Security Policy

VAULTFY AI TRADING CO LTD (hereinafter referred to as "Vaultfy AI Trading," "We," "Us," or "Our"), trading as VAULTFY.AI LIMITED (Company No. 17156633), with its registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ, is unequivocally committed to establishing and maintaining an Institutional Fortress of security for all information assets. This Security Policy (the "Policy") outlines the advanced principles, stringent responsibilities, and robust controls implemented to safeguard Our FinTech infrastructure platform and ultra-luxury concierge orchestration service (the "Service").

This policy is designed to exceed industry best practices, aligning with and often surpassing standards such as ISO 27001, NIST Cybersecurity Framework, SOC 2 Type II, and PCI-DSS Level 1 equivalent controls, while ensuring strict compliance with all relevant data protection and financial services regulations (e.g., UK GDPR, FCA guidelines).

1. Scope and Unwavering Applicability

This Policy applies to all VAULTFY.AI employees, contractors, third-party service providers, and any individuals or entities who access, process, or manage VAULTFY.AI information assets or systems. It covers all information, whether in digital, physical, or verbal form, and all systems, networks, and applications used to deliver the Service, including but not limited to ALFRED AI, hybrid payment rails, and client data.

2. Foundational Information Security Principles

VAULTFY.AI operates on the following non-negotiable information security principles:

• Confidentiality: Absolute protection of sensitive information from unauthorized disclosure, ensuring client privacy and proprietary data integrity.
• Integrity: Guaranteeing the accuracy, completeness, and authenticity of all information, preventing unauthorized modification or destruction.
• Availability: Ensuring timely, reliable, and resilient access to information and systems for authorized users, even in the face of adverse events.
• Accountability: Establishing clear ownership and audit trails for all actions related to information security.
• Compliance: Unwavering adherence to all applicable laws, regulations, and contractual obligations, with continuous monitoring of the evolving threat and regulatory landscape.

3. Governance, Oversight, and Unambiguous Responsibilities

3.1. Chief Information Security Officer (CISO)

VAULTFY.AI has appointed a dedicated Chief Information Security Officer (CISO) with executive authority, responsible for:

• Strategic development, implementation, and continuous improvement of the Information Security Management System (ISMS).
• Overseeing compliance with this Policy, regulatory requirements, and industry standards.
• Leading security incident response, threat intelligence, and advanced risk assessments.
• Reporting directly to the Board of Directors on security posture and risk.

3.2. Employee and Contractor Responsibilities

All personnel are mandated to:

• Strictly adhere to this Security Policy and all associated procedures.
• Complete rigorous, ongoing security awareness and specialized training.
• Immediately report any suspected security incidents, vulnerabilities, or policy violations.
• Act as custodians of VAULTFY.AI information assets, protecting them with the highest diligence.

4. Data Protection, Privacy, and Aggressive Minimization

4.1. Granular Data Classification

All information assets are classified with granular detail based on their sensitivity and criticality (e.g., Public, Internal, Confidential, Restricted, Top Secret). Access controls and protection measures are meticulously applied according to this classification, with a bias towards the highest level of protection.

4.2. End-to-End Data Encryption

• Data at Rest: All sensitive client data, financial records, proprietary code, and system configurations are encrypted at rest using FIPS 140-2 validated modules and AES-256 or stronger algorithms.
• Data in Transit: All data transmitted over internal and external networks is encrypted using TLS 1.3 or stronger protocols, with perfect forward secrecy (PFS) enforced.

4.3. Data Minimization and Immutable Retention

We implement aggressive data minimization strategies, collecting and retaining only the absolute minimum personal data necessary for the provision of the Service and for strict compliance with legal and regulatory obligations. Data retention periods are immutably defined and enforced, with secure deletion or anonymization upon expiry.

5. Advanced Access Control and Identity Management

5.1. Zero Trust Architecture

VAULTFY.AI operates on a Zero Trust security model, where no user or device is inherently trusted, regardless of their location. All access requests are authenticated, authorized, and continuously validated.

5.2. Multi-Factor Authentication (MFA) and Biometrics

MFA is mandatory for all internal systems, administrative access, and client access to sensitive features. Biometric authentication is integrated where appropriate for enhanced client security.

5.3. Principle of Least Privilege and Just-in-Time Access

Access to information systems and data is strictly granted based on the principle of least privilege and, where feasible, Just-in-Time (JIT) access, ensuring temporary permissions for specific tasks.

5.4. Privileged Access Management (PAM)

Robust PAM solutions are deployed to control, monitor, and audit all privileged accounts and activities, preventing unauthorized elevation of privileges.

6. Network, System, and Cloud Security

6.1. Micro-Segmentation and Software-Defined Networking (SDN)

Our network infrastructure utilizes micro-segmentation and SDN to isolate critical systems and data at the workload level, dramatically limiting the blast radius of any potential security breaches.

6.2. Advanced Threat Protection (ATP)

Next-generation firewalls (NGFW), Intrusion Detection/Prevention Systems (IDPS), and Security Information and Event Management (SIEM) systems are deployed for continuous monitoring, threat detection, and automated response to malicious activities.

6.3. Continuous Vulnerability Management and Red Teaming

• Automated Scans: Continuous, automated vulnerability scans and rigorous penetration tests are conducted on all systems and applications by independent, CREST-certified third parties.
• Red Team Exercises: Regular red team exercises simulate real-world attacks to identify and remediate weaknesses in defenses.
• Patch Management: A highly automated and prioritized patch management process ensures all systems are updated with the latest security patches within defined SLAs.

6.4. Cloud Security Posture Management (CSPM)

For cloud-native infrastructure, CSPM tools are utilized for continuous monitoring of security configurations, compliance, and threat detection.

7. Application Security (ALFRED AI and Platform)

7.1. Secure by Design and Secure Development Lifecycle (SDLC)

Security is architected into every phase of Our software development lifecycle, from threat modeling and secure coding practices to automated security testing and deployment.

7.2. Automated Code Review and Advanced Testing

All code undergoes rigorous automated (SAST, DAST, IAST) and manual security reviews and penetration testing to identify and remediate vulnerabilities before deployment.

7.3. API Security Gateway

Our APIs are protected by an advanced API Security Gateway, enforcing granular authentication (e.g., OAuth 2.0, mTLS), authorization, rate-limiting, and threat protection mechanisms.

7.4. AI Security Governance (ALFRED AI)

• Prompt Injection Protection: Robust controls are implemented to prevent prompt injection attacks and ensure ALFRED AI operates within defined parameters.
• Model Integrity: Continuous monitoring and validation of ALFRED AI models to prevent data poisoning, model drift, and unauthorized manipulation.
• Secure Data Handling: Strict protocols for data used in AI training and inference, ensuring privacy and confidentiality.

8. Incident Response, Business Continuity, and Disaster Recovery

8.1. Cyber Incident Response Plan (CIRP)

A comprehensive, Board-approved Cyber Incident Response Plan (CIRP) is in place, covering detection, analysis, containment, eradication, recovery, and post-incident review. The CIRP is regularly tested through tabletop exercises and live simulations.

8.2. Business Continuity (BC) and Disaster Recovery (DR)

Robust BC and DR plans are maintained and tested regularly to ensure the continuous availability and resilience of the Service. Critical data is backed up to geographically dispersed, encrypted, and immutable storage.

9. Third-Party Security Management and Supply Chain Risk

9.1. Rigorous Vendor Due Diligence

All third-party service providers (e.g., cloud providers, API partners, payment processors, KYC/AML providers) undergo an exhaustive security due diligence process, including security questionnaires, audits, and certifications (e.g., SOC 2 Type II, ISO 27001).

9.2. Contractual Security Requirements

Contracts with third parties include stringent security clauses, Data Protection Agreements (DPAs), and Service Level Agreements (SLAs) that mandate adherence to VAULTFY.AI's security standards and regulatory obligations.

9.3. Continuous Monitoring of Third-Party Risk

Third-party security posture is continuously monitored, and regular reviews are conducted to ensure ongoing compliance and risk mitigation.

10. Compliance, Audit, and Regulatory Engagement

10.1. Multi-Jurisdictional Regulatory Compliance

VAULTFY.AI maintains unwavering compliance with all relevant regulations, including UK GDPR, FCA guidelines, and continuously monitors the evolving regulatory landscape for FinTech, digital assets, and travel.

10.2. Independent Third-Party Audits and Certifications

Independent third-party audits (e.g., SOC 2 Type II, ISO 27001) are conducted periodically to assess the effectiveness of Our ISMS and ensure compliance with this Policy and external standards.

10.3. Proactive Regulatory Engagement

We maintain proactive engagement with regulatory bodies to ensure Our security practices remain at the forefront of compliance and best practice.

11. Policy Review and Continuous Improvement

This Security Policy will be reviewed at least annually, or more frequently as required by changes in technology, business operations, regulatory requirements, or the threat landscape. Our ISMS is subject to continuous improvement based on internal and external audit findings, risk assessments, and emerging threats.

12. Contact Information and CISO

For any questions regarding this Security Policy or to report a security incident, please contact Our Chief Information Security Officer at: