Policy on Information Security

Summary and purpose of the document

This document is the Information Security Policy of SQUAKE.earth GmbH (SQUAKE), Brunnenstraße 19-21, 10119 Berlin.

It represents binding rules for us, the employees of SQUAKE, with regards to:

‍

• the context in which we operate with our company and to what extent information security plays a role in this;
• what information security policy we are pursuing together;
• which interested parties have which requirements for the information security we provide;
• which information security targets we therefore define as binding for us;
• the scope of our information security management system (ISMS) – i.e., where and in which activities we comply with all information security regulations in a binding manner;
• what roles and responsibilities we have for information security;
• which regulations we have established to achieve our information security goals and meet the requirements of ISO 27001.

Information Security Policy

We consider information security to be an essential value that we want to offer. Much depends on the information security (confidentiality, integrity and availability) of information processed by our solutions. The market is strictly regulated, security and trust are highest good. As a tech organization, IS is a strategic component, we need to provide big players that are our clients.

‍

We express this through the following voluntary commitment:

‍

1. We are committed to complying with all legal information security regulations and those contractually stipulated by clients and partners, and to using information provided by authorities and other organizations to continuously improve information security.
2. We train all employees who perform activities in the scope of information security in such a way that they can act safely and consciously in terms of information security.
3. We create the necessary technical and organizational conditions that enable us to live information security.
4. We want to achieve that information security is not understood by all of us as “annoying extra work”, but as important and essential for clients, strategy and ultimately success. We must turn on our heads and not rely on the fact that following the established rules is sufficient in every situation. If we are faced with the choice of making something really secure or following a rule, we prefer to make it really secure – and adjust the rule if necessary.
5. We want to get better and better in our information security!
   ‍

We provide resources and an information security management system according to the international norm ISO/IEC 27001:2022 for the above.

‍

‍

Improving our information security‍

We improve our information security using an overall approach which works as follows:

‍

1. We plan improvements by means of identifying and managing risks, corrective and preventive actions and identifying in a planned manner to incidents and events.
2. We do improve by implementing what we planned in step 1.
3. We check if our improvements do what they are supposed to do by effectiveness checks on what we implemented, internal audits and measurements of our information security objective KPIs.
4. We act on the results of the checks and based on this, continue with step 1.

‍

‍

Interested parties‍

Based on our context, we have the following parties interested in information security:

‍

‍

‍

‍

* Upon building and expanding our services, we closely work together with external contractors and service providers. Internally set rules need to be applied by them, in order for us to credibly vouch for it. The table highlights the expectations from them to us. SQUAKE takes all needs and expectations seriously and addresses them.

‍

‍

Information Security Objectives‍

Derived from stakeholder interests, we have the following information security goals:

‍

1. Confidentiality: We strive to ensure that all information considered to constitute our offering, provided by others to use our offering, as well as derived from using our services is not disclosed to any unauthorized person.
2. We will measure this by counting how many incidents we suffer with effect on any stakeholder in which information has been improperly kept confidential and how many cases we discover ourselves during our internal acceptance tests before delivery. We aim for: less than 2 per year.
3. Integrity: We strive to ensure that all information processed through our software solution is secured against unauthorized and accidental modification/falsification during processing.
4. We will measure this by how many incidents get reported where information has been or could be changed without authorization and how many cases we discover ourselves after roll-out. We aim for: less than 2 per year.
5. Availability: In ****the development, operation and hosting of the services constituting our digital platform, we strive to ensure that the application is available at all times.
6. We will measure this by whether we manage to achieve an API uptime of 99.9%.

‍

‍

Scope‍

Derived from the information security objectives defined above, the scope of our information security management system is:

‍

‍

Adjacent services are constantly extended and enhanced over time. They can be static or dynamic. For now, they include (but are not limited to):

‍

• Information material for the compensation projects we sell which can be used by clients for marketing and communication purposes
• API code snippets to facilitate implementation
• The tracking of according API activities via the client dashboard
• A trust page to track the forthgoing of the project a client has invested in
• Send-out of confirmation documents to clients that substantiate the transaction
• The settlement of any service transaction on client side
• The settlement of any service transaction on supply side

‍

Roles, responsibilities, and communication‍

Essential roles in the scope of our information security management system are:

‍

‍

‍

All other roles and responsibilities result from the individual processes.

Communication on the topic of information security takes place at SQUAKE as follows:

‍

1. externally: In order to learn about changing requirements for information security topics from external stakeholders in a timely manner, client-facing teams, Product and Operations are in constant contact with them. SQUAKE actively inquires about requirements and communicate information security issues (e.g., risks or incidents) to them as necessary.
2. internally: The Chief Information Security Officer (CISO) keeps the topic of information security communicated internally at SQUAKE and is accessible to all employees. Through training and awareness campaigns, “consultation hours”, Notion posts, brief information in staff meetings, and other similar means, they keep the topic of information security in the conversation.

‍

All other communications are described in more detail in the process descriptions or SQUAKE’s ISMS.

‍

Rules‍

The requirements of ISO/IEC 27001:2022 are covered in this information security management system as follows:

‍