Zil Money is a financial technology company, not a bank or an FDIC member. Zil Money offers banking services through partnership with FDIC member banks Silicon Valley Bank and Texas National Bank.

INFORMATION SECURITY POLICIES & PROCEDURES

Updated February 15, 2024

PURPOSE

This Information Security Policies and Procedures (the “Policy”) of Zil Money Corporation (“Zil Money”, also referred to as the “Company”) is a set of rules by which those people who are given access to the Company’s technology, service platform, product, intellectual property, trade secret and non-public information constituting proprietary assets of the Company (hereinafter referred to “Secured Resources” or “Confidential Information”) must abide. The Policy provides a comprehensive framework for the protection of our technology, service platform, products, intellectual property, trade secrets, and non-public information.

The Policy serves several purposes. The main purpose is to inform the Company users: employees, contractors, agents, consultants, service providers and other authorized users of their obligatory requirements for strictly protecting the highly sensitive and confidentiality nature of the Secured Resources. The Policy describes the Secured Resources that all authorized users and whoever has access thereto must protect and identify many of the threats to such Secured Resources.

The Policy also describes the user’s responsibilities and privileges. It defined what is considered acceptable use; and what are the rules regarding Internet access. The Policy answers these questions, describes users’ limitations and informs users that there will be penalties for violation of the Policy. This document also contains procedures for responding to incidents that threaten the security of the Company’ computer network and cyber security system.

SCOPE – WHAT ARE WE PROTECTING

It is the obligation of all users of the Company systems to protect the Secured Resources of the Company. Secured Resources must be protected from unauthorized access, theft and destruction. The Secured Resources of the Company are made up of the following components:

(i) Computer hardware, CPU, disc, Email, web, application servers, PC systems, application software, system software, etc.

(ii) System Software including operating systems, database management systems, and backup and restore software, communications protocols, and so forth.

(iii) Application Software: used by the various departments within the company. This includes custom written software applications including those developed as products for customers, and commercial off the shelf software packages.

(iv) Communications Network hardware and software including routers, routing tables, hubs, modems, multiplexers, switches, firewalls, private lines, and associated network management software and tools.

COMPLIANCE WITH PARTNERS’ INFORMATION SECURITY REQUIREMENTS

Zil Money is dedicated to upholding the highest standards of information security in alignment with regulatory frameworks and contractual obligations. In strict adherence to international best practices, the Company is committed to compliance with the information security policies and procedures set forth by its service providers and bank partners. This commitment extends to the rigorous regulatory requirements embedded within the Master Service Agreements and other contractual documents governing the Company’s partnerships. In accordance with industry norms, Zil Money ensures that the information security measures implemented not only meet but often exceed the stipulations of these agreements. The Company views these partnerships as integral to its operations and recognizes the importance of harmonizing its security practices with the specified standards set by its esteemed partners.

CLASSIFICATION OF INFORMATION

User information found in computer system files and databases shall be classified as either confidential or non-confidential. The Company shall classify the information controlled by them. The CEO is required to review and approve the classification of the information and determine the appropriate level of security to best protect it. Furthermore, the CEO shall classify information controlled by units not administered by the CEO.

CLASSIFICATION OF COMPUTER SYSTEMS

LOCAL AREA NETWORK (LAN) CLASSIFICATIONS

A LAN will be classified by the systems directly connected to it. For example, if a LAN contains just one RED system and all network users will be subject to the same restrictions as RED systems users. A LAN will assume the Security Classification of the highest-level systems attached to it.

DEFINITIONS

Company. The term “Company” refers to Zil Money Corporation and its controlled entities.

Externally accessible to the public. The system may be accessed via the Internet by people outside of the Company without a logon id or password. The system may be accessed via dial-up connection without providing a logon id or password. It is possible to “ping” the system from the Internet. The system may or may not be behind a firewall. A public Web Server is an example of this type of system.

Non-Public, Externally accessible. Users of the system must have a valid logon id and password. The system must have at least one level of firewall protection between its network and the Internet. The system may be accessed via the Internet or the private Intranet. A private FTP server used to exchange files with business partners is an example of this type of system.

Internally accessible only. Users of the system must have a valid logon id and password. The system must have at least two levels of firewall protection between its network and the Internet. The system is not visible to Internet users. It may have a private Internet (non-translated) address and it does not respond to a “ping” from the Internet. A private intranet Web Server is an example of this type of system.

Chief Information Officer. The Director of the Department of Information Technology (IT) shall serve as the Chief Information Officer.

Security Administrator. An employee of IT shall be designated as the authorized Security Administrator for the Company.

THREATS TO SECURITY

1. Employees

One of the biggest security threats is employees. They may do damage to the Company systems either through incompetence or on purpose. The Company must layer its security to compensate for that as well. The Company must mitigate this by doing the following.

(a) Only give out appropriate rights to systems. Limit access to only business hours.

(b) Don’t share accounts to access systems. Never share your login information with co-workers.

(c) When employees are separated or disciplined, their access to the Company systems must be removed or limited.

(d) Advanced – Keep detailed system logs on all computer activity.

(e) Physically secure computer assets, so that only staff with appropriate needs can access.

2. Amateur Hackers and Vandals.

These people are the most common type of attackers on the Internet. The probability of attack is extremely high and there is also likely to be a large number of attacks. These are usually crimes of opportunity. These amateur hackers are scanning the Internet and looking for well-known security holes that have not been plugged. Web servers and electronic mail are their favorite targets. Once they find a weakness they will exploit it to plant viruses, Trojan horses, or use the resources of your system for their own means. If they do not find an obvious weakness, they are likely to move on to an easier target.

3. Criminal Hackers and Saboteurs.

The probability of this type of attack is low, but not entirely unlikely given the amount of sensitive information contained in databases. The skill of these attackers is medium to high as they are likely to be trained in the use of the latest hacker tools. The attacks are well planned and are based on any weaknesses discovered that will allow a foothold into the network.

USER RESPONSIBILITIES

ACCEPTABLE USE

User accounts on the Company computer systems are to be used only for the business of the Company and not to be used for personal activities. Unauthorized use of the system may be in violation of the law, constitutes theft and can be punishable by law. Therefore, unauthorized use of the Company computing system and facilities may constitute grounds for either civil or criminal prosecution.

Users are personally responsible for protecting all confidential information used and/or stored on their accounts. This includes their logon IDs and passwords. Furthermore, they are prohibited from making unauthorized copies of such confidential information and/or distributing it to unauthorized persons outside of the Company.

Users shall not purposely engage in activity with the intent to: harass other users; degrade the performance of the system; divert system resources to their own use; or gain access to the Company’s systems for which they do not have authorization.

Users shall not attach unauthorized devices on their PCs or workstations, unless they have received specific authorization from the employees’ authorized manager and/or the Company’s designated and authorized IT officer.
Users shall not download unauthorized software from the Internet onto their PCs or workstations.

Users are required to report any weaknesses in the Company’s computer security, and any incidents of misuse or violation of this Policy to their immediate supervisor.

USE OF THE INTERNET

The Company will provide Internet access to employees and contractors who are connected to the internal network and who have a business need for this access. Employees and contractors must obtain permission from their supervisor and file a request with the Security Administrator.

The Internet is a business tool for the Company. It is to be used for business-related purposes such as: communicating via electronic mail with suppliers and business partners, obtaining useful business information and relevant technical and business topics.

The Internet service may not be used for transmitting, retrieving or storing any communications of a discriminatory or harassing nature or which are derogatory to any individual or group, obscene or pornographic, or defamatory or threatening in nature for “chain letters” or any other purpose which is illegal or for personal gain.

USER CLASSIFICATION

All users are expected to have knowledge of these security guidelines and are required to report violations to the Security Administrator. Furthermore, all users must conform to the acceptable use as determined within the parameters of this Policy. The Company has established the following user groups and defined the access privileges and responsibilities:

MONITORING USE OF COMPUTER SYSTEMS

The Company has the right and capability to monitor electronic information created and/or communicated by persons using the Company’s computer systems and networks, including e-mail messages and usage of the Internet. It is not the Company policy or intent to continuously monitor all computer usage by employees or other users of the Company’s computer systems and network. However, users of the systems should be aware that the Company may monitor usage, including, but not limited to, patterns of usage of the Internet (e.g. site accessed, on-line length, time of day access), and employees’ electronic files and messages to the extent necessary to ensure that the Internet and other electronic communications are being used in compliance with the law and with the Company’s policies including this Policy.

ACCESS CONTROL

A fundamental component of this Policy is controlling access to critical Secured Resources that require protection from unauthorized disclosure or modification. The fundamental meaning of access control is that permissions are assigned to individuals or systems that are authorized to access specific resources. Access controls exist at various layers of the system, including the network. Access control is implemented by logon ID and password. At the application and database level, other access control methods can be implemented to further restrict access. The application and database systems can limit the number of applications and databases available to users based on their job requirements.

USER SYSTEM AND NETWORK ACCESS – NORMAL USER IDENTIFICATION

All users will be required to have a unique logon ID and password for access to systems. The user’s password should be kept confidential and MUST NOT be shared with management & supervisory personnel and/or any other employee whatsoever. All users must comply with the following rules regarding the creation and maintenance of passwords:

• Password must not be found in any English or foreign dictionary. That is, do not use any common name, noun, verb, adverb, or adjective. These can be easily cracked using standard “hacker tools”.

• Passwords should not be posted on or near computer terminals or otherwise be readily accessible in the area of the terminal.

• Password must be changed every (90 days).

• User accounts will be frozen after five failed logon attempts.

• Logon IDs and passwords will be suspended after 30 days without use.

Users are not allowed to access password files on any network infrastructure component. Password files on servers will be monitored for access by unauthorized users. Copying, reading, deleting or modifying a password file on any computer system is prohibited.

Users will not be allowed to logon as a System Administrator. Users who need this level of access to production systems must request a Special Access account as outlined elsewhere in this document.

Employee Logon IDs and passwords will be deactivated as soon as possible if the employee is terminated, fired, suspended, placed on leave, or otherwise leaves the employment of the Company office.

Supervisors / Managers shall immediately and directly contact the Company’s authorized IT Manager to report a change in employee status that requires terminating or modifying employee logon access privileges.

Employees who forget their password must call the IT department to get a new password assigned to their account. The employee must identify himself/herself by (e.g. employee number) to the IT department.

Employees will be responsible for all transactions occurring during Logon sessions initiated by use of the employee’s password and ID. Employees shall not logon to a computer and then allow another individual to use the computer or otherwise share access to the computer systems.

SYSTEM ADMINISTRATOR ACCESS

System Administrators, network administrators, and security administrators will have (type of access) access to host systems, routers, hubs, and firewalls as required to fulfill the duties of their job.

All system administrator passwords will be DELETED immediately after any employee who has access to such passwords is terminated, fired, or otherwise leaves the employment of the Company.

SPECIAL ACCESS

Special access accounts are provided to individuals requiring temporary system administrator privileges in order to perform their job.  These accounts are monitored by the Company and require the permission of the Company’s designated and authorized IT Manager.  Monitoring of the special access accounts is done by entering the users into a specific area and periodically generating their reports to management.  The reports will show who currently has a special access account, for what reason, and when it will expire.  Special accounts will expire in 30 days and will not be automatically renewed without written permission.

CONNECTING TO THIRD-PARTY NETWORKS

This Policy is established to ensure a secure method of connectivity provided between the Company and all third-party companies and other entities required to electronically exchange information with the Company.

“Third-party” refers to vendors, consultants, independent service providers and business partners doing business with the Company, and other partners that have a need to exchange information with the Company.  Third-party network connections are to be used only by the designated and approved employees of the third-party, only for the business purposes of the Company.  The third party will ensure that only its authorized users will be allowed to access information on the Company’s network.  The third party will not allow Internet traffic or other private network traffic to flow into the network.  A third-party network connection is defined as one of the following connectivity options:

• A network connection will terminate on a Web Server and the third-party will be subject to standard authentication rules of the Company.

This Policy applies to all third-party connection requests and any existing third-party connections.  In cases where the existing third-party network connections do not meet the requirements outlined in this document, they will be re-designed as needed.

All requests for third-party connections must be made by submitting a written request and be approved by the Company.

CONNECTING DEVICES TO THE NETWORK

Only authorized devices may be connected to the Company network(s).  Authorized devices include PCs and workstations owned by the Company that comply with the configuration guidelines of the Company.  Other authorized devices include network infrastructure devices used for network management and monitoring.

Users shall not attach to the network: non-Company computers that are not authorized, owned and/or controlled by the Company.  Users are specifically prohibited from attaching (specify) to the Company network.

NOTE: Users are not authorized to attach any device that would alter the topology characteristics of the Network or any unauthorized storage devices, e.g., thumb drives and writable CD’s.

REMOTE ACCESS

Only authorized persons may remotely access the Company network. Remote access is provided to those employees, contractors and business partners of the Company that have a legitimate business need to exchange information, copy files or programs, or access computer applications.  Authorized connection can be remote PC to the network or a remote network to the Company network connection.  The only acceptable method of remotely connecting into the internal network is using a secure ID.

UNAUTHORIZED REMOTE ACCESS

The attachment of (e.g., hubs) to a user’s PC or workstation that is connected to the Company LAN is not allowed without the written permission of the Company. Additionally, users may not install personal software designed to provide remote control of the PC or workstation. This type of remote access bypasses the authorized highly secure methods of remote access and poses a threat to the security of the entire network.

PENALTY FOR SECURITY VIOLATION

The Company takes the issue of security violations seriously.  Those people who use the Secured Resources of the Company must be aware that they can be disciplined and penalized if they violate this Policy.  Upon violation of this Policy, an employee of the Company may be subject to discipline up to and including termination of employment.  The specific discipline imposed will be determined by a case-by-case basis, taking into consideration the nature and severity of the violation of this Policy, prior violations of this Policy or other policies by the individual, his/her violation of state and/or federal laws and all other relevant information.  Discipline which may be taken against an employee shall be administrated in accordance with any appropriate rules or policies and the Company’s Policy Manual.

In a case where the accused person is not an employee of the Company the matter shall be submitted to the CEO.  The CEO may refer the information to law enforcement agencies and/or prosecutors for consideration as to whether criminal charges should be filed against the alleged violator(s).

SECURITY INCIDENT HANDLING PROCEDURES

This section provides some guidelines and procedures for handling security incidents.  The term “security incident” is defined as any irregular or adverse event that threatens the security, integrity, or availability of Secured Resources on any part of the Company network.  Some examples of security incidents are:

• Illegal access of a Company computer system.  For example, a hacker logs onto a production server and copies the password file.
• Damage to a Company computer system or network caused by illegal access.  Releasing a virus or worm would be an example.
• Denial of service attack against a Company web server.  For example, a hacker initiates a flood of packets against a Web server designed to cause the system to crash.
• Malicious use of system resources to launch an attack against other computers outside of the Company network.  For example, the system administrator notices a connection to an unknown network and a strange process accumulating a lot of server time.

Employees, who believe their terminal or computer systems have been subjected to a security incident, or has otherwise been improperly accessed or used, should do the following:

• Report the situation to their Supervisor immediately.
• The employee shall not turn off the computer or delete suspicious files. Leaving the computer in the condition it was in when the security incident was discovered.
• Will assist in identifying the source of the problem and in determining the steps that should be taken to remedy the problem.

TRAINING

Integral to building a strong Compliance Program and fostering a lasting culture of compliance is the training of employees. Zil Money mandates role-specific training for all employees, affiliates, and service providers. Reports validating training completion will be furnished to service and bank partners as necessary. For in-depth information on training schedules and requirements, please consult the compliance training policies delineated in the ZIL MONEY CORPORATION COMPLIANCE TRAINING HANDBOOK.