Information Security Policy

1. Purpose and Scope

This Information Security Policy ("Policy") describes the security controls, practices, and commitments that Ollify LLC ("Ollify," "we," "us," or "our") maintains to protect the confidentiality, integrity, and availability of the Ollify platform and Customer Data entrusted to us.

This Policy is published for the benefit of Ollify's customers, prospective customers, and other stakeholders who wish to understand how Ollify protects data within the Service. It covers Ollify's cloud infrastructure, application security, access controls, incident response, and vendor management practices.

This Policy applies to all systems, infrastructure, personnel, and third-party service providers involved in the delivery of the Ollify platform. It is reviewed and updated at least annually or following any material change to Ollify's security environment.

2. Security Governance

2.1 Security Ownership. Information security at Ollify is the responsibility of the Managing Member and designated security personnel. Security responsibilities include:

• Establishing and maintaining security policies and controls

• Overseeing risk assessment and management processes

• Managing security incidents and response

• Reviewing and approving changes to security-relevant systems and configurations

• Ensuring personnel receive appropriate security awareness training

2.2 Security Policy Review. This Policy and all supporting security policies are reviewed at minimum annually. Reviews are triggered earlier by material security incidents, significant changes to Ollify's infrastructure or product, changes in applicable law or regulation, or identification of material risks not addressed by existing controls.

2.3 Risk Management. Ollify conducts periodic risk assessments to identify, evaluate, and address security risks to Customer Data and the Service. Risk assessment considers:

• Threats to the confidentiality, integrity, and availability of Customer Data

• Vulnerabilities in Ollify's infrastructure, application, and operational practices

• Likelihood and potential impact of identified risks

• Effectiveness of existing controls in mitigating identified risks

Identified risks are documented, prioritized, and addressed through remediation, mitigation, or acceptance with appropriate management approval.

3. Cloud Infrastructure Security

3.1 Amazon Web Services (AWS). The Ollify platform is hosted exclusively on Amazon Web Services (AWS). Ollify leverages AWS's enterprise-grade infrastructure security controls, which include:

• Physical data center security including 24/7 security personnel, biometric access controls, and video surveillance at AWS facilities

• ISO 27001, SOC 1, SOC 2, and SOC 3 certified infrastructure

• Network infrastructure designed for high availability and redundancy

• Hardware security managed and maintained by AWS under the AWS Shared Responsibility Model

3.2 Infrastructure Configuration. Ollify's AWS infrastructure is configured and managed according to the following security principles:

• Principle of least privilege applied to all AWS IAM roles, policies, and service accounts

• Production, staging, and development environments are logically separated

• Security groups and network access control lists (NACLs) restrict inbound and outbound traffic to authorized sources and destinations only

• Public access to storage resources (S3 buckets) is disabled by default

• AWS CloudTrail is enabled for audit logging of API activity across Ollify's AWS accounts

• AWS Config is used to monitor and enforce configuration compliance

• Multi-factor authentication (MFA) is required for all AWS console access

3.3 Availability and Redundancy. Ollify designs its infrastructure to support high availability:

• Production systems are deployed across multiple AWS Availability Zones to protect against single-point failures

• Automated health checks and load balancing distribute traffic and detect unhealthy instances

• Database services are deployed in a Multi-AZ configuration with automated failover

• Recovery objectives are documented internally and will be formalized into published commitments as backup and recovery capabilities are validated through testing

4. Data Security

4.1 Encryption in Transit. All data transmitted between customers and the Ollify platform is encrypted in transit using industry-standard protocols:

• TLS 1.2 or higher is required for all connections to the Ollify platform

• TLS 1.0 and 1.1 are disabled

• HTTP connections are automatically redirected to HTTPS

• Ollify's TLS certificates are issued by trusted certificate authorities and renewed before expiration

4.2 Encryption at Rest. Customer Data stored within the Ollify platform is encrypted at rest:

• AWS managed encryption (AES-256) is applied to all production data stores, including databases and object storage

• Database backups are encrypted using the same standards as production data

• Database encryption keys are managed through AWS Key Management Service (KMS); object storage uses Amazon S3's server-side encryption (SSE-S3)

4.3 Data Isolation. Customer Data is logically isolated within the Ollify platform. Ollify's application architecture enforces tenant isolation controls to prevent one customer's data from being accessed by another customer. Data isolation is enforced at the application layer and validated through security testing.

4.4 Data Retention and Deletion. Ollify retains Customer Data in accordance with the Agreement and applicable law. Upon termination or cancellation of a subscription, Customer Data is retained for sixty (60) days during which customers may export their data. Following the retention period, Customer Data is permanently deleted from Ollify's systems and backups in accordance with Ollify's data deletion procedures. Deletion procedures are designed to render data unrecoverable.

4.5 Backups. Ollify performs automated backups of Customer Data on a regular schedule:

• Database backups are performed daily at minimum

• Backups are currently stored within the same AWS region as primary production data; cross-region backup replication is on Ollify's infrastructure roadmap

• Regular, documented backup restoration testing is being implemented as part of Ollify's infrastructure roadmap

• Backups are encrypted using the same standards as production data

• Backup retention periods are defined and managed in accordance with Ollify's data retention policies

Ollify's current backup and recovery capabilities, their present limitations, and the improvement roadmap are described in detail in Ollify's Backup and Recovery Policy, available at ollify.app/legal/backup-and-recovery-policy.

5. Application Security

5.1 Secure Development Practices. Ollify follows secure software development practices throughout the software development lifecycle (SDLC):

• Security requirements are considered during product design and architecture phases

• Code changes are reviewed prior to deployment to production environments

• Automated static analysis and dependency scanning tools are used to identify known vulnerabilities in code and third-party libraries

• Security-relevant changes receive additional review before deployment

• Production deployments follow a controlled release process with rollback capability

5.2 Vulnerability Management. Ollify maintains an ongoing vulnerability management program:

• Third-party libraries and dependencies are monitored for known vulnerabilities using automated scanning tools

• Critical and high-severity vulnerabilities are prioritized for remediation on an expedited basis

• Infrastructure and application components are patched and updated on a regular schedule

• Security patches for critical vulnerabilities are applied as quickly as practicable following vendor release

5.3 Penetration Testing. Ollify conducts or commissions security assessments of its platform on a periodic basis. Assessment findings are tracked and remediated according to severity. Customers with specific security assessment requirements should contact security@ollify.app to discuss options.

5.4 Responsible Disclosure. Ollify operates a responsible disclosure program for security researchers who identify vulnerabilities in the Ollify platform. If you have identified a potential security vulnerability, please report it to security@ollify.app. Ollify commits to:

• Acknowledging receipt of vulnerability reports within three (3) business days

• Investigating reported vulnerabilities in good faith

• Providing timely remediation of confirmed vulnerabilities based on severity

• Not pursuing legal action against researchers who follow responsible disclosure principles

6. Access Control

6.1 Employee Access. Access to Customer Data and production systems by Ollify personnel is strictly controlled:

• Access to production systems and Customer Data is limited to personnel with a documented business need

• Principle of least privilege is applied — personnel are granted only the access necessary to perform their job functions

• Access rights are reviewed periodically and revoked promptly upon role change or separation

• Multi-factor authentication (MFA) is required for access to production systems and administrative tools

• Access to Customer Data for support purposes is logged and auditable

6.2 Customer Access Controls. Ollify provides customers with controls to manage access to their own accounts and data:

• Role-based access controls allow account administrators to assign permissions to users within their organization

• Account administrators can add, modify, and remove user access at any time

• Password requirements enforce minimum complexity and length standards

• Multi-factor authentication (MFA) for customer accounts is not available as of this Effective Date. Ollify may introduce MFA for customer accounts in a future release; customer sign-in is protected today by rate limiting, a CAPTCHA step-up after repeated failed attempts, and immediate server-side session revocation

• Session management controls include automatic session timeout after periods of inactivity

6.3 Authentication. Ollify enforces the following authentication standards:

• Passwords are stored using industry-standard hashing algorithms (bcrypt or equivalent) — plaintext passwords are never stored

• Failed login attempts are rate-limited to protect against brute-force attacks

• Multi-factor authentication for customer accounts is not yet available; Ollify may introduce it in a future release. MFA is enforced for Ollify's internal administrative portals

• API access, where offered, is controlled through token-based authentication with configurable expiration

7. Network Security

7.1 Network Controls. Ollify's network architecture is designed to limit exposure and contain potential threats:

• Production systems operate within isolated Virtual Private Clouds (VPCs) with controlled ingress and egress

• Public-facing components are limited to load balancers and API gateways — application servers and databases are not directly internet-accessible

• Network traffic is filtered using AWS security groups and network access control lists

• Outbound traffic from production systems is restricted to authorized destinations

7.2 DDoS Protection. Ollify utilizes AWS Shield and AWS CloudFront to provide protection against distributed denial of service (DDoS) attacks. These services provide automatic detection and mitigation of common DDoS attack patterns at the network and application layers.

7.3 Logging and Monitoring. Ollify maintains comprehensive logging and monitoring of its infrastructure and application:

• AWS CloudTrail logs all API activity within Ollify's AWS accounts

• Application logs capture authentication events, access to Customer Data, and security-relevant actions

• Infrastructure and application metrics are monitored with automated alerting for anomalous conditions

• Application and system logs are retained for a minimum of ninety (90) days, and platform audit logs for seven hundred thirty (730) days; logs are protected against unauthorized modification

• Security events are reviewed and investigated in accordance with Ollify's incident response procedures

8. Incident Response

8.1 Incident Response Program. Ollify maintains a documented incident response program to detect, contain, investigate, and remediate security incidents. The program covers:

• Detection and identification of potential security events through monitoring and alerting

• Classification of incidents by severity and potential impact on Customer Data

• Containment procedures to limit the spread and impact of confirmed incidents

• Investigation and root cause analysis of confirmed incidents

• Remediation and recovery procedures

• Post-incident review and improvement of controls

8.2 Customer Notification. In the event of a confirmed security incident that affects Customer Data, Ollify will notify affected customers in accordance with the notification requirements of the Agreement and applicable law. Notification will include:

• A description of the nature of the incident to the extent known

• The categories and approximate volume of Customer Data affected

• The measures Ollify has taken or is taking to address the incident

• Recommended steps customers may take to protect themselves

9. Vendor and Subprocessor Security

9.1 Vendor Assessment. Ollify evaluates the security posture of third-party vendors and subprocessors prior to engagement and on a periodic basis. Assessment criteria include:

• Review of the vendor's security certifications and compliance documentation (SOC 2, ISO 27001, or equivalent)

• Review of the vendor's data handling and privacy practices

• Contractual security and data protection requirements

• Ongoing monitoring of vendor security posture for material changes

9.2 Subprocessor List. Ollify maintains a current list of subprocessors that process Customer Data on Ollify's behalf. The subprocessor list is available at ollify.app/legal/subprocessors and is updated when subprocessors are added or removed. Key subprocessors include:

Planned Subprocessor — Not Yet Active. Anthropic, PBC (AI feature processing, Claude API) is disclosed here for transparency but is not yet active in production.

9.3 Contractual Security Requirements. All subprocessors that process Customer Data are required to enter into data processing agreements with Ollify that include the terms below, except for government agencies that do not offer data processing agreements in the commercial sense (see Ollify's Subprocessor List for details):

• Obligations to implement appropriate technical and organizational security measures

• Restrictions on the use of Customer Data to the specified processing purpose

• Requirements to notify Ollify of security incidents affecting Customer Data

• Audit rights or provision of third-party security certifications

10. Physical Security

Ollify does not operate its own data centers. All physical infrastructure is hosted within AWS facilities, which maintain comprehensive physical security controls including:

• Perimeter security with fencing, barriers, and controlled entry points

• 24/7 security personnel and video surveillance

• Multi-factor physical access controls including badge readers and biometric verification

• Environmental controls for temperature, humidity, and fire suppression

• Redundant power supplies and uninterruptible power systems

AWS physical security certifications and documentation are available at aws.amazon.com/compliance.

11. Business Continuity and Disaster Recovery

Ollify maintains business continuity and disaster recovery capabilities appropriate to its current stage, and is transparent about their present limits:

• Critical systems are deployed across multiple AWS Availability Zones to provide redundancy against infrastructure failures; cross-region resilience is on Ollify's infrastructure roadmap

• Automated failover is configured for the database tier, and the application tier runs redundant instances behind load balancing; automated daily encrypted backups protect against data loss

• Recovery procedures are documented internally; formal, scheduled restoration testing is being implemented

• Recovery time and recovery point objectives are documented internally and will be published as formal commitments once validated through testing

• Business continuity plans are reviewed and updated at least annually

Ollify's Backup and Recovery Policy, available at ollify.app/legal/backup-and-recovery-policy, describes current backup and recovery capabilities and limitations in detail. Ollify's Service Level Agreement (SLA), available at ollify.app/legal/service-level-agreement, describes uptime commitments and remedies for service availability failures.

12. Security Awareness

Ollify personnel with access to Customer Data or production systems receive security awareness training:

• Security awareness training is provided to all relevant personnel upon onboarding

• Training covers data handling obligations, phishing awareness, password security, and incident reporting procedures

• Security awareness training is refreshed at least annually

• Personnel handling Customer Data are informed of their specific data protection obligations

13. Customer Security Responsibilities

While Ollify maintains the security controls described in this Policy, customers share responsibility for the security of their use of the Service. Customer responsibilities include:

• Maintaining the confidentiality of account credentials and API keys

• Using strong, unique passwords, and enabling multi-factor authentication for account users once it becomes available

• Managing user access within their organization and promptly revoking access for departed users

• Complying with Ollify's Acceptable Use Policy with respect to data submitted to the Service

• Promptly reporting suspected security incidents or unauthorized account access to security@ollify.app

• Keeping client-side software, browsers, and operating systems used to access the Service up to date

14. Contact

For security-related questions, vulnerability reports, or to request additional security documentation, contact Ollify at: