Trust Statement

This Trust Statement describes the general security, confidentiality and operational practices of PT. TRUSTGUARD PRO TRADE ("Company", "we", "us", "our") in connection with software development, implementation, integration, support, maintenance and related technology services.

This statement is provided for general informational purposes. Project-specific security, hosting, backup, audit, support, incident notification or compliance requirements are agreed separately in the applicable proposal, Statement of Work, service agreement or security addendum.

1. Our Role

The Company provides B2B software development and technology services.

The Company acts solely as a technology services provider. We do not provide banking, payment, e-money, investment, lending, crypto-asset, wallet, custody, remittance, acquiring, card issuing or other regulated financial services.

Where a client project involves regulated functionality, the client and/or its licensed providers remain responsible for all required licences, approvals, KYC/AML, sanctions screening, transaction monitoring, customer onboarding, customer disclosures and other regulated obligations.

2. Security Approach

The Company applies reasonable technical and organisational measures designed to protect client information, project materials, access credentials, source code and systems accessed in connection with our services.

Our approach may include:

• controlled access to client and project resources;
• access on a need-to-know basis;
• confidentiality obligations for personnel and contractors;
• secure handling of credentials, tokens and access keys;
• reasonable separation of development, testing and production environments where applicable;
• code review and testing practices appropriate to the project;
• incident escalation and client notification procedures;
• responsible use of third-party tools and service providers.

3. Access Control

Access to client systems, repositories, documents and environments is limited to personnel who require access for the agreed project.

Where supported by the relevant tools or platforms, we use access controls, user permissions and authentication measures to reduce the risk of unauthorised access.

Access may be reviewed, changed or removed when personnel roles change, project requirements change or the engagement ends.

4. Confidentiality

Personnel, contractors and service providers who may access client information are expected to maintain confidentiality and use such information only for the purpose of providing the agreed services.

Client information is not used for unrelated purposes without the client's permission.

5. Credentials and Client Access

Credentials, API keys, tokens, passwords and other access details provided by clients must be handled with care and used only for the agreed project.

Where possible, clients are encouraged to provide individual user accounts, limited permissions and temporary access rather than shared or permanent credentials.

Access to production systems should be limited and granted only where necessary for delivery, troubleshooting, deployment or support.

6. Software Development Practices

The Company follows practical software development practices appropriate to the nature and scope of each project.

These may include:

• project planning and documentation;
• source code management;
• peer review or code review where appropriate;
• testing before release;
• issue tracking and change management;
• use of reputable development tools and frameworks;
• reasonable review of third-party libraries and dependencies.

Specific development, testing, release, documentation or quality assurance requirements are agreed separately in the applicable project documents.

7. Data Protection

Where the Company processes personal data on behalf of a client, it does so only for the purpose of providing the agreed services and in accordance with the applicable agreement, Privacy Policy and Data Processing Agreement, where applicable.

The Company does not intentionally process sensitive personal data unless this is required for a specific project and agreed in writing with the client.

8. Backups and Recovery

Backup, recovery, disaster recovery, uptime and availability requirements depend on the hosting model, project architecture and client requirements.

Unless expressly agreed otherwise, project-specific backup schedules, retention periods, recovery time objectives, recovery point objectives and disaster recovery procedures are defined in the applicable Statement of Work, service agreement or hosting arrangement.

9. Incident Response

If the Company becomes aware of a security incident affecting client information or systems under its responsibility, it will take reasonable steps to assess, contain and address the incident.

Where the incident affects client data or client systems, the Company will notify the client without undue delay and cooperate reasonably with the client's investigation and remediation efforts.

The client remains responsible for regulatory notifications, customer notifications and other legal obligations unless otherwise agreed in writing.

10. Third-Party Providers

The Company may use third-party tools and service providers for hosting, development, communication, project management, analytics, security, backup, accounting or other business purposes.

The Company uses reputable providers and applies reasonable contractual or operational safeguards where third-party providers may process client data or personal data.

Use of specific hosting providers, cloud platforms, tools or subprocessors may be agreed separately with the client.

11. Client Responsibilities

Clients are responsible for:

• providing accurate project requirements;
• granting appropriate and limited access to systems;
• maintaining security of their own accounts, systems and environments;
• ensuring they have the right to provide data and materials to the Company;
• reviewing and testing deliverables before production use;
• complying with laws and regulations applicable to their business and users.

12. No Certification Claims

Unless expressly stated in writing, PT. TRUSTGUARD PRO TRADE does not claim to be certified under ISO 27001, SOC 2, PCI DSS or any other specific security certification.

The Company's controls are intended to be aligned with reasonable industry practices for software development and technology services, but project-specific compliance requirements must be agreed separately.

13. Contact

For security-related questions, please contact: