Information Security Policy

• Organisation: DISRUPTIVE LABS, S.L. (trade name "Reversa"), CIF B21866249
• Version: 3, approved on 2026-11-03 · Classification: Public
• ENS measures: org.1 (RD 311/2022, art. 12) · ISO/IEC 27001:2022: clause 5.2, control A.5.1

While providing the service of Reversa (DISRUPTIVE LABS, S.L.) to clients, Reversa’s staff members and vendors acquire access to the client's privileged and sensitive information. Each of Reversa's clients places an enormous amount of trust that their data is created, stored, shared, and transmitted securely.

The loss of any client data or services due to unauthorized access, intrusion, theft, natural or cyber disasters, or cyber-attacks diminishes the client's trust as well as significantly damages Reversa’s reputation as an advocate for companies to develop, implement and maintain systems to prevent the loss of intellectual property and other confidential information.

The purpose of this policy document is to define the direction, principles, and basic rules for information security management within Reversa. This document describes the management's vision and commitment to effectively protect "confidentiality," maintain "integrity," and ensure the "availability" of its information assets and to respond and recover from information security incidents when they arise.

Information security is deemed to safeguard three main objectives:

• Confidentiality – Data and information assets must be confined to people authorized to access them and not be disclosed to others.
• Integrity – Keeping the data intact, complete, and accurate, and information systems operational.
• Availability – An objective indicating that information or system is at the disposal of authorized users when needed.

This policy applies to all employees, contractors, and third-party vendors of Reversa who access, process, store, or transmit organizational or client data. It covers all information assets regardless of format (electronic, paper, or verbal) that are created, received, stored, or transmitted by Reversa.

In-scope systems and locations include cloud-hosted infrastructure and services running on the production stack (Render, AWS, MongoDB Atlas, Neo4j Aura), code repositories and related development artifacts stored in GitHub, Google Workspace accounts (including email and Drive), and employee devices (company-managed laptops and workstations).

This policy also applies to third-party SaaS vendors and service providers that process Reversa data, including those used for backups, monitoring, or security, to the extent of the services they provide and as defined in contractual agreements.

• Reversa shall establish, implement, and maintain a holistic and robust Information Security Management System (ISMS). ISMS is defined as the overall management system, based on a business risk approach, to establish, implement, operate, monitor, review, maintain and improve information security. The management system includes organizational structure, policies, planning activities, responsibilities, practices, procedures, processes and resources.
• The ISMS shall have adequate and appropriate arrangements which shall enable it to effectively protect "confidentiality," maintain "integrity" and ensure "availability" of its information assets and to respond and recover from information security incidents when they arise.
• While planning the ISMS, Reversa shall consider its internal and external issues along with the requirements of the interested parties and determine risks and opportunities that could affect the activities supporting the provision of its products and services. The top management shall provide the required resources and sufficiently contribute towards the ISMS, ensuring it achieves its intended outcome(s).

Information and supporting technology, including the production cloud infrastructure (Render, AWS, MongoDB Atlas, Neo4j Aura), GitHub code repositories, Google Workspace services, and company-managed endpoint devices, are critical business assets. Confidentiality, integrity, and availability of information collected (including PII, behavioral data, and business/operational data) are essential to meet legal, regulatory (SOC 2, ISO 27001, GDPR), and contractual obligations.

Where capabilities (e.g., backups, email, productivity suites) are provided by third-party SaaS vendors, Reversa relies on vendor-managed controls documented in vendor contracts and shared-responsibility models. Internal controls shall focus on secure configuration, access control, data protection, monitoring, and vendor management.

Designing and implementing security controls requires participation from employees, contractors, and relevant vendors. Management policies and administrative controls shall supplement technical controls to protect data across development (GitHub), deployment and production (Render, AWS, MongoDB Atlas, Neo4j Aura), and end-user environments (Google Workspace and employee devices).

The objectives of the Information Security Policy are:

• Align the ISMS with Reversa’s SaaS business strategy and scaling objectives.
• Protect and safeguard customer and operational data (including PII) processed across Render, AWS, MongoDB Atlas, GitHub, Google Workspace, and on company-managed devices.
• Reduce risks associated with cloud services, third-party SaaS providers, and remote endpoint use through configuration management, vendor due diligence, and endpoint protection.
• Ensure that all information assets are inventoried and classified, and that protection measures are applied according to risk and sensitivity.
• Ensure information and systems are accessible only to authorized users via role-based access control, least privilege, and multi-factor authentication where supported.
• Provide customers contractual and operational means to support PII subject rights (access, correction, erasure) in accordance with GDPR and contractual obligations.
• Process customer data only per customer instructions and contractual terms; avoid independent processing beyond those instructions.
• Maintain compliance with SOC 2, ISO 27001, GDPR, and other applicable legal and regulatory requirements for data collection, storage, processing, transmission, and disclosure.
• Allocate resources to establish, operate, monitor, and improve the ISMS.
• Raise organizational awareness so employees, contractors, and relevant vendors understand and fulfill their information security responsibilities.
• Develop and maintain supporting procedures and controls that reflect best practices appropriate for an early-stage SaaS company using Render, AWS, MongoDB Atlas, GitHub, and Google Workspace.
• Periodically review and update security objectives to reflect changes in business, technology, or regulatory requirements.

• Segregation of duties is a method for reducing the risk of accidental or deliberate misuse of an organization’s assets.
• While assigning responsibilities, conflicting duties and areas of responsibility shall be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of the organization’s assets.
• Care shall be taken that every individual may access, modify, or use assets with proper authorization or detection. The possibility of collusion should be considered while designing the controls.

Based on requirements and proper vendor validation, specialist advice shall be sought whenever required. This could be by having a Security Consultant on a contractual or per-call payable basis. Where appropriate, Reversa may engage security-focused industry groups, cloud provider security programs (e.g., AWS, Render, and MongoDB Atlas security resources), or GDPR/SOC 2 advisory services rather than non-profit agencies when specialist operational or compliance guidance is required.

Where required, the organization shall maintain appropriate contact with law enforcement authorities, regulatory bodies, fire departments, emergency services, telecommunication providers, and others. These contacts shall ensure help can be availed of and is accessible during a crisis. For incidents involving regulated data (e.g., personal data under GDPR), the Security Incident Response lead shall follow legal reporting timelines and engage relevant regulators or law enforcement as required.

Information security should be integrated into the organization’s project management method(s) to ensure that information security risks are identified and addressed as part of a project. This applies generally to any project regardless of its character. Examples: a project for a core business process, IT, facility management, and other supporting processes. For software development projects, security requirements shall be included in GitHub-based workflows (code reviews, branch protections, and dependency scanning). Cloud deployments to AWS must follow approved architecture and secure configuration checklists prior to production rollout.

Any employee, contractor, or third-party who becomes aware of a suspected or actual security incident must report it immediately to the Security Incident Response lead via the organization’s designated incident reporting channel (e.g., internal incident management workflow and email to the security mailbox in Google Workspace). Reports must include sufficient detail to allow timely assessment and response.

• Compliance with this policy and its supporting policies shall be assessed at least annually through internal audits and periodic external assessments aligned to SOC 2 and ISO 27001 requirements. Identified exceptions shall be remediated based on risk and tracked to closure.
• The security policy shall be reviewed annually, and additionally when significant changes occur to the organizational structure, business processes, AWS infrastructure, use of third-party services, or regulatory requirements.
• The security policy shall be reviewed and revised whenever a major security risk or incident is identified.

The following policy documents shall support the information systems security policy at a minimum:

12.1 Human Resources Security Policy

The purpose of this policy is to ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered.

12.2 Risk Assessment & Management Procedure

The purpose of this procedure is to ensure that guidelines related to understanding and managing risks that may affect information security are provided.

12.3 Access Control Policy

The purpose of this policy is:

• To limit access to information and information processing facilities.
• To ensure authorized user access and to prevent unauthorized access to systems and services.
• To make users accountable for safeguarding their authentication information.
• To prevent unauthorized access to systems and applications.
• Segregation of duties.

12.4 Asset Management Policy

The purpose of this policy is:

• To identify Reversa’s assets and define appropriate protection responsibilities.
• To ensure that information receives an appropriate level of protection in accordance with its importance to Reversa.
• To prevent unauthorized disclosure, modification, removal, or destruction of information stored on media.

12.5 Operations Security Policy

The purpose of this policy is to ensure the protection of information through daily operations that take place in providing Reversa’s services.

12.6 Acceptable Usage Policy

• To ensure that all employees at Reversa are aware of the acceptable use of assets and formal cybersecurity guidelines to ensure best security practices.
• To ensure that Reversa’s information is protected when accessed, processed, or stored at teleworking sites.

12.7 Compliance Policy

The purpose of this document is to ensure Reversa complies with all legal and regulatory requirements to ensure the proper functioning of all business domains.

12.8 System Acquisition and Development Policy

The purpose of this policy is to ensure that information security is an integral part of information systems across the entire lifecycle. This also includes the requirements for information systems that provide services over public networks.

12.9 Physical and Environmental Policy

This policy helps to prevent unauthorized physical access, damage, and interference to Reversa’s information and information processing facilities.

12.10 Business Continuity Management Policy

The purpose of this policy is to ensure that business continuity is embedded in Reversa’s scope of operations.

12.11 Vendor Management Policy

The purpose of this policy is to ensure the protection of Reversa’s assets that are provided by third-party suppliers.

12.12 Incident Management Policy

This policy helps the management of any information security incidents that may compromise confidentiality, integrity, or availability of data and services by Reversa.

Public. An unsigned copy is published on reversa.ai for interested parties.

Compliance with this policy shall be verified through various methods, including, but not limited to, automated reporting, audits, and feedback to the policy owner. Any staff member found to be in violation of this policy may be subject to disciplinary action, which may include termination of employment or contractual agreement. The disciplinary action shall depend on the extent, intent, and repercussions of the specific violation.

• The Information Security Officer (or designated security lead) proposes the Information Security Policy and every change to it. Management approves them (section 17.6).
• For the ENS system, the Information Security Officer is the Responsable de la seguridad defined in section 17.4.
• The Information Security Officer (or designated security lead) has executive authority over information security and works with Management to issue all documentation, each document approved as section 17.6 sets.
• The Information Security Officer (or designated security lead) is responsible for the development and maintenance of all ISMS documentation.
• The Information Security Officer (or designated security lead) shall schedule periodic internal audits with the help of either the internal team or external consultants.
• The Information Security Officer (or designated security lead), along with the Head of Engineering, is responsible for building a strategic and comprehensive privacy program that defines, develops, maintains, and implements policies and processes that enable consistent, effective privacy practices that minimize the risk and ensure the confidentiality of Personally Identifiable Information (PII), paper or electronic, across all media types.

This document shall be reviewed at least annually and additionally whenever significant changes occur in technology (e.g., changes to AWS architecture, GitHub processes, Google Workspace configuration), third-party vendor relationships, regulatory requirements (SOC 2, ISO 27001, GDPR), or after major security incidents.

This section adapts the policy to Royal Decree 311/2022, of 3 May, which regulates the Esquema Nacional de Seguridad (ENS). It applies to the information system in the ENS scope: the information system that supports the design, development, deployment, maintenance, technical support and operations of Reversa's cloud-hosted regulatory-compliance SaaS platform, including customer onboarding and support activities that process customer data. The system is in category MEDIA. For that system, where this section and the rest of the policy differ, this section prevails.

17.1 Mission and objectives

DISRUPTIVE LABS, S.L. (Reversa) develops and operates a cloud SaaS platform that companies and public bodies use to follow regulation and comply with it. Its mission in information security is to protect the information it processes and the services it provides, so that its customers, public-sector customers included, can rely on their confidentiality, integrity, availability, authenticity and traceability. The objectives in section 5 apply to these five dimensions.

17.2 Legal and regulatory framework

Reversa carries out its activities under:

• Royal Decree 311/2022, of 3 May, regulating the Esquema Nacional de Seguridad, with its technical security instructions and the CCN-STIC guides that apply.
• Regulation (EU) 2016/679, the General Data Protection Regulation, and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights.
• Law 34/2002, of 11 July, on information society services and electronic commerce.
• Law 9/2017, of 8 November, on Public Sector Contracts, for the services it provides to public bodies.
• The contracts and data processing agreements signed with customers and providers.
• ISO/IEC 27001:2022, under which Reversa's information security management system is certified.

The Compliance Policy describes how Reversa identifies and follows these requirements.

17.3 Basic principles

Reversa applies the basic principles of article 5 of the ENS:

• Security as an integral process. Security covers people, technology, processes and providers. Every staff member has duties under this policy.
• Risk-based security management. The risk analysis, made under the Risk Assessment & Management Policy and covering the five ENS dimensions, decides which measures are applied and how strongly.
• Prevention, detection, response and conservation. The supporting policies set the preventive measures. Threat detection services and monitoring detect incidents. The Incident Management Policy governs the response. Backups and the Business Continuity & Disaster Recovery Policy keep the information and the service.
• Lines of defence. Several independent layers protect the system: the web application firewall at the edge, network restrictions on the databases, single sign-on with multi-factor authentication, authorisation inside the application, and encryption in transit and at rest.
• Continuous monitoring. Systems and controls are monitored continuously, including the automated checks of the compliance platform.
• Periodic reassessment. The risk analysis and the security measures are reviewed at least once a year and whenever a significant change or a serious incident occurs.
• Differentiation of responsibilities. The roles in 17.4 separate who sets requirements, who decides on security and who operates the system.

17.4 Security roles

Management, in this policy, means the company's founders acting as its leadership team: the CPTO, the COO and the CRO.

Designation and renewal. Management appoints each role holder in writing, and the appointment is recorded in the minutes of the Security Committee. Appointments are reviewed every year at the management review, and renewed when a holder leaves, changes job, or a conflict of interest appears. One person may hold the roles of information owner and service owner.

Security officer and system owner. As a rule, the Responsable de la seguridad and the Responsable del sistema are different people, with no reporting line between them (art. 13.3). While the size of the team does not allow it, one person holds both roles, as art. 13.3 permits for a justified lack of resources, with these compensating measures:

• The information and service owner, who does not report to that person, reviews their security decisions at the Security Committee and can escalate them to Management.
• Every change to production code needs the approval of another engineer, and nobody can approve their own change.
• Administrative actions on the main platforms are logged: AWS CloudTrail, the MongoDB Atlas activity feed and the GitHub audit log.
• An internal audit and an independent external audit review the security measures every year.

The Security Committee reviews this exception every year and ends it when the team can separate the two roles.

Conflicts. Disagreements between role holders are raised at the Security Committee. If the committee does not resolve them, Management decides.

17.5 Security Committee

• Members: the COO, who chairs it, the four ENS role holders, and the Data Protection Representative. One person may sit in more than one capacity.
• Duties: coordinate information security across the company; approve the security rules (17.6); follow the risk analysis, incidents, audit results and improvement actions; propose resources to Management; resolve conflicts between role holders.
• Meetings: at least once a year, together with the management review, and after any serious incident or significant change to the system. Minutes record the attendees, the decisions and the actions with their owners.
• Relationship with the rest of the company: the committee reports to Management. Its decisions bind all staff and are carried out through engineering, operations and provider management.

17.6 Security documentation

Security documentation has four levels:

1. Security policy: this document. Approved by Management.

2. Security rules: the Acceptable Usage Policy, the Code of Business Conduct Policy and the topic policies. They say what is and is not allowed. Approved by the Security Committee.

3. Security procedures: how specific tasks are done. Approved by the Responsable de la seguridad.

4. Records and evidence: what shows that the rules and procedures are followed.

The compliance platform is the system of record for policies and procedures: it keeps every version, records who approved it, and tracks staff acknowledgement. Working drafts and evidence are kept in the company's Google Workspace and in the compliance repository. Access is limited to the staff who need it, and each document is classified under the Data Classification Policy. Every document is reviewed at least once a year.

17.7 Risks from processing personal data

The system processes business contact data of customer users (name, professional email, job title, preferences), pseudonymised usage events, the content users enter, and support requests. It does not ask for special categories of data, but users could include them in the documents or questions they enter. The main risks are unauthorised access to customer accounts and content, special categories of data entered by users, disclosure of personal data to AI model or other service providers, transfers outside the European Union, and keeping data longer than needed.

Reversa treats them through the Record of Processing Activities, the data protection impact assessment screenings, the Data Protection Policy, the Data Retention Policy, keeping processing in the European Union where the provider allows it, with standard contractual clauses for the providers that process personal data outside it, as listed in the Record of Processing Activities, AI models that are not trained on customer data, and data processing agreements with the providers that process personal data on its behalf. These risks are part of the system risk analysis and are reviewed with the Record of Processing Activities every quarter.

17.8 Minimum security requirements

The minimum requirements of article 12.6 of the ENS are developed in these documents: