Certyze Security and Data Hosting Notice

1. Purpose and Scope

This Security and Data Hosting Notice describes the security measures, data hosting arrangements, and operational practices applicable to the Certyze application provided by Thinkdata Labs LLP (the “Provider”). It is intended for Conformity Assessment Bodies (“CABs”) and other stakeholders evaluating the Provider’s approach to data protection, infrastructure hosting, and information security. This notice is informational and should be read together with the applicable contractual agreements between the Provider and each CAB.

2. Provider Information

The Certyze application is provided by the following entity (the “Provider”):

3. Definitions

The following capitalised terms have the meanings set out below when used in this Notice.

4. Data Hosting and Residency

The Certyze application, which runs on Amazon Lightsail, and each CAB’s separate Amazon RDS database are hosted in the AWS Asia Pacific Mumbai region (ap-south-1). Production Customer Data and daily encrypted backups are configured to remain within India.

Certain AWS support and telemetry services may involve processing outside India. CAB production database content, however, remains configured in the Mumbai region at all times.

5. Multi-Database Architecture

5.1 Each CAB is provisioned a separate database within a multi-database architecture. This design provides logical separation of Customer Data so that one CAB’s data is not accessible to another CAB.

5.2 Application code and certain infrastructure components (such as web servers and application services) may be shared across CABs. The separate database per CAB ensures that Customer Data remains isolated at the data-storage layer, notwithstanding any shared application or infrastructure resources.

6. Security Controls

The Provider has implemented the following technical and organisational controls within the Production Environment:

7. Access Management and Support Access

7.1 Provider personnel access to Customer Data is restricted to authorised individuals operating on a need-to-know basis. All access by Provider personnel is logged.

7.2 Role-based access control governs permissions for both CAB users and Provider administrators. Each user is assigned a role that determines the scope of data and functionality available to that user.

7.3 MFA is mandatory for all Provider administrators and for all CAB users.

8. Availability and Resilience

The Provider maintains availability and resilience measures for the Certyze Production Environment, including daily encrypted backups and use of AWS infrastructure capabilities within the ap-south-1 region.

Specific recovery time objectives, recovery point objectives, and uptime commitments are governed solely by the Master Software-as-a-Service Agreement between the Provider and each CAB. This notice does not establish, modify, or extend any such commitments.

9. Incident Handling and Notification

The Provider maintains procedures for identifying, investigating, and responding to security incidents affecting the Certyze Production Environment or Customer Data.

Where the Provider becomes aware of a personal data breach affecting a CAB’s Customer Data, the Provider will notify the affected CAB without undue delay after becoming aware of it. The notification will include, to the extent known at the time, a description of the incident, the categories of data affected, and remedial actions taken or planned.

Further notification terms are set out in the Data Processing Addendum and the Master Software-as-a-Service Agreement between the Provider and the CAB.

10. Certifications and Assurance

10.1 The Provider has identified ISO 27001 or SOC 2 Type II certification as a target for the Certyze platform. As of 19 October 2026, neither certification nor any equivalent third-party security attestation has been obtained.

10.2 No current third-party security certification or attestation is in effect with respect to the Certyze application or its supporting infrastructure. The Provider will update this notice and inform CABs when any such certification is achieved.

11. Customer Security Responsibilities

Each CAB is responsible for the following security obligations in connection with its use of Certyze:

12. Relationship to Contractual Agreements

12.1 This notice is provided for informational purposes only. Nothing in this notice creates, modifies, or supersedes any obligation or right under the Master Software-as-a-Service Agreement or any other contractual arrangement between the Provider and a CAB.

12.2 In the event of any inconsistency between this notice and the terms of an applicable contractual agreement, the contractual agreement shall govern.

13. Changes to This Notice

The Provider may update this notice from time to time to reflect changes in security practices, hosting arrangements, or applicable requirements.

Where material changes are made, the Provider will communicate updates to CABs through the Certyze application, email notification, or other reasonable means. The current version of this notice will be identified by its publication date, as set out in Section 15.

14. Security Contact

CABs and other stakeholders may direct vulnerability reports, security concerns, or questions regarding this Notice to the Provider at the following address: legal@thinkdatalabs.com.

The Provider will acknowledge receipt of security-related communications within a reasonable period and will handle reported matters in accordance with its incident handling and response practices described in Section 9 of this Notice.

15. Effective Date

This Security and Data Hosting Notice is effective as of 19 October 2026.

Version: 1.0, dated 19 October 2026.

All prior informal security disclosures relating to the Certyze application are superseded by this Notice as of the effective date, subject to Section 12 (Relationship to Contractual Agreements).