Corporate Governance Portal

At Fobisoft Solutions Ltd., information security is a fundamental business commitment that underpins every solution we develop, every customer we support and every technology platform we operate. Protecting information is not simply a technical obligation; it is an essential part of maintaining the confidence entrusted to us by healthcare institutions, commercial organisations, partners and every individual whose information we process.

We recognise that information is one of the most valuable assets owned by any organisation. Our responsibility is therefore to ensure that such information remains protected against unauthorised access, disclosure, alteration, destruction or loss while remaining available to authorised users whenever it is legitimately required.

This Information Security Policy establishes the principles, governance framework and minimum security requirements that guide the protection of Fobisoft's information assets, customer information, intellectual property and supporting technology infrastructure across the organisation.

Information security is embedded throughout our software development lifecycle, operational procedures and customer support activities. Through continual improvement, responsible governance and secure engineering practices, we remain committed to safeguarding information today while preparing for the evolving security challenges of tomorrow.

Fobisoft preserves the principles of Confidentiality, Integrity, Availability, Accountability and Resilience.

Security controls are embedded throughout the software lifecycle rather than added after development.

Fobisoft recognises information assets as critical business resources requiring appropriate protection throughout their lifecycle.

Fobisoft Solutions Ltd. adopts a proactive approach to identifying, assessing, mitigating and continuously monitoring information security risks that may affect the confidentiality, integrity or availability of company and customer information assets.

Security risks are managed through a combination of employee awareness, technical safeguards, operational procedures and resilient recovery capabilities. Risk management forms part of everyday business operations and software development activities rather than being treated as a standalone function.

Fobisoft Solutions Ltd. implements Identity and Access Management (IAM) controls to ensure that only authenticated and authorised individuals are granted access to information systems, software platforms and information assets. Access permissions are assigned strictly according to business responsibilities and the principle of least privilege.

Customer user accounts and security privileges within Hospitum, FobiPoS and other licensed platforms are administered exclusively by authorised Client System Administrators. Access rights are reviewed periodically and must be updated promptly whenever personnel roles, responsibilities or employment status change.

Fobisoft Solutions Ltd. employs industry-recognised cryptographic controls to safeguard the confidentiality, integrity and authenticity of information throughout its lifecycle. Cryptographic mechanisms are implemented to protect sensitive information against unauthorised disclosure, interception and tampering during storage, transmission and processing.

The organisation continuously reviews cryptographic technologies to ensure alignment with current industry recommendations and evolving security threats. Encryption standards are applied consistently across software platforms, cloud services, backup infrastructure and customer communications wherever sensitive information is processed.

Fobisoft Solutions Ltd. integrates information security throughout the Software Development Lifecycle (SDLC) for all software products, including Hospitum, FobiPoS, DauLabs and all Artificial Intelligence initiatives. Security is considered from project inception through deployment and ongoing maintenance to ensure that software is resilient against security threats while meeting business and regulatory requirements.

Every software release follows a structured development methodology that incorporates technical reviews, quality assurance and security validation before deployment into production environments. Security is treated as a continuous engineering activity rather than a final-stage verification exercise.

Fobisoft Solutions Ltd. acts as a trusted steward of customer information entrusted to the organisation during software implementation, technical support, maintenance and disaster recovery operations. Customer information is processed only for legitimate, authorised business purposes and in accordance with contractual, legal and regulatory obligations.

Customer information remains the property of the respective customer. Fobisoft processes such information solely to deliver agreed services, maintain software reliability, resolve technical issues and support secure business operations. Every employee, contractor and authorised representative is expected to handle customer information with the highest level of confidentiality and professional responsibility.

Fobisoft Solutions Ltd. supports remote working while maintaining the same level of information security expected within company-controlled environments. Employees, contractors and authorised personnel working remotely shall protect company and customer information by complying with approved security controls and operational procedures.

Remote access to company resources shall be permitted only from trusted devices using secure internet connectivity and company-approved Virtual Private Network (VPN) services. All remote users are responsible for ensuring that their working environment prevents unauthorised access to confidential information.

Fobisoft Solutions Ltd. protects endpoint devices against unauthorised access, malware, data loss and other cybersecurity threats by implementing security controls appropriate to the organisation's operational environment. All company-managed devices accessing corporate or customer information shall comply with approved endpoint security requirements.

Endpoint security applies to desktops, laptops, development virtual machines and other authorised computing devices used by employees and contractors when performing company business. Devices failing to meet minimum security requirements may be denied access to company systems until compliance has been restored.

Fobisoft Solutions Ltd. maintains backup and disaster recovery capabilities to ensure the continued availability of business operations and customer information following equipment failure, cyber incidents, natural disasters or other disruptive events. Backup processes are designed to support timely restoration while protecting the confidentiality and integrity of backed-up data.

Customer database backups are generated in accordance with company backup procedures and securely transmitted to approved cloud infrastructure where they are encrypted and retained in accordance with the applicable Data Retention and Disposal Policy. Backup operations are continuously monitored to verify successful completion and identify operational failures requiring investigation.

Fobisoft Solutions Ltd. recognises that third-party service providers, consultants and contractors may require access to company or customer information while performing authorised business activities. Such access shall be carefully managed to ensure that security, confidentiality and privacy obligations remain equivalent to those expected of company personnel.

Access granted to external parties shall be limited to the minimum privileges necessary for the authorised assignment and shall remain valid only for the duration of the approved engagement. Upon completion or termination of the engagement, all associated system access and credentials shall be revoked without unnecessary delay.

Fobisoft Solutions Ltd. recognises that informed personnel are one of the organisation's strongest security controls. Continuous security awareness helps reduce the likelihood of human error, social engineering attacks and accidental disclosure of sensitive information. Every authorised user is expected to understand and actively support the organisation's information security objectives.

Security awareness is an ongoing process rather than a one-time activity. Employees, contractors and other authorised users shall receive periodic training appropriate to their roles to ensure they remain aware of evolving cybersecurity threats, regulatory obligations and company security procedures.

Fobisoft Solutions Ltd. is committed to conducting its business in compliance with applicable laws, regulations, contractual obligations and recognised industry best practices. Information security controls shall be implemented and maintained to support compliance while protecting the confidentiality, integrity and availability of company and customer information.

Compliance activities form part of the organisation's governance framework and are supported through documented policies, operational procedures, periodic reviews and continual improvement initiatives. Where legal, contractual or regulatory requirements evolve, Fobisoft shall review and update its security practices to maintain ongoing compliance.

Fobisoft Solutions Ltd. recognises that exceptional business or operational circumstances may occasionally require temporary deviations from the requirements of this Information Security Policy. Such exceptions shall be strictly controlled to ensure that any associated information security risks remain understood, documented and appropriately managed.

Policy exceptions shall be considered only where there is a legitimate business justification and where suitable alternative controls can be implemented to minimise any resulting security risks. Exceptions shall never be regarded as permanent changes to this policy.

Compliance with this Information Security Policy is mandatory for all employees, directors, contractors, consultants and other authorised users who access Fobisoft information systems or customer information. Failure to comply with this policy may expose the organisation and its customers to significant legal, operational and reputational risks.

All suspected policy violations shall be investigated fairly, consistently and in accordance with applicable employment, contractual and legal requirements. Corrective actions shall be proportionate to the nature, severity and impact of the violation, while taking into account whether the incident resulted from negligence, intentional misconduct or criminal activity.

The following definitions apply to Version 1.0 of this Information Security Policy. Unless otherwise stated, these terms shall be interpreted according to their commonly accepted information security meaning within the Fobisoft Information Security Governance Framework.

This document shall be maintained under the Fobisoft Information Security Governance Framework. All revisions shall be reviewed, approved and recorded to ensure that only the latest authorised version is used throughout the organisation.

This Information Security Policy forms the foundation of the Fobisoft Information Security Governance Framework and shall be read together with supporting governance policies, standards and operational procedures. These documents collectively establish the organisation's security, privacy and compliance requirements.