Information Security Policy

Revised 10 September 2026

eBase Solutions, Inc. protects the confidentiality, integrity and availability of information used in its business and entrusted to it by clients, personnel and business partners. This policy describes the security principles that guide our operations and services.

Scope

This policy applies to eBase Solutions, Inc. personnel, contractors, information systems and information assets. An affiliate may adopt this policy for its own operations. Client contracts and system-specific security requirements may impose additional obligations.

Governance and risk management

Management assigns responsibility for information security and reviews the security program periodically. We assess security risks based on the sensitivity of the information, the systems and services involved, contractual requirements and reasonably foreseeable threats. We select and review controls in proportion to those risks.

Security principles

Legal and contractual compliance. We address applicable information-security, privacy and contractual requirements in the jurisdictions where we operate.

Access control. We limit access to information and systems according to job responsibilities and business need. Access should be authorized, attributable to an individual where practicable, reviewed periodically and removed when no longer needed.

Data protection and client separation. We use technical and organizational measures intended to prevent unauthorized access, use, alteration or disclosure. We separate client information logically or through other appropriate controls. We do not use client information to train a publicly available artificial-intelligence model unless the client expressly authorizes that use in writing.

People. Personnel with access to company or client information are subject to confidentiality obligations and receive security guidance appropriate to their roles. Suspected security incidents must be reported promptly.

Suppliers. We consider security and confidentiality risks when selecting and overseeing vendors that handle information on our behalf, and we use contractual protections appropriate to the service and risk.

Security measures

Depending on the system, service and risk, our security measures may include:

• Encryption or other protections for information in transit and at rest
• Network, endpoint and cloud security controls
• Authentication, account management and least-privilege access
• Logging, monitoring and review for sensitive systems
• Vulnerability management, security updates and change control
• Backups, restoration procedures and continuity planning
• Physical safeguards for facilities, equipment and records
• Retention and secure disposal procedures

Incident response

We maintain processes to report, assess, contain, investigate and recover from suspected information-security incidents. We preserve relevant evidence, take corrective action and notify clients, individuals or regulators when required by contract or applicable law.

Business continuity

We plan for disruptions that could affect important services and maintain recovery arrangements appropriate to service requirements. We review or test relevant recovery procedures periodically and revise them when business or technology changes warrant.

Japanese affiliate certification

The eBase Solutions website states that eBase Solutions KK and eBase Solutions Laboratory hold PrivacyMark certification in Japan. PrivacyMark concerns personal-information protection by the certified Japanese entities; it is not a certification of eBase Solutions, Inc. or of every information-security control described in this policy.

Review and improvement

We review this policy periodically and when material changes to our business, technology, risk environment or legal obligations warrant. We address identified weaknesses and update controls as appropriate.

Contact

Security questions and vulnerability reports may be sent to:

eBase Solutions, Inc.
Attn: Information Security
6754 Bernal Avenue, Ste 740110
Pleasanton, CA 94566, USA
info@ebase-solutions.com

Do not include passwords, personal information, exploit code or other sensitive material in the initial email. We will provide a more appropriate communication method if needed.