuity and disaster recovery arrangements. Critical technology dependencies shall be identified and recovery requirements documented.

Relevant personnel shall receive periodic training on passwords, phishing, data handling, incident reporting, customer information protection, secure use of systems and other applicable security responsibilities.

Security controls may be tested through vulnerability assessments, access reviews, configuration reviews, application security testing, incident exercises and other assurance activities proportionate to risk.

Employees, vendors and relevant partners shall report suspected security incidents, unauthorised access, credential compromise, data leakage, malware, phishing and other material security events through approved channels.

Security exceptions shall be documented, risk-assessed, approved by authorised management and reviewed periodically. Exceptions shall not override mandatory legal, regulatory or contractual requirements.

Security records, logs, approvals, incidents, assessments, training records, access reviews and remediation evidence shall be retained according to the Company's approved data-retention requirements.

This Policy shall be reviewed at least annually and whenever there is a material change in business operations, technology, threat environment, product architecture, regulatory requirements or security risk.