Security Policy at Osome

1.How we protect your information

Access is carefully controlled

Access to Osome systems and customer information is limited to authorised personnel who require it to perform their responsibilities.

We apply role-based access (RBAC), least-privilege, and need-to-know principles. Additional safeguards are used for privileged access and production environments, including multi-factor authentication.

Access permissions are reviewed and adjusted when responsibilities change or access is no longer required.

Information is protected in transit and at rest

We use industry-standard encryption and security controls to protect information while it is transmitted and stored within Osome managed environments.

Access to encryption keys and other sensitive security components is restricted according to business need and security responsibilities.

Additional safeguards may be applied according to the sensitivity of the information and the systems processing it.

Security is built into our development process

Security is incorporated into the way Osome develops, reviews, and changes its technology.

Our development and change-management practices include code review, security testing, vulnerability scanning, and controlled deployment processes.

Potential vulnerabilities are assessed according to risk and tracked through remediation and verification.

Periodic security assessments are also performed across applications and supporting infrastructure to identify weaknesses that may require further investigation or remediation.

We monitor for security events

Osome records and monitors security-relevant activity to support incident detection, investigation, and response.

Logging and monitoring are designed to help identify unusual or suspicious activity and provide information required for security investigations.

Security logs are protected against unauthorised access or modification and retained according to applicable operational, security, and legal requirements.

We prepare for security incidents

Osome maintains processes for identifying, assessing, containing, investigating, and recovering from security incidents.

The response to an incident depends on its nature, severity, affected systems and information, and potential impact on customers and Osome.

Where notification is required under applicable law, we follow the relevant regulatory and notification requirements.

Security incidents may also result in root-cause analysis, remediation, and follow-up actions intended to reduce the likelihood or impact of recurrence.

We plan for disruption and recovery

Osome maintains business continuity and disaster recovery arrangements for systems and services that are important to our operations.

These arrangements are periodically reviewed and tested to help prepare for technology failures, infrastructure disruptions, service-provider failures, and other events that could affect normal operations.

Specific service availability, recovery, or support commitments, where applicable, are defined in the relevant customer agreement or service terms.

We assess the services we rely on

Osome works with selected third-party providers to support our technology and business operations.

Relevant suppliers are assessed according to factors such as:

• the information they process;

• the level of access they require;

• the importance of their service to Osome;

• the potential impact of disruption or compromise; and applicable security, privacy, contractual, and regulatory requirements.

Where appropriate, assessments may consider security controls, independent assurance, data-protection obligations, contractual safeguards, and incident-notification requirements.

Third-party risks are reviewed as services and risk profiles change.

Security includes our people

Personnel with access to Osome systems and information are subject to security requirements appropriate to their responsibilities and applicable law.

These measures include confidentiality obligations, security and data-protection training, and controlled access to systems and customer information.

Security awareness is maintained as threats, technologies, and working practices evolve.

2.Security governance and risk management

Security is an ongoing process.

Osome maintains a risk-based information security programme covering the systems, applications, people, processes, and third parties involved in providing our services.

Security risks are identified, assessed, treated, and reviewed as our business, technology, regulatory environment, and threat landscape change.

Material risks, remediation activities, and control performance are reviewed by relevant security and management stakeholders.

Our approach is designed to ensure that security measures remain proportionate to the risks they address and continue to evolve with our services.

3.Security standards and assurance

Our information security programme is designed with reference to internationally recognised security and assurance frameworks, including:

• ISO/IEC 27001:2022 for information security management; and

• the AICPA Trust Services Criteria used in SOC 2 examinations.

These frameworks inform areas such as risk management, access control, secure development, operational security, incident management, supplier security, business continuity, and continual improvement.

References to standards or assurance frameworks on this page describe the principles used to inform our security programme. They should not be interpreted as a certification, attestation, or independent assurance claim unless Osome expressly states that the relevant certification or attestation has been formally achieved and identifies its applicable scope.

Our privacy and data-protection practices are governed separately according to the laws and regulatory requirements applicable to the jurisdictions in which we operate.

For more information, please see our Privacy and Data Protection Policy.

4.Help protect your Osome account

Security is a shared responsibility. A few simple precautions can significantly reduce the risk of unauthorised access.

5.Use a strong, unique password

Use a password that is unique to your Osome account.

Avoid reusing passwords from your email, banking, social media, or other online services.

Never share your password, authentication codes, or account-recovery information with another person.

If you believe your credentials may have been compromised, change them immediately and contact Osome through an official support channel.

6.Use multi-factor authentication

Enable multi-factor authentication whenever it is available for your account.

Do not approve an authentication request that you did not initiate.

Never provide an authentication or one-time verification code in response to an unsolicited email, message, telephone call, or chat request.

7.Keep your devices secure

Keep your operating system, browser, and applications up to date.

Use appropriate device-security measures such as screen locking and device encryption.

Avoid accessing sensitive business information from shared or untrusted devices, and take additional care when using public or unsecured networks.

8.Check before you sign in

Access Osome through the official website or application.

Check the website address before entering credentials, making payments, or uploading documents.

If a message unexpectedly asks you to sign in, open Osome directly rather than following the link contained in the message.

9.Recognising suspicious communications

Attackers may attempt to impersonate Osome through email, messaging applications, social media, telephone calls, or fraudulent websites.

Be cautious when a communication:

• creates unusual urgency or pressure;

• threatens account suspension or another negative consequence unless you act immediately;

• unexpectedly requests a password or authentication code;

• asks for sensitive identity or financial information outside the normal process;

• requests an unexpected transfer of money or change to payment details;

• comes from an unfamiliar, misspelled, or misleading domain;

• directs you to an unexpected sign-in page;

• contains an unsolicited attachment or download; or

• asks you to bypass an established Osome process or security control.

If you are unsure whether a communication is genuine, do not rely on the links or contact information it contains.

Access Osome directly or contact us through an official Osome channel to verify the request.

Osome will never ask you to disclose your password or authentication codes through an unsolicited email, message, or chat request.

10.Report suspicious activity

If you receive a suspicious communication claiming to be from Osome, believe someone may have accessed your account, or identify possible fraud or impersonation, contact Osome through an official customer-support channel.

Where possible, retain the original communication and provide relevant details such as:

• the sender;

• the date and time received;

• a description of what occurred; and

• screenshots where appropriate.

Do not include passwords, authentication codes, or other credentials in your report.

Account-access, fraud, phishing, privacy, billing, or general service matters should be reported through the appropriate Osome support channel rather than through the technical vulnerability-reporting process below.

11.Report a security vulnerability

We value responsible reports from security researchers and others who identify potential technical security vulnerabilities affecting Osome.

If you believe you have identified a vulnerability affecting an Osome-owned website, application, API, or service, please report it privately to:

[security@osome.com] with subject [REPORT] <Title>

Please provide enough information for our security team to understand, reproduce, and assess the issue.

12.What to include

Where available, include:

• a clear description of the suspected vulnerability;

• steps required to reproduce the issue;

• the potential security impact;

• a non-destructive proof of concept;

• relevant screenshots or sanitised request and response information; and

• contact information if you would like us to follow up with you.

Please do not include passwords, authentication codes, unnecessary personal information, confidential customer information, or information obtained from accounts or systems you are not authorised to access.

13.Responsible vulnerability disclosure

We ask security researchers to act responsibly, in good faith, and in accordance with applicable law.

Testing should be limited to what is reasonably necessary to identify and describe a suspected vulnerability.

When conducting security research:

• use only accounts, systems, and information that you own or are expressly authorised to access;

• avoid accessing, modifying, retaining, downloading, or deleting information belonging to another person or organisation;

• stop testing if you unexpectedly encounter customer data or other sensitive information that you are not authorised to access;

• avoid disrupting, degrading, or damaging Osome services;

• do not demonstrate impact beyond what is reasonably necessary to explain the vulnerability; and

• provide Osome with a reasonable opportunity to investigate and address the issue before public disclosure.

14.Activities not authorised by this page

This page does not authorise:

• denial-of-service, stress, load, or resource-exhaustion testing;

• social engineering, phishing, or impersonation;

• destructive testing or deployment of malware;

• attempts to establish persistence within Osome systems;

• lateral movement between accounts, systems, environments, or customer organisations;

• intentional extraction of customer or Osome information;

• modification or deletion of information belonging to others;

• physical-security testing or attempts to gain unauthorised access to Osome premises; or

• testing of systems operated by Osome customers, partners, suppliers, or other third parties.

This page does not grant permission to access systems, accounts, or information that you are not otherwise legally authorised to access.

Osome does not currently publish a formal bug-bounty programme or financial reward structure through this page.

Submission of a vulnerability report does not create an entitlement to payment or reward until further open bug bounty program released.

15.What happens after you report a vulnerability

Reports submitted through the approved security-reporting channel are reviewed by Osome.

Depending on the nature of the report and the information provided, we may:

We do not guarantee a specific acknowledgement, remediation, or disclosure timeframe through this public page.

To protect our customers, personnel, systems, and security investigations, we may not be able to disclose details about internal security controls, vulnerabilities, incidents, or remediation activities.

16.Security and data protection

Security and privacy are closely connected, but they address different responsibilities.

This page explains Osome's general approach to protecting our systems, services, and information.

Our Privacy and Data Protection Policy explains how Osome collects, uses, shares, transfers, retains, and protects personal data, together with applicable individual rights and privacy contacts.

For privacy-related questions or requests, please refer to the contact information provided in the Privacy and Data Protection Policy.

17.Security questions

For questions about Osome's information security practices, security assurance, or this page, please contact:

[security@osome.com] with subject [ASK] <Title>

For account, billing, accounting, corporate-secretarial, tax, or other service-related questions, please use the appropriate Osome customer-support channel.