# Information Security Policy

> Information security is a fundamental element of our service quality and customer trust.

Source: https://www.theleapers.co/en/information-security-policy

- Draft for Approval · Version 1.2
- Initial effective date: 01 January 2025
- Last review: 11 October 2026

ISO/IEC 27001 status: Leapers is currently working toward ISO/IEC 27001 Information Security Management System certification. Publication of this policy does not mean that the company is currently ISO/IEC 27001 certified.

## 1. Purpose and approach

- Leapers Eğitim Danışmanlık Teknoloji A.Ş. considers information security a fundamental element of service quality and customer trust. Our information security approach is based on protecting confidentiality, integrity and availability, systematically managing risks, and observing applicable legal, regulatory and contractual obligations.
- This public policy summarizes the principal commitments of our internal Information Security Policy. System architecture, risk registers, technical configurations, security testing details and internal control evidence are not disclosed publicly for security reasons.

## 2. Scope

- This policy covers the TAP platform provided by Leapers Eğitim Danışmanlık Teknoloji A.Ş., established in Türkiye, to customers globally, together with the software development, operation, maintenance, customer support, assessment and reporting processes that support TAP. TAP may be operated as SaaS in a region-specific cloud environment or in a customer-controlled on-premises/private environment according to customer and regional requirements. Personnel, devices, infrastructure and service providers that may affect TAP security are evaluated within our risk management approach regardless of deployment model.

## 3. Our core information security principles

- Limit access to information according to business need and authorization, and maintain privileges at the lowest level reasonably required.
- Process personal and corporate data in line with purpose limitation and data minimization principles.
- Maintain appropriate traceability for critical systems, access and changes in proportion to risk.
- Consider security and privacy from the design stage for new products, features, integrations and infrastructure changes.
- Continuously improve controls by learning from information security incidents, audit findings, technology changes and customer requirements.

## 4. Access and system security

- Access to administrative and production systems is restricted to authorized persons with a legitimate business need. Privileged access is protected through stronger controls, and permissions are updated or removed when roles change or access is no longer required.
- Secure configuration, patching, vulnerability management, appropriate encryption, logging and monitoring controls are applied to applications, servers, containers and related infrastructure components according to risk level.

## 5. Personal data and data residency

- Personal data is processed for purposes required by the service and in accordance with applicable data protection law. TAP supports a region-aware deployment model; the location of each production environment is determined with regard to applicable law, customer contract, data-residency requirements and risk assessment. In the Türkiye production environment, production personal data relating to customers and participants is processed and stored in Türkiye using the Amazon Web Services (AWS) Istanbul Local Zone. For other countries or regions, an approved AWS Region/Local Zone or a customer-controlled on-premises environment may be used. Where cross-region transfer or access is required, the relevant legal, contractual and security conditions are assessed separately.
- Customer and participant data is not used for general-purpose model training or for the development of third-party products unless there is a documented and approved purpose.

## 6. Artificial intelligence and secure product development

- AI components used within TAP are assessed together with information security, data minimization and human oversight principles. Before personal data is transferred to any external AI, transcription, analytics or similar service, the provider, data residency, confidentiality and contractual conditions are reviewed.
- AI outputs are used as decision support where appropriate to the service; where human evaluation is required, final decisions are not left solely to automated system output.

## 7. Cloud infrastructure, service providers and subprocessors

- Before engaging service providers that may access information or systems, Leapers evaluates, in proportion to risk, the scope of service, data-processing role, data residency, access, security commitments, incident notification and termination conditions. Required confidentiality and data-protection obligations are contractually safeguarded.
- Region-specific TAP SaaS deployments primarily use Amazon Web Services (AWS) cloud infrastructure services. AWS is certified against internationally recognized information security, cloud security and privacy standards including ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019 and ISO/IEC 27701:2019. These certifications relate to AWS's own information security management system, infrastructure and services within the applicable certification scope; they do not replace The Leapers' own ISO/IEC 27001 certification process. For on-premises deployments, the production infrastructure may operate within a customer-controlled environment and the allocation of responsibilities is defined for the specific engagement.
- Under the AWS shared responsibility model, The Leapers separately implements controls within its own responsibility for access management, network and application security, encryption, secure configuration, logging, backup, data residency, vulnerability management and incident response. AWS services and data flows used by TAP are subject to risk-based supplier and architecture reviews.

## 8. Business continuity and backup

- Backup, restoration and continuity requirements for critical information and services are determined according to business impact. Merely creating backups is not considered sufficient; recoverability and continuity controls are assessed on a planned basis.

## 9. Security incidents and personal data breaches

- Information security incidents are managed through defined processes covering detection, assessment, containment, preservation of records, remediation, recovery, communication and improvement. For personal data breaches, required notifications are coordinated according to Leapers' role in the relevant processing activity, customer contracts and applicable law.
- Security vulnerabilities or suspected incidents may be reported to security@theleapers.co.

## 10. Privacy and personal data requests

- For personal data and privacy matters, you may contact us at privacy@theleapers.co or kvkk@theleapers.co. Data-subject and customer requests are evaluated according to applicable law and the respective data-processing roles of the parties.

## 11. Review and continual improvement

- Our information security policy is reviewed at least annually and whenever there are significant changes to systems, the organization, applicable law, customer requirements, country/region or risk. Regional requirements are managed, where necessary, through policy supplements, contractual addenda, technical standards or control sets. Risk assessments, security testing, incidents and audit findings are used as inputs to continual improvement.

## 12. Contact

- Information security: security@theleapers.co
- Privacy: privacy@theleapers.co
- KVKK: kvkk@theleapers.co