Information Security Policy for Clients

ELVEN WORKS SOLUÇÕES EM TECNOLOGIA LTDA. (“ELVENWORKS”), registered under CNPJ No. 34.169.199/0001-06, presents this Information Security Policy for Clients (“Policy”) with the aim of making transparent the commitments and practices we adopt to protect the information and personal data processed within the scope of our products and services.

1. Scope

This Policy applies to all information under the responsibility of ELVENWORKS, in any format, and to the systems, tools and processes used to process it, including the Elven Platform and the Elven Observability, Elven Monitoring, Elven Command Center, Elven Incidents and Elven Dora Metrics solutions, as well as the professional services provided to our clients.

2. Objectives

Our information security objectives are:

• To preserve the confidentiality, integrity and availability of information;
• To comply with applicable legislation, in particular the General Data Protection Law (LGPD – Law No. 13,709/2018), and with the contractual obligations undertaken with our clients;
• To identify, assess and treat the security risks that may affect information and services;
• To promote a security culture among employees, suppliers and other parties involved;
• To adopt technical and organizational controls proportionate to the risks and to seek the continuous improvement of these controls.

3. ELVENWORKS Commitments

To achieve these objectives, ELVENWORKS undertakes to:

• Protect the data processed in the Elven Platform infrastructure;
• Comply with applicable privacy and data protection legislation;
• Raise awareness among employees and partners of their information security responsibilities;
• Adopt proactive cybersecurity measures;
• Maintain secure digital work environments;
• Continuously review and improve its security practices.

4. Organization of Information Security

Information security is handled in a structured manner at ELVENWORKS, taking into account people, technologies and processes. The main practices adopted include:

• Encryption: data provided by users is encrypted;
• Application protection: use of a Web Application Firewall (WAF) to mitigate external attacks;
• Credential management: storage of credentials in a password vault, with restricted access;
• Cloud infrastructure: use of cloud providers compliant with the LGPD and the GDPR. The subprocessors that process data on our behalf are listed in the List of Subprocessors;
• Confidentiality: all employees sign a Confidentiality Agreement;
• Supplier management: security and data protection obligations are required in contracts with third parties;
• Specialized advisory: specialized legal support in Privacy and Data Protection;
• Incident management: processes for the identification, handling and communication of security incidents (see item 8).

5. Training and Awareness

We provide periodic training to our team, reinforcing the importance of care with the information handled in the course of their activities. Topics covered include:

• Recognizing social engineering attempts, such as phishing;
• Good practices for authentication and password management;
• Proper handling of data and risks of accidental exposure;
• Identification and reporting of security incidents;
• Risks of using insecure networks.

6. Retention, Availability and Backup

Personal data is stored while the client's account is active and, after its deletion, is deleted, except when storage is necessary to comply with a legal obligation or for the regular exercise of rights in administrative, judicial or arbitral proceedings, as described in our Privacy Policy.

Application access logs and connection logs are kept for the periods set forth in applicable legislation, in particular the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet – Law No. 12,965/2014), and may be made available upon request by the competent authorities or for the defense of the rights of ELVENWORKS.

We perform periodic backups, stored securely and used exclusively for system recovery.

7. Client Responsibilities

Information security is a shared responsibility. The client must:

• Keep their access credentials confidential;
• Use strong passwords and update them periodically;
• Protect their devices against unauthorized access;
• Immediately notify ELVENWORKS of any suspicious activity or suspected compromise of their account;
• Ensure that the data entered into the platform complies with applicable legislation;
• Follow the Terms of Use and the security guidelines of ELVENWORKS;
• Consider the security and privacy impacts when sharing information.

8. Security Incident Response

ELVENWORKS maintains processes to respond to security incidents, such as breaches, leaks and other threats. In the event of a security incident that may entail relevant risk or harm to data subjects, the affected clients will be notified in accordance with applicable legislation and contractual obligations.

9. Continuous Improvement

We periodically review our information security practices and controls to ensure that they remain adequate, applicable and effective.

10. Review and Communication of this Policy

This Policy will be reviewed annually or whenever there are significant changes. Any changes will be published through the official channels of ELVENWORKS, and we recommend consulting this page periodically.

11. Contact

Questions about this Policy, or reports of incidents and vulnerabilities, may be sent to our Data Protection Officer (DPO) by email at fabricio.lopes@elven.works.

Date of last update: September 29, 2026.