Information Security Policy

Purpose and scope

The purpose of this Information Confidentiality and Security Policy (the "Policy") is to set out the core principles, rules and responsibilities for protecting the confidentiality, integrity and availability of all information assets that ORELSİS BİLİŞİM MAKİNE OTOMASYON SANAYİ VE TİCARET LİMİTED ŞİRKETİ ("ORELSIS") and its brands own, process, use or access, including data entrusted to us by our customers.

As a company that builds enterprise software, AI and automation solutions, we see information security as a core element of our operational continuity, our legal compliance and the protection of customer trust. To manage information security risks systematically, we follow an Information Security Management System approach aligned with international standards (the ISO/IEC 27001 approach).

The Policy covers ORELSIS' information systems, corporate data and information assets, software development and delivery processes, IT infrastructure, the employees and managers with access to these systems, and business partners and third parties we work with. It has been prepared with reference to applicable law, in particular Law No. 6698 on the Protection of Personal Data, and international information security standards.

Core principles

1. 1.Continuous improvement: information security infrastructure, processes and technologies are continuously developed in line with the changing threat landscape, technological developments and legal requirements.
2. 2.Protection of information assets: all information assets in physical and digital environments are protected against unauthorised access, alteration, disclosure, loss, corruption or destruction.
3. 3.Monitoring and managing threats: risks and potential threats are monitored regularly, and the necessary technical and organisational measures are taken against identified vulnerabilities.
4. 4.Defined responsibilities: information security is not only a technical matter but every employee's responsibility; roles are defined clearly and awareness is built.
5. 5.Secure by design: in the products we build, security and privacy are treated as requirements from the design stage.

Definitions

Implementation

Information Security Management System

• Information security processes are planned, implemented, monitored and continuously improved.
• An inventory of information assets is maintained and asset owners are assigned.
• Corporate data is classified by level of sensitivity and appropriate security controls are applied.
• Senior management provides the necessary resources and oversees implementation of the Policy.

Access rights and system use

• Access rights are defined by role on a least-privilege basis, reviewed regularly and updated without delay on a change of role or departure.
• Multi-factor authentication, authorisation, logging and access controls are applied to critical systems.
• Employees use information systems only for business purposes and in line with company procedures, and do not share confidential information with unauthorised people.

Secure development and customer data

• Source code is kept in access-restricted repositories; changes go through code review.
• Dependencies and components are scanned regularly for known vulnerabilities.
• Access to customer systems is provided only within the scope of a contract, by authorised staff and with logging; customer data used in test and development environments is anonymised wherever possible.
• In on-premise deployments, the principle is that customer data stays on the customer's infrastructure.

Risk assessment, vulnerability management and audit

• IT infrastructure, cyber security and supplier-related risks are assessed regularly and results are reported to management.
• Regular vulnerability scans and security assessments are carried out; identified vulnerabilities are prioritised, remediated and tracked.
• Practices are subject to periodic internal audit, and independent audits are commissioned where needed.

Business continuity and incident management

• Backup, business continuity and crisis management plans are maintained for critical systems and tested regularly.
• A defined process is run to detect, report, assess and manage security incidents.
• Employees and business partners report suspicious activity, vulnerabilities and suspected breaches without delay; corrective and preventive actions are taken.
• In the event of a personal data breach, the notifications required by law are made.

Training and awareness

Employees receive regular information security training and awareness activities and are briefed on policies and procedures. Awareness is regarded as a key element of implementing the Policy effectively.

Business partners and third parties

Business partners and third parties are expected to comply with information security requirements to the extent relevant to them. These obligations are set out in contracts and confidentiality undertakings; where needed, supplier risks are assessed and additional measures are requested.

Authority and responsibilities

All employees and managers are responsible for complying with this Policy. Employees must not share confidential information or corporate data with unauthorised people, must use information systems in line with procedures, and must report risks, vulnerabilities or suspected breaches without delay. A breach of the Policy may lead to disciplinary sanctions; a breach by third parties may lead to legal and contractual measures, including suspension or termination of the contract.

Review and updates

The Policy is reviewed regularly and updated in line with information security risks, technological developments, operational needs and changes in law. To report a security vulnerability, write to [email protected].