SECURITY POLICY

At Nexus Pay, operated by Nexus People L.L.C-FZ (“Nexus Pay”, “Nexus People”, “we”, “us”, or the “Company”), we recognize the importance of protecting workforce, payroll, operational, and employee-related information processed through our platform and related services.

This Security Policy outlines the administrative, technical, and organizational measures implemented to help protect Customer information against unauthorized access, misuse, loss, disclosure, or alteration.

Nexus Pay provides workforce administration and operational management services through digital platforms, web portals, mobile applications, and associated support systems (collectively, the “Services”).

---

1. INFRASTRUCTURE & HOSTING

Nexus Pay utilizes commercially recognized cloud infrastructure providers and hosting environments to support the delivery of Services.

Hosting environments may include cloud infrastructure providers such as Microsoft Azure or equivalent enterprise-grade hosting providers.

Data hosting and processing environments may be located within or outside the United Arab Emirates, including regions such as:

• UAE;
• Singapore;
• United States;
• or other operationally appropriate jurisdictions.

Hosting providers may maintain internationally recognized compliance and security standards including ISO-related certifications and infrastructure security controls.

2. DATA SECURITY MEASURES

Nexus Pay implements commercially reasonable safeguards designed to protect information during storage and transmission.

Security measures may include:

• encrypted communications;
• restricted system access;
• user authentication controls;
• activity logging;
• database protections;
• secure backup procedures;
• monitoring and vulnerability management practices.

Sensitive information transmitted between users and the Platform may be protected using industry-standard encrypted communication protocols.

3. ACCESS CONTROL

3.1 Customer Access Management

Customers are responsible for:

• managing user permissions;
• controlling administrator access;
• promptly revoking access for unauthorized or terminated users;
• maintaining confidentiality of credentials.

3.2 Internal Access Restrictions

Access to Customer information within Nexus Pay is restricted to authorized personnel who require such access for operational support, maintenance, customer assistance, security monitoring, or related legitimate business purposes.

Personnel handling sensitive operational information may be subject to confidentiality obligations and internal security procedures.

4. SYSTEM MONITORING & BACKUPS

Nexus Pay may utilize monitoring systems, logging tools, and operational alerts to:

• monitor system availability;
• identify technical issues;
• detect suspicious activities;
• maintain operational continuity.

Periodic backups may be maintained for disaster recovery and operational continuity purposes.

5. INCIDENT RESPONSE

Nexus Pay maintains internal procedures designed to address suspected security incidents or unauthorized access events.

Where a confirmed incident materially affects Customer information, Nexus Pay may notify affected Customers within a commercially reasonable timeframe, subject to:

• applicable laws;
• regulatory requirements;
• law enforcement restrictions;
• operational considerations.

Nexus Pay may take reasonable remedial measures including:

• investigation;
• temporary service restrictions;
• credential resets;
• security updates;
• system isolation measures.

6. VULNERABILITY MANAGEMENT

Nexus Pay may periodically:

• review system security;
• apply software and infrastructure updates;
• implement security patches;
• assess operational risks;
• improve internal security controls.

Security measures and operational procedures may evolve over time based on business, technical, operational, or regulatory requirements.

7. CUSTOMER SECURITY RESPONSIBILITIES

Customers and authorized users are responsible for:

• safeguarding login credentials;
• using secure devices and networks;
• maintaining updated antivirus and endpoint protections;
• reviewing access permissions regularly;
• protecting exported payroll or employee records;
• ensuring internal workforce confidentiality controls.

Nexus Pay shall not be responsible for security incidents resulting from:

• Customer negligence;
• credential sharing;
• compromised user devices;
• unauthorized third-party access;
• insecure Customer configurations.

8. LIMITATION OF SECURITY GUARANTEES

While Nexus Pay implements commercially reasonable security measures, no electronic platform, cloud infrastructure, or internet-based transmission can be guaranteed completely secure.

Accordingly, Nexus Pay does not guarantee:

• uninterrupted availability;
• absolute protection from cyber threats;
• prevention of all unauthorized access attempts;
• immunity from evolving security vulnerabilities or external attacks.

9. THIRD-PARTY SERVICES

The Services may rely on third-party infrastructure providers, communication providers, hosting environments, integrations, or external service partners.

Nexus Pay is not responsible for security practices or operational interruptions caused solely by third-party systems outside its direct operational control.

10. POLICY UPDATES

Nexus Pay reserves the right to update or modify this Security Policy from time to time to reflect:

• operational changes;
• evolving security practices;
• legal or regulatory developments;
• infrastructure updates.

Updated versions may be published through the Platform or communicated through appropriate channels.

11. CONTACT INFORMATION

For security-related inquiries or reports, please contact: