Information Security and Platform Protection Policy

This policy defines the general framework for protecting the ATHLENIXS® website, platform and data against unauthorised access, loss, alteration or unlawful disclosure. It does not replace detailed technical procedures or service agreements.

The responsibilities of the system owner, the security officer, data owners and service providers are defined according to the company's actual structure.

Permissions are granted on a least-privilege and need-to-know basis, and are reviewed when a role changes or a relationship ends. Multi-factor authentication is planned for administrative and sensitive accounts wherever it is available.

Protection controls in transit and at rest are determined according to data classification and the technical architecture.

The logs required for administrative and security activity are defined, along with their retention period, who may view them, and how they are reviewed and alerted on for unusual activity.

Updates and vulnerabilities are managed according to severity, and changes are tested before release wherever possible. No penetration test or active scan is carried out without written authorisation and an approved scope.

Backup frequency, storage locations, access permissions and recovery objectives are defined, with restoration to be tested periodically and the results documented.

Procedures are adopted for recording, assessing, containing and investigating incidents, restoring service and capturing lessons learned. Legal and contractual notifications are made in line with the applicable requirements.

The risks of suppliers and service providers are assessed according to the type of data and level of access, and confidentiality, reporting and deletion obligations are documented for the end of the relationship.

Users are responsible for protecting their login credentials, reporting suspicious activity, and not sharing data without authorisation.

Controls are reviewed periodically and after incidents or material changes. This document is a proposed governance framework; on its own it does not evidence the implementation of any technical control, and implementation and audit evidence must be retained.