Security Measures

1. Purpose and Scope

These Security Measures describe the principal technical and organisational controls maintained by DTS Services Ltd for the CyPay Platform. They form part of the contractual and data-protection framework referenced by the MSA and DPA. Controls may evolve as technology, infrastructure, risk and legal requirements change, provided the overall level of protection is not materially reduced.

2. Key Security Pillars

Identity and Access Control

User access is governed through unique credentials and role-based access controls (RBAC). Permissions are structured according to role and the principle of least privilege, with elevated permissions reserved for authorised administrative or super-user functions. Centralised audit and login information may be maintained to support accountability, troubleshooting and security monitoring.

Data Protection and Encryption

Data transmitted between authorised Client endpoints and the Platform is encrypted using modern TLS protocols over secure HTTPS connections. Application permissions and logical controls are used to support separation of Client environments and prevent unauthorised cross-client access.

Infrastructure and Resilience

Production infrastructure is hosted using enterprise-grade third-party cloud infrastructure within the European Economic Area (EEA). The hosting environment benefits from layered physical, operational and network security controls, availability measures, backup processes and maintenance procedures designed to support business continuity and recovery from contingency events.

3. Identity and Access Security

• Each authorised User is provided with, or creates, individual credentials. Shared credentials should be avoided where individual accounts are supported.
• Role-based permissions limit functions and access according to the User's assigned role, including administrator/super-user and standard-user roles where applicable.
• The Client controls allocation and removal of access for its Users and must promptly withdraw access when no longer needed.
• Login activity and relevant audit information may be recorded for security, support, troubleshooting and compliance. Unusual access patterns may trigger review or notification where technically enabled.

4. Transmission and Data Protection

• The Platform uses secure HTTPS connections with TLS encryption for data transmitted between authorised browsers and the Platform.
• Clients should access the Platform only through the correct CyPay / MyCyPay domain and verify the browser's secure HTTPS indication.
• Access to Client Data is restricted through application permissions and logical controls designed to prevent unauthorised access between separate Client environments.

5. Hosting, Network and Physical Security

• Production infrastructure is hosted in enterprise-grade data centres within the EEA through third-party cloud service providers.
• The hosting environment is protected through layered physical, operational and network security controls maintained by the relevant infrastructure provider.
• Network and infrastructure protections may include firewalls, access restrictions, monitoring, redundancy and other controls appropriate to the environment.
• DTS Services Ltd periodically reviews material hosting arrangements in light of operational, security and legal requirements.

6. Backup, Resilience and Business Continuity

• The Platform and relevant Client databases are subject to continuous or regular backup procedures, as technically configured, designed to support restoration after a contingency event.
• Backup and maintenance processes support service availability, disaster recovery and operational continuity.
• Backup retention, restoration and deletion are managed according to technical feasibility, security requirements, the MSA/DPA and applicable legal obligations.
• No backup or continuity arrangement can guarantee uninterrupted availability in every circumstance; the controls are designed to reduce the likelihood and impact of disruption.

7. Application and Operational Security

• Access to production systems and administrative functions is limited to authorised persons according to operational need and least-privilege principles.
• The Platform is maintained and updated to address security, reliability, performance and legal or regulatory requirements as appropriate.
• Security-relevant logs and system information may be used to investigate technical issues, suspicious activity or attempted unauthorised access.
• Reasonable malware, network and infrastructure protections are maintained through Platform controls, operational practices and third-party hosting controls.

8. Client Security Responsibilities

• use strong and unique passwords and keep credentials confidential;
• promptly remove or disable access for former employees, contractors or other Users who no longer require it;
• maintain reasonably secure endpoint devices, current supported browsers/operating systems and appropriate anti-malware protection;
• notify DTS Services Ltd without undue delay of suspected unauthorised access, credential compromise or other security concerns;
• avoid sending unnecessary sensitive payroll or employee information through insecure support or communication channels.

9. Security Limitations

No internet-based or cloud system can be guaranteed to be completely secure, continuously available, error-free or immune from unauthorised access. DTS Services Ltd maintains measures designed to reduce security risks, but effectiveness also depends on factors outside its control, including Client devices, Users, networks, credentials and instructions. These Security Measures do not constitute an absolute guarantee against every cyber incident, data loss, interruption or unauthorised access.

10. Relationship with Other Legal Documents

These Security Measures must be read with the MSA and DPA. If there is a conflict concerning personal-data security, the DPA prevails; otherwise the MSA prevails. The Terms of Service provide operational user obligations consistent with these measures.

11. Version Control

Version 1.1. Revision date: 3 September 2026. Effective date: 3 September 2026. The Provider may revise these measures in accordance with the MSA and DPA, including to reflect changes in technology, infrastructure, security practices or legal requirements, provided the overall level of protection is not materially reduced.