APPCIRCLE INC.
INFORMATION SECURITY POLICY

1. PURPOSE AND SCOPE 

2. DEFINITIONS AND SCOPE 

• Company: Appcircle Inc.
• Information: Information and knowledge are the most critical assets of an organisation. These assets should not be given out, stolen, changed in such a way that they lose their value, or lost. Information can be found in various forms. It can be printed or written on paper, stored in electronic media and sent by mail or electronically.
• Confidentiality: Information is only accessible to authorised persons,
• Integrity: Protecting information from unauthorised modification and recognising when it has been modified,
• Availability: It means that the information can be used by authorised users when needed.
• Sensitive customer data: Highly confidential data such as passwords, PINs, encryption keys that users use to prove their identity on systems,
• Information Security and Risk Committee: Represents the committee established to establish policies, procedures and processes for the management of information systems and ensuring information security, and to effectively manage the risks arising from the use of information technologies.
• Senior Management: Responsible for overseeing and approving the regular updating of the Information Security Policy.

3. BASIC PRINCIPLES OF INFORMATION SYSTEMS MANAGEMENT 

• All information related to the Company shall be stored or backed up and used in the domestic electronic environment in a secure manner that allows access at any time,
• Infiltration and stress testing,
• Accounting records shall be accounted in accordance with the procedures and principles determined by the Public Oversight, Accounting and Auditing Standards Board, It is established in a structure that will allow.

It is established in a structure that will allow. 

A business continuity plan is established to ensure the continuous functioning of information systems. The operability and adequacy of this plan is regularly tested and necessary measures are taken if required. In the planning of business continuity, critical information technology assets and processes are identified; business impact analyses and risk assessments are performed for these.

4. COMPANY INFORMATION SECURITY POLICY 

• Protects the confidentiality of customer and personnel information in order to ensure the protection of the privacy of personal information.
• Implement the infrastructure and controls that will protect the integrity of information and guarantee its continuous accessibility.
• Provides authorisation in accordance with the principle of separation of duties in design, development, testing and implementation processes and establishes an approval mechanism in critical processes.
• Provides physical and logical separation of Development, Test and Production environments.
• It ensures that the minimum authorisation principle required for the authorisation of users is ensured and authorisations are checked regularly.
• It establishes network security against threats from external networks.
• Establishes layered security architecture and ensures continuous surveillance.
• Ensures that measures to ensure security such as encryption and masking are taken in the transmission and storage of sensitive customer data and personal information.
• It ensures the reliability of the encryption keys used.
• Establishes an information security organisation to ensure the management and coordination of information security activities.
• Inventory information assets, determine ownership and manage risks on information assets.
• Carries out information security incident management activities that include the steps of detecting, reporting and preventing recurrence of information security incidents.
• Implements an adequate awareness programme for all staff and ensures the participation of all employees to meet information security requirements.
• Takes the necessary physical and environmental security measures to ensure the security of information in the areas where information is processed.
• Determines and realises the security requirements in the acquisition, development and maintenance of information systems.
• It obliges employees to comply with the determined information security policies, processes, legal and regulatory obligations by obtaining their written commitments.
• Carries out business continuity activities to prevent interruptions in business activities and ensure continuous access to information.
• Implements the necessary security controls in all relevant areas to control access to information and prevent unauthorised access.
• Applies the necessary security controls in the operation of information systems activities, defines the roles and responsibilities for this.

5. MAIN TOPICS OF INFORMATION SECURITY POLICY 

6. REVIEW OF INFORMATION SECURITY POLICY

The Company's Information Security Policy is reviewed by the Information Security Officer at least once a year and, if deemed necessary, updated and submitted to the Board of Directors for approval. New policies are produced to include the needs arising due to developments in security technologies.

7. RESPONSIBILITY FOR THE IMPLEMENTATION OF INFORMATION SECURITY POLICY

It is ensured that all employees are aware of the Information Security Policy. The final version of the policy is announced to all personnel and published in a common area where personnel can access it continuously. Personnel must comply with the general provisions that concern them. It is the responsibility of the administrative supervisor of the personnel to check whether the personnel comply with the general provisions that concern them. Compliance with information security policies is regularly monitored.

8. WALKABILITY

It enters into force upon its approval by the Board of Directors and its announcement to the personnel of our Company.

9. EXECUTIVE

The Board of Directors executes the provisions of the Policy.

10. APPROVAL

Approval of the Board of Directors numbered 2023-03 and dated 14.03.2023.

11. REVISION HISTORY