Information Security Policy

At ALLE TECH, information security is fundamental to our business. We are committed to maintaining the:

• Confidentiality of customer information
• Integrity of business and system data
• Availability of our services and infrastructure

We implement commercially reasonable administrative, technical, physical, and organizational safeguards designed to protect information from unauthorized access, disclosure, alteration, destruction, misuse, or loss.

This Policy applies to:

It also applies to all employees, contractors, consultants, partners, and authorized service providers handling ALLE TECH or Customer information.

ALLE TECH utilizes reputable cloud infrastructure providers to deliver secure and reliable services. Depending on the solution deployed, infrastructure may include providers such as:

• Amazon Web Services (AWS)
• Microsoft Azure
• Google Cloud Platform (GCP)
• Odoo Cloud
• SAP-approved hosting providers
• Other enterprise cloud providers

These platforms provide enterprise-grade capabilities including:

• Physical security & environmental controls
• Infrastructure redundancy & continuous availability features
• Network security & disaster recovery capabilities

ALLE TECH leverages these services to support secure delivery of customer solutions.

Data in Transit

All communications between users and ALLE TECH systems are protected using industry-standard encryption protocols, including HTTPS and TLS. Where applicable, secure APIs and encrypted communication channels are used between integrated systems.

Data at Rest

Customer information stored within supported environments is protected using commercially reasonable security measures. Where technically appropriate and supported by the underlying platform, sensitive information may be encrypted at rest.

Access to customer systems, software environments, and internal resources is granted strictly on the basis of business necessity and the principle of least privilege. Security controls include:

Customers remain responsible for protecting their own user credentials and administrator accounts.

ALLE TECH encourages strong authentication practices. Customers and users should:

• Use strong and unique passwords.
• Avoid password sharing.
• Change compromised credentials immediately.
• Enable Multi-Factor Authentication (MFA) whenever available.
• Follow their organization's password policies.

ALLE TECH follows secure software development practices throughout the application lifecycle. Security measures may include:

Security practices are reviewed and improved on an ongoing basis.

ALLE TECH maintains commercially reasonable network protection measures, including:

• Firewall protection & secure network segmentation
• Traffic filtering & access restrictions
• Intrusion monitoring & threat detection
• Security event monitoring & continuous infrastructure monitoring

To support business continuity, ALLE TECH maintains backup and recovery procedures appropriate to the Services being delivered. Backup activities may include:

• Database & Configuration backups
• Application backups & Virtual server snapshots
• Document backups & Disaster recovery planning

Backup frequency and retention periods vary according to the applicable customer agreement, platform capabilities, and operational requirements.

ALLE TECH maintains procedures for identifying, investigating, responding to, and recovering from information security incidents.

Employees, consultants, and contractors who access customer information are required to:

• Protect confidential information.
• Follow company security procedures.
• Report suspected security incidents promptly.
• Comply with internal information security policies.
• Access customer information only where required for authorized responsibilities.

Access is granted only to personnel with a legitimate business need.

ALLE TECH may engage carefully selected third-party providers to support the delivery of our Services. Examples include:

Reasonable efforts are made to select providers that maintain appropriate security standards and contractual confidentiality obligations.

ALLE TECH maintains operational practices designed to support the continuity of our business operations and customer services. Business continuity measures may include:

• Infrastructure redundancy
• Backup procedures
• Disaster recovery planning
• Incident response processes
• Cloud failover capabilities & recovery testing where appropriate

While every reasonable effort is made to ensure continuity, no technology service can guarantee uninterrupted availability.

Security is a shared responsibility. Customers remain responsible for:

ALLE TECH cannot be held responsible for security incidents arising from customer negligence, compromised credentials, unsupported customizations, or third-party systems outside our control.

ALLE TECH designs its products, services, and implementation methodologies to support customer compliance initiatives.

However, each Customer remains solely responsible for ensuring compliance with all laws, regulations, industry standards, and internal governance requirements applicable to its business and jurisdiction.

Information security is an ongoing process. ALLE TECH periodically reviews and enhances its:

• Security controls & infrastructure
• Internal procedures & risk management practices
• Incident response capabilities & security awareness programs

to address evolving cybersecurity threats and industry best practices.

ALLE TECH may update this Information Security Policy from time to time to reflect operational, technological, legal, or regulatory changes. Updated versions will be published on:

https://www.alle-tech.com

Continued use of our Services following publication of an updated Policy constitutes acceptance of the revised version.

For information security inquiries or to report a suspected security issue, please contact: