SECURITY POLICY

INTRODUCTION AND SECURITY COMMITMENT

Purpose of this Policy

URIGHTCOMPANY FINANCE LIMITED hereinafter — the "Company", "we", "us", or "our" — maintains this Security Policy to establish the principles, controls, and procedures used to protect customer information, financial transactions, payment infrastructure, virtual currency activity, internal systems, and digital services from unauthorized access, misuse, fraud, data breaches, cyber threats, operational disruption, and other security risks.

This Policy supports the Company's broader AML/CTF, KYC, sanctions, fraud prevention, privacy, and risk-management framework.

Security Commitment

The Company is committed to maintaining a secure and resilient technology environment appropriate to the nature of its activities as a Canadian Money Services Business and payment-related service provider.

The Company applies technical, organizational, administrative, and operational safeguards to protect:

• customer and business information;
• personal information and KYC records;
• payment and transaction data;
• virtual currency transaction information, where applicable;
• internal systems and infrastructure;
• access credentials and authentication mechanisms;
• logs, audit trails, and compliance records;
• communication channels and customer support systems.

Regulatory and Compliance Context

The Company designs and maintains its security framework in accordance with applicable legal, regulatory, and compliance requirements, including Canadian privacy requirements under the Personal Information Protection and Electronic Documents Act (PIPEDA), applicable AML/CTF obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), FINTRAC requirements, sanctions obligations, and relevant payment security expectations.

Where applicable, the Company also considers industry standards and best practices relating to payment security, data protection, cybersecurity, operational resilience, and fraud prevention.

SCOPE OF APPLICATION

Persons Covered

This Policy applies to:

• all directors, officers, employees, and management of the Company;
• temporary, fixed-term, and permanent staff;
• contractors, consultants, trainees, agents, and service providers;
• third parties acting under the responsibility or direction of the Company;
• any person with access to Company systems, customer information, payment infrastructure, or internal tools.

Systems and Data Covered

This Policy applies to:

• all Company information systems;
• customer portals and payment pages;
• internal administrative tools;
• payment processing infrastructure;
• transaction monitoring and fraud prevention systems;
• KYC, AML/CTF, and sanctions screening systems;
• databases, logs, backups, and archives;
• cloud infrastructure and third-party hosted environments;
• communication systems and customer support tools;
• endpoints, laptops, mobile devices, and workstations used for Company business.

Relationship with Other Policies

This Policy should be read together with the Company's Privacy Policy, AML/CTF Policy, KYC Policy, Sanctions Policy, Cookie Policy, Refund and Cancellation Policy, Terms and Conditions, and other applicable legal and compliance documents.

INFORMATION SECURITY PRINCIPLES

Confidentiality

The Company protects sensitive information from unauthorized access, disclosure, misuse, or exposure. Access to customer, transaction, compliance, and internal information is granted only to authorized personnel with a legitimate business, legal, compliance, security, or operational need.

Integrity

The Company maintains safeguards to protect information, systems, and transaction records from unauthorized alteration, destruction, manipulation, or corruption.

Integrity controls support accurate record keeping, transaction monitoring, regulatory reporting, audit trails, and customer protection.

Availability

The Company applies reasonable measures to ensure that critical systems, data, and services remain available and operational when required.

Availability controls include monitoring, backups, resilience planning, incident response, and continuity measures.

Accountability

Users with access to Company systems are responsible for safeguarding credentials, following security procedures, reporting suspicious activity, and using systems only for authorized purposes.

System access and activity may be logged, monitored, and reviewed for security, compliance, fraud prevention, and audit purposes.

GOVERNANCE AND SECURITY RESPONSIBILITIES

Security Governance

The Company maintains internal governance to oversee information security, cybersecurity, payment security, access management, incident response, and vendor security.

Security controls are supported by management oversight, documented procedures, periodic review, and risk-based monitoring.

Senior Management Responsibility

Senior management is responsible for supporting a strong security culture, allocating appropriate resources, and ensuring that security risks are considered in business, technology, compliance, and operational decisions.

Employee Responsibility

All employees and contractors must:

• comply with this Policy and related procedures;
• protect customer and Company information;
• use approved systems and secure channels;
• keep credentials confidential;
• report suspected security incidents immediately;
• complete required security training;
• avoid unauthorized access, disclosure, or use of information.

Compliance and Security Coordination

Security controls are coordinated with the Company's AML/CTF, KYC, sanctions, fraud prevention, privacy, and risk-management functions to ensure that security incidents, fraud indicators, unauthorized activity, and suspicious behavior are properly reviewed and escalated where necessary.

ACCESS CONTROLS

Role-Based Access

Access to Company systems and information is granted based on role, business need, and the principle of least privilege.

Personnel are granted only the level of access required to perform their duties.

Authentication Requirements

The Company requires appropriate authentication controls for access to sensitive systems, including:

• strong passwords;
• multi-factor authentication;
• secure credential storage;
• restricted administrator access;
• session controls and timeout mechanisms;
• periodic review of user access.

Access Review

Access rights are reviewed periodically and upon changes in role, department, employment status, contractual relationship, or business need.

Access must be promptly revoked or modified when an employee, contractor, or third party no longer requires access.

Privileged Access

Privileged and administrative access is strictly controlled, logged, and reviewed. Such access is granted only where necessary and may be subject to additional approval, monitoring, and security requirements.

Access Logging

Access to sensitive systems may be logged and monitored. Logs may include user identity, access time, system accessed, IP address, device information, actions performed, and changes made.

Logs are reviewed as part of security monitoring, fraud prevention, compliance controls, and audit processes.

DATA PROTECTION AND ENCRYPTION

Protection of Sensitive Data

The Company applies safeguards to protect sensitive information, including personal information, KYC records, transaction data, compliance records, payment data, security logs, and confidential business information.

Encryption in Transit

The Company uses secure communication protocols, including Transport Layer Security (TLS), where appropriate, to protect information transmitted through websites, portals, payment pages, internal systems, and external service connections.

Encryption at Rest

Sensitive data may be encrypted at rest using appropriate encryption standards where required by the nature of the data, system architecture, legal obligations, or risk profile.

Backups

The Company maintains secure backups of critical data and systems where appropriate. Backups may be encrypted, access-controlled, and stored in secure cloud or offsite environments.

Backup procedures are designed to support data recovery, business continuity, audit requirements, and operational resilience.

Data Minimization

The Company collects and retains information only as necessary for lawful business, compliance, regulatory, security, and operational purposes.

Where information is no longer required and retention is not required by law, the Company securely deletes, anonymizes, or disposes of it.

PAYMENT AND TRANSACTION SECURITY

Transaction Monitoring

The Company applies transaction monitoring and risk-based controls to detect suspicious, unusual, unauthorized, or fraudulent activity.

Monitoring may include:

• transaction value, volume, and frequency checks;
• velocity checks;
• unusual behavior detection;
• payment method consistency checks;
• device and IP consistency checks;
• merchant and beneficiary review;
• fraud indicators;
• sanctions and AML/CTF risk indicators.

Payment Security Controls

The Company applies payment security controls to protect payment flows, customer funds, and transaction integrity.

Such controls may include:

• secure payment pages;
• encrypted communication channels;
• tokenization where applicable;
• BIN-code verification;
• geo-consistency checks;
• transaction risk scoring;
• authorization checks;
• refund and withdrawal controls;
• closed-loop payment controls where applicable.

Card and Payment Data

The Company does not store full payment card details where tokenization or secure payment processing infrastructure is used.

Payment data is handled through secure systems and trusted payment processing arrangements designed to reduce exposure to unauthorized access and misuse.

Fraud Prevention

The Company uses fraud prevention controls to identify and prevent:

• account takeover;
• unauthorized transactions;
• synthetic identity use;
• stolen payment instruments;
• mule accounts;
• chargeback abuse;
• suspicious refund requests;
• automated bot activity;
• misuse of payment infrastructure.

Virtual Currency Transaction Security

Where the Company provides virtual currency-related services, it may apply additional security and Know Your Transaction controls, including:

• blockchain analytics;
• wallet address screening;
• source and destination risk checks;
• review of exposure to mixers, tumblers, darknet markets, ransomware, fraud, stolen assets, sanctioned wallets, or other illicit activity;
• enhanced scrutiny of unhosted or self-custodied wallets;
• rejection or escalation of high-risk transactions where appropriate.

DEVICE AND ENDPOINT SECURITY

Company Devices

Company devices used to access internal systems, customer information, payment infrastructure, or compliance tools must be protected by appropriate security controls.

Such controls may include:

• full-disk encryption;
• anti-malware and endpoint protection;
• firewalls;
• secure configuration standards;
• automatic screen locking;
• operating system and application updates;
• remote wipe capability for lost or stolen devices;
• restrictions on unauthorized software.

Personal Devices

Use of personal devices for Company business may be restricted or subject to approval. Where permitted, personal devices must comply with applicable security requirements.

Removable Media

Use of removable media, including USB devices, may be restricted, disabled, or subject to approval to reduce the risk of data loss, malware, or unauthorized transfer of information.

Lost or Stolen Devices

Lost, stolen, or compromised devices must be reported immediately. The Company may take actions such as remote wipe, credential reset, access revocation, incident investigation, or regulatory assessment where required.

NETWORK AND INFRASTRUCTURE SECURITY

Network Protection

The Company applies appropriate controls to protect networks, servers, applications, databases, and cloud infrastructure.

Such controls may include:

• firewalls;
• intrusion detection or prevention systems;
• network segmentation;
• secure configuration;
• monitoring of suspicious activity;
• restricted administrative access;
• vulnerability management;
• secure remote access controls.

Remote Access

Remote access to sensitive systems must be secured and limited to authorized users.

Remote access may require:

• multi-factor authentication;
• approved devices;
• secure encrypted connections;
• access logging;
• session monitoring;
• role-based permissions.

Cloud Security

Where cloud infrastructure or cloud-based services are used, the Company applies risk-based controls to protect data, systems, and access.

Cloud providers and cloud configurations may be reviewed for security, resilience, access controls, data protection, and compliance requirements.

Vulnerability Management

The Company may conduct vulnerability assessments, security reviews, patch management, penetration testing, or other technical evaluations based on risk and operational needs.

Identified vulnerabilities are assessed, prioritized, and remediated according to severity and business impact.

MONITORING, LOGGING, AND AUDIT TRAILS

Security Monitoring

The Company monitors systems, logs, alerts, and security events to detect unauthorized access, suspicious activity, fraud attempts, system misuse, and potential incidents.

Logs and Audit Trails

The Company maintains logs and audit trails for security, compliance, fraud prevention, operational, and regulatory purposes.

Logs may include:

• user access records;
• authentication events;
• system changes;
• transaction events;
• administrative actions;
• security alerts;
• failed login attempts;
• device and IP information;
• payment and transaction events;
• compliance-related actions.

Log Retention

Security and access logs are retained for a period appropriate to their purpose and risk level. Where logs relate to AML/CTF, KYC, transaction monitoring, regulatory reporting, or compliance records, they may be retained for at least five (5) years or longer where required or permitted by law.

Audit Review

Logs and security records may be reviewed by authorized personnel, compliance staff, internal reviewers, auditors, regulators, or competent authorities where required or permitted by law.

INCIDENT RESPONSE

Security Incident Definition

A security incident may include:

• unauthorized access to systems or data;
• suspected or confirmed data breach;
• malware or ransomware event;
• loss or theft of device or credentials;
• unauthorized transaction activity;
• account takeover;
• phishing or social engineering attack;
• misuse of internal systems;
• fraud or attempted fraud;
• compromise of payment or customer information;
• material disruption of systems or services.

Incident Reporting

Employees, contractors, and service providers must report suspected security incidents immediately through internal reporting channels or to the designated security or compliance contact.

Delays in reporting may increase risk to customers, systems, and regulatory compliance.

Incident Response Process

The Company's incident response process may include:

• identification and initial assessment;
• containment of the incident;
• preservation of evidence;
• investigation and root cause analysis;
• remediation and recovery;
• communication with affected parties where required;
• notification to regulators or authorities where required;
• review of controls and implementation of corrective measures.

Privacy Breach Notification

Where a privacy breach creates a real risk of significant harm or where notification is otherwise required by applicable law, the Company will take steps to notify affected individuals and relevant authorities in accordance with applicable privacy requirements, including PIPEDA where applicable.

Regulatory and Law Enforcement Reporting

Where an incident relates to money laundering, terrorist financing, sanctions evasion, fraud, unauthorized transactions, terrorist property, or other financial crime concerns, the matter may be escalated to the Compliance Officer / MLRO and reported to FINTRAC, law enforcement, or other competent authorities where required.

Non-Disclosure Restrictions

Where an incident is subject to AML/CTF, sanctions, fraud, regulatory, or law enforcement review, the Company may be restricted from disclosing certain information to customers or third parties.

THIRD-PARTY AND VENDOR SECURITY

Vendor Risk Management

The Company applies risk-based oversight to third-party service providers that support technology, payment processing, KYC, sanctions screening, fraud prevention, cloud hosting, customer support, analytics, security, compliance, or other critical functions.

Security Assessment

Before engaging or continuing a relationship with relevant third-party providers, the Company may assess:

• security controls;
• privacy and confidentiality practices;
• data protection safeguards;
• access control measures;
• incident response capabilities;
• regulatory and compliance posture;
• business continuity arrangements;
• subcontracting and cross-border data processing risks.

Contractual Protections

Third-party arrangements may include contractual provisions addressing:

• confidentiality;
• data protection;
• permitted use of information;
• security obligations;
• breach notification;
• audit or review rights;
• compliance with applicable laws;
• return or deletion of data upon termination.

No Outsourcing of Accountability

The Company may use third-party providers to support operations, but remains responsible for its legal, regulatory, AML/CTF, privacy, and security obligations.

EMPLOYEE TRAINING AND AWARENESS

Security Training

Employees and relevant contractors receive security awareness training appropriate to their role and access level.

Training may include:

• secure handling of customer information;
• phishing and social engineering awareness;
• password and authentication hygiene;
• data protection and confidentiality;
• secure use of devices and systems;
• incident reporting;
• fraud and account takeover indicators;
• AML/CTF and sanctions-related security risks;
• safe remote work practices.

Onboarding and Refresher Training

New employees must complete relevant security training during onboarding or before accessing sensitive systems.

Refresher training is provided periodically and may be updated when there are material changes in systems, threats, laws, policies, products, or procedures.

Confidentiality Obligations

Employees, contractors, and service providers with access to sensitive information are subject to confidentiality obligations and must not disclose customer, transaction, security, or compliance information except where authorized.

BUSINESS CONTINUITY AND RESILIENCE

Continuity Planning

The Company maintains reasonable business continuity and resilience measures to support the availability of critical systems and services in the event of disruption, system failure, cyber incident, vendor outage, or other operational event.

Backup and Recovery

The Company maintains backup and recovery procedures for critical information and systems where appropriate.

Recovery measures may be tested or reviewed periodically based on risk and operational requirements.

Operational Disruption

Where a material disruption affects services, the Company may take steps to protect customers, secure systems, preserve records, communicate with affected parties, and restore services in a controlled manner.

DATA RETENTION AND SECURE DISPOSAL

Retention

Security records, access logs, transaction records, KYC records, AML/CTF records, and related compliance information are retained in accordance with applicable laws, regulatory obligations, internal procedures, and business needs.

Where records are required for AML/CTF, KYC, sanctions, transaction monitoring, reporting, or audit purposes, they may be retained for at least five (5) years or longer where required or permitted by law.

Secure Disposal

When information is no longer required, the Company securely deletes, anonymizes, archives, or disposes of it in a manner designed to prevent unauthorized access, recovery, or misuse, unless continued retention is required or permitted by law.

POLICY VIOLATIONS

Non-Compliance

Failure to comply with this Policy may create legal, regulatory, operational, security, and reputational risks for the Company.

Internal Consequences

Employees, contractors, or representatives who fail to comply with this Policy or related procedures may be subject to disciplinary action, including access restriction, termination of employment or contract, and referral to competent authorities where appropriate.

Reporting Concerns

Employees and contractors are expected to promptly report suspected security weaknesses, policy violations, unauthorized access, data exposure, fraud indicators, or suspicious activity.

Good-faith reporting of security or compliance concerns is supported by the Company.

POLICY REVIEW AND CONTACT INFORMATION

Periodic Review

This Policy is reviewed at least annually or upon significant changes in systems, regulations, threats, products, services, business operations, technology, or the Company's risk profile.

Updates

The Company may update this Policy from time to time. The latest version will be published on the Company's website with a revised effective date.

Contact Information

For security-related inquiries or to report a suspected security issue, please contact:

• Email: [email protected]
• Address: 1 - 4903 54 STREET, LLOYDMINSTER, SASKATCHEWAN, CANADA, S9V 0N6
• Regulatory Reference: FINTRAC MSB Registration #C100000462