Cybersecurity Incident Disclosure Policy

Status: Pre-listing governance baseline; specified reporting triggers (e.g., Form 8-K Item 1.05) take effect upon listing.

0) Corporate structure and scope

Tanqory PTE. LTD. (Singapore, UEN 202448997H) is the ultimate parent and holding company of the Tanqory group, including its wholly-owned subsidiaries Tanqory Inc. (Delaware, USA) and Tanqory OÜ (Estonia). Tanqory Inc. is the contracting entity and merchant of record for every product and service Tanqory sells to merchants and customers worldwide — Tanqory PTE. LTD. itself does not contract with, bill, or hold a direct customer relationship with any merchant or customer. This document is adopted by Tanqory PTE. LTD. as the group's holding company and applies group-wide, including to Tanqory Inc.'s and Tanqory OÜ's operations, unless a section below states a narrower scope.

1) Purpose

This policy governs how TANQORY PTE. LTD. and its wholly-owned subsidiaries Tanqory OÜ and Tanqory Inc. (together, the "Group") identify, escalate, assess for materiality, document, and disclose cybersecurity incidents to regulators, data subjects, customers, investors, and the public. It is designed to (a) satisfy the Group's existing obligations under GDPR Articles 33–34, Singapore PDPA Part VIA, and (for in-scope EU operations of Tanqory OÜ) Directive (EU) 2022/2555 ("NIS2"); and (b) establish a documented practice that, upon any future SEC registration and Nasdaq listing, will satisfy the cybersecurity disclosure obligations of Regulation S-K Item 106 and Form 8-K Item 1.05.

The Form 8-K Item 1.05 four-business-day disclosure obligation does not currently apply to the Group. It is adopted by analogy as a target practice so that the Group's escalation, assessment, and communication processes are calibrated to public-company expectations from the outset.

2) Scope

This policy applies to:

(a) all systems, applications, networks, endpoints, cloud environments, and data assets operated by, or on behalf of, any Group entity, including production, staging, and corporate IT;

(b) all personnel, contractors, and agents of any Group entity;

(c) all third-party service providers handling Group data or operating Group systems, to the extent governed by the Third-Party Risk Management Policy; and

(d) any cybersecurity incident or series of related incidents affecting (a), (b), or (c), regardless of root cause (malicious attack, error, misconfiguration, or supply-chain compromise).

3) Definitions

3.1 "Cybersecurity Incident" means an unauthorized occurrence, or series of related unauthorized occurrences, on or conducted through the Group's information systems that jeopardizes the confidentiality, integrity, or availability of the Group's information systems or any information residing therein. This definition is aligned with the SEC's definition in 17 CFR §229.106(a).

3.2 "Material Cybersecurity Incident" means a Cybersecurity Incident as to which there is a substantial likelihood that a reasonable investor would consider information about the incident important in making an investment decision, or as to which the disclosure of the incident would be viewed by a reasonable investor as having significantly altered the total mix of information available. Materiality is determined under §6.

3.3 "Personal Data Breach" has the meaning given in GDPR Article 4(12): a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. For Singapore, "Notifiable Data Breach" has the meaning given in §26B PDPA.

3.4 "CISO" means the Chief Information Security Officer or, pending such appointment, the senior officer designated by management to lead information security and accountable for the Group's information-security program.

3.5 "Disclosure Committee" has the meaning given in the Regulation FD Policy.

4) Detection and triage

4.1 Sources of detection. Incidents may be identified through internal monitoring (SIEM, EDR, cloud-native security telemetry), employee or contractor reports, customer reports, the Bug Bounty Program (see trust-and-security/bug-bounty-policy.md), the Vulnerability Disclosure Program (see trust-and-security/vulnerability-disclosure.md), third-party threat intelligence, regulator inquiries, or law-enforcement contact.

4.2 Initial triage. The Security function performs initial triage upon detection, in accordance with the Incident Response Plan (see trust-and-security/incident-response-plan.md). Triage outputs include (a) preliminary classification (suspected vs. confirmed incident), (b) initial severity rating, (c) systems and data potentially affected, and (d) preliminary scope of personal data involvement.

4.3 Containment first. Containment and evidence preservation actions are not delayed pending materiality assessment. Materiality assessment under §6 runs in parallel with technical response.

4.4 Single source of truth. Each incident receives a unique tracking identifier and is recorded in the incident-response case management system of record from triage through closure, as designated by the senior officer responsible for information security.

5) Reporting cascade

5.1 First-hour notifications. Upon confirmation of a Cybersecurity Incident, the on-call security responder notifies:

(a) the CISO (or designated alternate);

(b) the Data Protection Officer (or, for Tanqory OÜ in its capacity as GDPR Article 27 representative, the EU privacy contact);

(c) the General Counsel; and

(d) the CTO or Head of Engineering for the affected system.

5.2 Disclosure Committee. The CISO escalates to the Disclosure Committee (CEO, CFO, General Counsel, Head of Investor Relations) within twenty-four (24) hours of incident confirmation, or sooner if the preliminary assessment suggests potential materiality, regulatory notification, or customer notification.

5.3 Board notification. The General Counsel notifies the Chair of the Audit Committee promptly upon Disclosure Committee determination that an incident is, or is reasonably likely to be, material. The full Board is notified at the next regularly scheduled meeting, or sooner if circumstances warrant.

5.4 Cross-entity notification. For incidents affecting multiple Group entities, each entity's designated officer is notified concurrently so that local regulatory obligations are not delayed.

6) Materiality assessment

6.1 Standard. Materiality is determined under the standard set out in §3.2 and SEC Staff Accounting Bulletin No. 99, considering both quantitative and qualitative factors.

6.2 Quantitative factors. Direct financial loss, costs of investigation and remediation, regulatory fines or assessments reasonably likely to be imposed, contractual penalties and customer indemnification exposure, business interruption, and impact on revenue and key financial metrics.

6.3 Qualitative factors. Nature, scope, and duration of the incident; the data, systems, or business functions affected; impact on operations including any disruption of service to customers or business partners; impact on the Group's reputation and customer relationships; the possibility of litigation or regulatory action; harm to data subjects; impact on critical infrastructure or essential services within the meaning of NIS2; and the possibility of recurrence.

6.4 Aggregation. A series of related Cybersecurity Incidents is assessed in the aggregate. The fact that any single occurrence in a series is not, by itself, material does not preclude a materiality finding for the series.

6.5 Documentation. The Disclosure Committee documents its materiality determination, including the facts considered, the conclusion, and the date on which it was reached. The "date of materiality determination" is the date that starts the four-business-day clock under §7.3 upon listing.

7) Regulatory notification timelines

7.1 GDPR — 72 hours to supervisory authority. Where a Cybersecurity Incident constitutes a Personal Data Breach affecting personal data for which a Group entity is the controller, the relevant Group entity notifies the competent supervisory authority not later than 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons (GDPR Article 33(1)). Where the breach is likely to result in a high risk, affected data subjects are notified without undue delay (GDPR Article 34). Tanqory OÜ, in its capacity as GDPR Article 27 representative, coordinates supervisory-authority interaction in the EU.

7.2 Singapore PDPA — 3 calendar days. Where a Cybersecurity Incident constitutes a Notifiable Data Breach under §26B PDPA, TANQORY PTE. LTD. notifies the Personal Data Protection Commission as soon as practicable and in any case not later than 3 calendar days after the day it makes the assessment that the breach is notifiable, and notifies affected individuals as soon as practicable on or after notifying the Commission, in each case in accordance with §§26C and 26D PDPA.

7.3 SEC Form 8-K Item 1.05 — four business days (upon listing). From and after the date the Group becomes subject to the reporting requirements of §13 or §15(d) of the Exchange Act, the Group files a Form 8-K under Item 1.05 within four business days of determining that a Cybersecurity Incident is material, describing the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the Group, including its financial condition and results of operations. Disclosure may be delayed only in the limited circumstances permitted by Item 1.05 (including a determination by the U.S. Attorney General that disclosure would pose a substantial risk to national security or public safety, communicated in writing to the SEC).

7.4 NIS2 (where applicable to Tanqory OÜ). Where Tanqory OÜ is an in-scope "essential" or "important" entity under NIS2 and the relevant Estonian transposition, an early warning is issued to the competent CSIRT or competent authority within 24 hours of awareness of a significant incident, an incident notification within 72 hours, and a final report not later than one month thereafter, consistent with Article 23 of NIS2 as transposed in Estonian law. The Company will assess and document, on a risk-based basis, whether and when Tanqory OÜ falls within NIS2 scope as an "essential" or "important" entity, and will apply these obligations to the extent it does.

7.5 Other jurisdictions. Where notification is required under U.S. state breach-notification laws (for Tanqory Inc.), HIPAA, GLBA, FTC Health Breach Notification Rule, Canadian PIPEDA, UK GDPR, or any other applicable law, the General Counsel coordinates with local counsel to meet the applicable timeline.

8) Customer and data-subject notification

8.1 Contractual notice. Customer notification timelines required by the Group's customer contracts (typically 48–72 hours, subject to specific MSA terms) are tracked alongside regulatory timelines and met by the General Counsel and Customer Success in coordination with Security.

8.2 Form. Customer and data-subject notifications include, to the extent then known and consistent with the requirements of the applicable law: the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the incident and mitigate adverse effects, and a contact point for further information.

8.3 No premature disclosure. Notifications are not issued before the Disclosure Committee, in consultation with external counsel, is satisfied that the disclosure (a) is accurate to the extent then known, (b) will not impair an ongoing law-enforcement investigation, and (c) will not, in itself, create additional security exposure.

9) Forensics and evidence preservation

9.1 Forensic readiness. Security maintains evidence-preservation procedures consistent with ISO/IEC 27037 and the Incident Response Plan, including logging, image capture, and chain-of-custody documentation.

9.2 Legal hold. Upon escalation under §5.2, the General Counsel issues a legal hold covering all documents, communications, and electronic records relating to the incident.

9.3 Privilege. Forensic work intended to be protected by attorney-client privilege or work-product doctrine is engaged through, and directed by, outside counsel.

10) External counsel and breach-response vendors

The Group will engage qualified incident-response counsel and forensic providers so that response can begin without delay, including outside counsel for U.S. breach response, outside counsel for EU/GDPR matters, a digital-forensics and incident-response (DFIR) provider, and breach-notification mailing and contact-center support, engaging these providers on a pre-positioned or as-needed basis appropriate to its risk profile.

11) Insurance notification

The Company maintains (or is procuring) cyber-insurance coverage appropriate to its risk profile. Where such coverage is in place, the carrier is notified in accordance with the terms of the policy promptly upon escalation under §5.2, and the General Counsel maintains the notification template and the carrier and broker contacts.

12) Annual risk-management and governance disclosure (upon listing)

Upon listing, the Group's annual report on Form 10-K (or Form 20-F, if applicable) will include, under Regulation S-K Item 106:

(a) a description of the Group's processes for assessing, identifying, and managing material risks from cybersecurity threats, including whether and how such processes have been integrated into the Group's overall risk-management system;

(b) a description of whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Group;

(c) a description of the Board's oversight of cybersecurity risk, including identification of any committee responsible for such oversight (the Audit Committee per the Audit Committee Charter); and

(d) a description of management's role in assessing and managing material cybersecurity risks, including identification of the position(s) responsible (the CISO) and the relevant expertise of such position(s).

13) Tabletop exercises and continuous improvement

13.1 Tabletop cadence. The Group conducts tabletop exercises that simulate a material cybersecurity incident, including the materiality-assessment and disclosure workflow described in this policy. The Company will conduct these exercises periodically, on a risk-based basis and no less than annually, increasing to semi-annual upon a public listing.

13.2 Lessons learned. After each actual incident and each tabletop, the CISO produces a written after-action report. Material findings are tracked to closure and reported to the Audit Committee at its next regularly scheduled meeting.

14) Cross-references

This policy is read together with:

• trust-and-security/incident-response-plan.md — operational response runbook;
• trust-and-security/bug-bounty-policy.md — coordinated researcher reporting channel;
• trust-and-security/vulnerability-disclosure.md — non-bounty disclosure intake;
• trust-and-security/security-overview.md — Group-wide control posture;
• trust-and-security/access-control-policy.md;
• trust-and-security/encryption-policy.md;
• trust-and-security/network-security-policy.md;
• trust-and-security/business-continuity-plan.md and disaster-recovery-policy.md;
• trust-and-security/third-party-risk-management.md;
• governance/audit-committee-charter.md;
• governance/regulation-fd-policy.md.

In the event of any conflict between this policy and an operational runbook, this policy controls with respect to disclosure timing and content; the runbook controls with respect to operational containment and recovery steps.

15) Recordkeeping

Incident records, materiality-assessment memoranda, regulatory notifications, customer notifications, and after-action reports are retained for the longer of (a) seven (7) years from the date of incident closure or (b) the period required by the Document Retention Policy and applicable law.

16) Annual review and adoption note

This policy is reviewed at least annually by the Disclosure Committee in consultation with the CISO and the General Counsel, and amendments are recommended to the Board. The next scheduled review date is 28 May 2027.

Adoption note. The Group's notification obligations under GDPR Articles 33–34 and Singapore PDPA Part VIA, and (where applicable) NIS2, are effective immediately. The four-business-day Form 8-K Item 1.05 obligation and the Regulation S-K Item 106 annual-disclosure obligation take effect upon any registration of the Group's securities with the SEC, without further Board action. Group-wide notification practices, escalation cascades, and tabletop expectations under this policy are effective immediately as a pre-listing governance baseline.