Information Security Management System Policy

Last updated: 19 September 2026

This Policy is issued by GQ VENTURES SAS, trading as FARENIO, under French and European Union law, and forms Level 3 of the FARENIO Governance Hierarchy set out in Article 1 below.

ARTICLE 1 – GOVERNANCE HIERARCHY

This Policy forms part of the FARENIO AI Governance & Compliance Framework, which establishes the governance architecture applicable to trust, safety, artificial intelligence, information security, platform verification, financial-crime controls and tax-reporting controls throughout the FARENIO Marketplace and Ecosystem.

FARENIO operates the following governance hierarchy:

Level 1 — Trust & Safety

Protection of Clients, Hosts, Service Providers, Cleaners, Vendors, Partners, properties and the integrity of the Marketplace.

Level 2 — Artificial Intelligence Governance

Governance of AI systems, automated decision-making, algorithms and AI-assisted operations.

Level 3 — Security / ISMS

Protection of information, systems, infrastructure, applications, accounts, APIs and business operations.

Level 4 — Identity, KYC/KYB, AML/CFT Interface & DAC7

Verification of marketplace participants, trader traceability, tax-reporting due diligence, payment-provider compliance interfaces and financial-crime risk controls. This layer is addressed in FARENIO's dedicated AML, KYC, CTF & DAC7 Compliance Policy and is not duplicated in this document.

These layers form a single control architecture but remain legally distinct. Compliance with one layer shall not be treated as compliance with another.

This Policy sets out Level 3 — Security / ISMS. Trust & Safety controls (Level 1) are addressed in FARENIO's Marketplace Trust, Safety & Integrity Policy, AI Governance (Level 2) is addressed in FARENIO's AI Governance & Responsible AI Policy, and identity verification, KYC/KYB, AML/CFT and DAC7 tax-reporting controls (Level 4) are addressed separately in FARENIO's AML, KYC, CTF & DAC7 Compliance Policy.

ARTICLE 2 – ISMS OBJECTIVE

FARENIO shall maintain an Information Security Management System proportionate to its operations and risk exposure.

The ISMS shall protect:

Confidentiality — Integrity — Availability — Authenticity — Accountability — Resilience.

ARTICLE 3 – SECURITY SCOPE

Security governance applies to:

• Production Systems;
• Staging Systems;
• Databases;
• Source Code;
• Cloud Infrastructure;
• Portals;
• APIs;
• PMS Integrations;
• Payment Integrations;
• AI Systems;
• Administrative Systems;
• Endpoints;
• Credentials;
• Backups;
• Logs; and
• Third-party technology services.

ARTICLE 4 – ACCESS CONTROL

FARENIO shall apply:

• Role-Based Access Control;
• Least Privilege;
• Need-To-Know;
• MFA Where Appropriate;
• Privileged-Access Controls;
• Joiner/Mover/Leaver Procedures;
• Credential Protection;
• Periodic Access Review; And
• Separation Of Incompatible Duties.

Production access shall be restricted to authorised persons.

ARTICLE 5 – DEVELOPMENT SECURITY

Development shall implement appropriate:

• Repository Controls;
• Branch Protection;
• Code Review;
• Secrets Management;
• Dependency Management;
• Vulnerability Scanning;
• Testing;
• Deployment Approval;
• Staging/Production Separation;
• Change Management; and
• Rollback Procedures.

Direct uncontrolled modification of production systems is prohibited.

ARTICLE 6 – DATA SECURITY

Security measures shall reflect data sensitivity and include where appropriate:

• Encryption In Transit;
• Encryption At Rest;
• Key Management;
• Backup;
• Recovery Testing;
• Access Logging;
• Integrity Controls;
• Data Segregation;
• Retention controls; and
• Secure deletion.

ARTICLE 7 – VULNERABILITY MANAGEMENT

FARENIO shall maintain processes covering:

Identify → Assess → Prioritise → Remediate → Validate → Document.

Critical vulnerabilities affecting exposed production systems shall receive priority remediation.

ARTICLE 8 – LOGGING AND MONITORING

Security-relevant events shall be logged proportionately.

Monitoring may cover:

• Authentication;
• Privileged Activity;
• API Activity;
• Configuration Changes;
• Administrative Actions;
• Security Alerts;
• Anomalous Behaviour;
• Data Access;
• Payment/Payout Events; And
• AI security events.

Logs shall be protected against unauthorised alteration.

ARTICLE 9 – SECURITY INCIDENT RESPONSE

FARENIO shall maintain an incident-response process:

Detect → Triage → Contain → Preserve Evidence → Investigate → Eradicate → Recover → Notify where required → Review.

Incidents potentially constituting personal-data breaches shall be immediately referred into the GDPR breach-assessment process.

ARTICLE 10 – BUSINESS CONTINUITY

Critical systems shall have proportionate:

• Backups;
• Restoration Procedures;
• Recovery Objectives;
• Service-Continuity Measures;
• Dependency Mapping;
• Emergency Contacts; And
• Recovery Testing.

ARTICLE 11 – SUPPLIER SECURITY

Material technology suppliers shall undergo risk-based due diligence covering:

• Security;
• Privacy;
• Availability;
• Subprocessors;
• Breach Notification;
• Data Location;
• Access;
• Resilience;
• Contractual Safeguards; And
• Exit Arrangements.

ANNEX E

ISMS CONTROL REGISTER

The Security Function shall maintain appropriate registers covering:

• Information Assets;
• Systems;
• Data Classifications;
• Access;
• Privileged Accounts;
• Suppliers;
• Vulnerabilities;
• Security Risks;
• Security Incidents;
• Backups;
• Business Continuity;
• Changes; And
• Remediation.

ANNEX G

THIRD-PARTY RISK REGISTER

Material third parties shall be classified according to:

• Service;
• Data Access;
• System Access;
• Criticality;
• Personal-Data Processing;
• AI Involvement;
• Payment Involvement;
• Geographic Location;
• Subprocessors;
• Security Status;
• Contractual Controls;
• Business-Continuity Dependency;
• Regulatory Dependency;
• Review Date; And
• Exit Plan.

ARTICLE 12 – RECORDS AND EVIDENCE

FARENIO shall maintain proportionate evidence demonstrating operation of this Policy and the wider FARENIO AI Governance & Compliance Framework, including, as relevant to Information Security:

• Policies;
• Registers;
• Risk Assessments;
• AI Classifications;
• DPIAs;
• Security Assessments;
• Verification Records;
• Supplier Reviews;
• Access Reviews;
• Training Records;
• Deployment Approvals;
• Incidents;
• Complaints;
• Corrective Actions;
• Audits; And
• Management Reviews.

ARTICLE 13 – LEGAL PRECEDENCE

This Policy forms part of the internal governance architecture of GQ VENTURES SAS operating under the FARENIO trade name. It shall operate together with the FARENIO Terms and Conditions, Service Provider Terms, Vendor/Partner Terms, Privacy Policy, Cookie Policy, Consumer Information, Information Security Policies, Incident Response Plan, Data Retention Policy, Business Continuity Plan, contractual payment-provider arrangements and applicable tax and accounting procedures.

Nothing in this Policy limits mandatory statutory rights or obligations.

Where a conflict exists between this Policy and mandatory French or European Union law, mandatory law prevails.

ARTICLE 14 – CORE GOVERNANCE RULE

FARENIO adopts the following control principle:

VERIFY PEOPLE → PROTECT USERS → PROTECT DATA → SECURE SYSTEMS → GOVERN AI → CONTROL PAYMENTS → REPORT TAX DATA → MONITOR → AUDIT → IMPROVE.

No commercial objective, automated system, Service Provider, employee, contractor, Vendor, Partner or third-party technology provider may override a mandatory legal or regulatory requirement.

ARTICLE 15 – CONTACT

Governance and compliance matters:

GQ VENTURES SAS — FARENIO

Compliance & Governance Function

Email: contact@farenio.com

Privacy requests shall be submitted through the privacy contact identified in the FARENIO Privacy Policy.

Security incidents shall be submitted through FARENIO's designated security-reporting channel.