MurrCloud Information Security Policy

1. Scope

This policy applies to the MurrCloud ERP platform and every system, person and service provider that stores, processes or transmits customer data, including:

• The MurrCloud cloud platform, its applications and integrations, including bank connectivity, ecommerce and payment integrations
• Production infrastructure, databases and backups
• Source code, development and deployment systems
• Company devices and business applications
• MurrCloud employees, contractors and subprocessors

2. Security governance

MurrCloud's Information Security Officer owns this policy and the security program. Responsibilities include approving access to sensitive data, overseeing risk assessments, leading incident response, and reviewing the program at least once a year.

Every employee and contractor must follow this policy, complete security training, and report suspected security issues immediately. Exceptions require documented approval, compensating controls and an expiry date.

3. Risk management

MurrCloud identifies, assesses, treats and monitors security risks through a documented risk management process.

• We maintain an inventory of systems, data and service providers.
• Risks are rated by likelihood and impact, assigned an owner, and tracked to resolution in a risk register.
• The register is reviewed quarterly, and a full risk assessment is performed at least annually and after significant changes such as new integrations, infrastructure changes or security incidents.

4. Access control

Access to systems and customer data follows the principles of least privilege and need-to-know.

• Every user has a unique account; shared accounts are not permitted.
• Multi-factor authentication is required for administrative access, source code, cloud infrastructure and business systems, and is available to all customer users.
• Role-based permissions limit access to financial and banking data to authorized users.
• Access is approved before it is granted, removed promptly when no longer needed, and reviewed quarterly.
• Administrative access uses encrypted channels only.

5. Data protection and encryption

Customer data is classified by sensitivity and protected accordingly. Financial account data, banking credentials, access tokens and secrets receive our highest level of protection.

• In transit: all connections use TLS 1.2 or higher.
• At rest: production databases, file storage and backups are encrypted.
• Secrets and keys: stored in restricted, encrypted locations, never in source code, and rotated periodically and immediately if exposure is suspected.
• Bank connectivity: customers connect bank accounts through regulated third-party providers such as Plaid. MurrCloud never sees or stores customers' online-banking usernames or passwords. Access tokens are encrypted, used only on our servers, and revoked when a connection is removed.
• Non-production environments never contain real customer financial data.
• We use customer data only to provide and support the MurrCloud service.

6. Data retention and deletion

MurrCloud keeps customer data only as long as needed to provide the service or meet legal obligations, and deletes it on a defined schedule.

• When an agreement ends, customers may export their data before it is deleted. We can provide confirmation of deletion on request.
• Deletion is automated where possible, logged, and checked regularly.
• Data under a legal or regulatory hold is kept until the hold is released.
• Individuals may request access to or deletion of their personal information by emailing contact@murrcloud.com. We respond within 30 days, or sooner where applicable privacy law requires.

7. Infrastructure and application security

• Servers are hardened before going live, with unused services disabled, firewalls limited to required ports, and key-based administrative access.
• Production, staging and development are separate environments with separate credentials.
• All code is kept in version control. Changes to production are reviewed, tested and deployed through a documented process with a rollback plan.
• Developers follow secure coding practices based on the OWASP Top 10, including access-rights checks, input validation and keeping secrets out of code.

8. Vulnerability management

MurrCloud scans for vulnerabilities on a regular schedule and fixes them within deadlines based on severity.

• Operating systems, platform software and dependencies are patched regularly.
• Code dependencies are scanned automatically, and internet-facing systems are scanned periodically.
• Independent security testing is performed periodically.
• Software that is nearing end of life is tracked and upgraded or replaced before support ends.

9. Logging and monitoring

• Security-relevant events are logged and retained for up to 12 months. These include sign-ins, administrative changes, access to sensitive financial data, and deployments.
• Logs never contain passwords, access tokens or full account numbers.
• Automated alerts flag suspicious activity, such as repeated failed sign-ins or unexpected administrative changes, and these are reviewed promptly.
• Platform availability is monitored around the clock.

10. Incident response

MurrCloud has a documented incident response plan that is tested at least once a year.

1. Detect and report: suspected incidents are escalated to the Information Security Officer immediately.
2. Triage: each incident is assessed and assigned a severity.
3. Contain: affected systems are isolated, and exposed credentials and access tokens are revoked.
4. Recover: the cause is removed, systems are restored from clean backups, and integrity is verified.
5. Notify: affected customers, partners and regulators are notified without undue delay and as required by law and contract.
6. Learn: a post-incident review identifies the root cause and the improvements needed.

11. Third-party service providers

MurrCloud assesses every service provider that handles customer data before using it, and reviews key providers each year.

• We review each provider's security evidence, such as SOC 2 or ISO 27001 reports, along with where it stores data, how it encrypts data, and how it notifies customers of breaches.
• Contracts require confidentiality, data protection, prompt breach notification, and return or deletion of data at the end of the relationship.

12. Business continuity and backups

• Production data is backed up daily, encrypted, and stored separately from production systems.
• We test restoring from backups regularly.
• Recovery objectives: data loss of no more than 24 hours (RPO) and service restored within 8 hours (RTO) for the core platform.

13. Personnel security

• Before they get access, employees and contractors sign confidentiality agreements and acknowledge this policy. Where the law allows, they are also screened.
• Security awareness training is completed at onboarding and every year after.
• Company devices use full-disk encryption, automatic updates, screen locks and malware protection, and are scanned for vulnerabilities.
• Remote access over untrusted networks uses a secure VPN.
• Lost devices are reported immediately and wiped remotely where possible.

14. Shared responsibility

Security is a shared effort. MurrCloud secures the platform, and customers are responsible for:

• Turning on multi-factor authentication and using strong, unique passwords
• Granting users only the permissions they need, and removing access when staff leave
• Protecting their own devices and networks
• Reporting suspected unauthorized access to MurrCloud promptly

15. Reporting a security issue

16. Policy review and contact

This policy is reviewed at least once a year and updated as our services, risks and legal requirements change. The current version is always published on this page.

Questions about this policy or how we protect your data: contact@murrcloud.com

MurrCloud Inc.
Last updated November 5, 2026