Data Security Guide

1. Scope and General Principles

This Guide applies to all information that Users enter, upload, or generate through FaroNova's Services, including FaroMonitor and FaroPlanning.

FaroNova distinguishes the following main categories of User information based on their treatment:

• Conversations with the Conversational Assistant: The content of queries and responses is processed in real time and deleted immediately after generating the response (Zero Data Retention). FaroNova does not store, access, or review this content.

• Stored files: Documents uploaded by the User to the platform are stored with AES-256 encryption on Amazon S3 (server-side, keys managed by AWS). Only the User, through their authenticated account, can access their content.

• Client context for alert relevance analysis: the organization's profile, the description of the target functional area, and the topics declared as relevant are processed through an Enterprise AI Provider to determine whether a regulatory development is relevant to the User and with what priority, under no-training and confidentiality guarantees, with bounded retention by the provider (the detail of the categories processed is in Section 2 of this Guide and in the Privacy Notice).

Additionally, FaroNova securely stores User account data (name, email, organization, authentication credentials) and usage statistics with irreversibly pseudonymized identifiers, as described in the Privacy Notice.

Processing roles: FaroNova acts as data controller with respect to registration, authentication, support, billing, contact, and website browsing data. With respect to personal data contained in files, queries, projects, or documents uploaded by corporate clients for their own use, the client acts as data controller and FaroNova acts as data processor, acting solely under the client's instructions and for the provision of the Service.

2. AI Data Processing

FaroNova's Services use artificial intelligence to process information across various features. FaroNova relies on Enterprise AI Providers —corporate-grade artificial intelligence infrastructure providers— selected because they contractually meet the following minimum guarantees: (i) not using customer data to train, improve, or develop AI models; (ii) processing data solely to provide the Service, under a confidentiality obligation; (iii) operating under international transmission contracts pursuant to Law 1581 of 2012; and (iv) maintaining security measures equivalent to or higher than those required by said law. The identity of the current providers is published in the "Data Processors" section of the Privacy Notice and may be updated in accordance with the procedure described therein.

AI processing and its retention regime depend on the feature:

• Conversational Assistant (FaroMonitor): User queries and instructions are processed in real time under a Zero Data Retention policy (immediate deletion after generating the response). Conversation history is kept only in volatile memory during the active session and deleted when it ends (30-minute inactivity or process shutdown). No conversation content is persisted to any database, cache, or file system. Conversations from previous sessions cannot be retrieved.

• Automated alert relevance analysis: to determine whether a regulatory development is relevant to the User and with what priority, FaroNova processes, through an Enterprise AI Provider, the client context needed for that analysis: the organization's profile (sector, territories of operation, the authorities that regulate it, tax identification, and relevant counterparties), the description of the target functional area, the topics and tags declared as relevant by the organization, by the area, and by the User themselves, and the configured prioritization rules. This analysis is performed under the no-training and confidentiality guarantees described above. Unlike the Conversational Assistant, the provider for this analysis may retain the content transiently, for a limited period and for the sole purpose of security and abuse prevention, after which it is deleted (bounded retention). It is not used for model training.

• Public regulation enrichment: the analysis and summarization of official regulation from government sources is processed using AI. This activity does not involve personal data or private client context, as it operates exclusively on public documents.

General processing flow: (1) information is transmitted via encrypted connection (HTTPS/TLS) to the corresponding Enterprise AI Provider; (2) the provider processes the request and generates a result; (3) the result is delivered to the Service; (4) the content is deleted immediately (Conversational Assistant) or retained in a bounded manner by the provider for abuse-prevention purposes and then deleted (alert analysis).

Access to processed content: FaroNova does not access the content in the ordinary course of service provision; any exceptional access would require a legal or contractual basis and documented internal controls. Enterprise AI Providers do not access the content in the ordinary course of their operations, except for the automated and bounded security and abuse-prevention processes provided for in their terms. FaroNova does not persist the prompt or the full payload sent to the provider for alert analysis; the organization's profile and topics of interest are retained as Service configuration (see the Privacy Notice), and only the analysis result is retained: the relevance and priority classification, its score, the reasons or signals supporting it, and a brief explanation generated by the model.

Use for model training: in none of these features is customer data used to train, improve, or develop artificial intelligence models. This prohibition is contractual with each provider.

3. AI Image Generation

The scenario planning module (FaroPlanning) allows Users to generate illustrative images for strategic scenarios using artificial intelligence. These images are generated through Google Vertex AI (Gemini model), Google Cloud Platform's artificial intelligence service.

Processing flow:

1. The User requests the generation of an image for a planning scenario.

2. FaroPlanning builds a descriptive text prompt derived from the scenario narratives (general context descriptions, not the User's direct personal data).

3. The prompt is transmitted via encrypted connection (HTTPS/TLS) to Google Vertex AI.

4. Google Vertex AI generates the image and returns it to FaroPlanning.

5. The generated image is stored with AES-256 encryption on Amazon S3, with the same protection measures applicable to other stored files.

Data handling by Google:

• Google Cloud Platform operates under enterprise terms establishing that customer data is not used to train, improve, or develop artificial intelligence models.

• Google does not retain generation prompts or produced images beyond the time strictly necessary to complete the request.

• Access credentials for Google Vertex AI are securely stored in AWS Secrets Manager, not in source code.

Nature of transmitted data:

The prompts sent to Google Vertex AI are textual descriptions of strategic planning scenarios. They do not contain personally identifiable User data, but rather general descriptions of contexts and narratives that the User has drafted as part of their planning exercise.

4. Processing of Stored Files

Documents uploaded by the User to the platform (PDFs, text files, and other supported formats) are stored persistently for later consultation and use.

Protection measures:

• Encryption in transit: All file transfers are conducted via HTTPS/TLS protocol.

• Encryption at rest: Files are stored with AES-256 encryption on Amazon S3, using server-side encryption with AWS-managed keys (SSE-S3).

• Access control: Only the User, properly authenticated through AWS Cognito, can access the content of their files.

Access to file content:

• FaroNova: Does not access the content of User files in the ordinary course of service provision. Any exceptional access would require a legal or contractual basis and documented internal controls.

• Amazon Web Services: Stores encrypted files. Does not access their content in the ordinary course of operations.

• Unauthorized third parties: Without the authentication credentials and encryption keys managed by AWS, files are unreadable.

Retention period:

• During service term: Files remain stored until the User voluntarily deletes them.

• Post-termination: Unless the applicable commercial agreement provides for a different period, the User's files will remain available for export for thirty (30) calendar days following termination. After that period, they will be permanently deleted from all systems, including files, projects, usage statistics, and authentication account. The exceptions are: (a) a minimal legal audit record that does not contain User content, email, or personally identifiable information, retained solely for legal compliance with a defined expiration period; and (b) encrypted backups of the authentication infrastructure, retained for a limited period in accordance with FaroNova's disaster recovery practices and automatically deleted upon expiration of their retention cycle.

5. Usage Statistics

FaroNova collects aggregated statistics on Service usage for the sole purpose of improving its products. These statistics may include:

• Platform usage frequency.

• Most consulted modules or sections.

• General query volume.

• General navigation patterns.

• Session times.

Before storing these statistics, user identifiers are irreversibly pseudonymized using a one-way cryptographic hash function (SHA-256 with fixed salt). This means it is not possible to recover the User's identity from the stored data. The statistics do not include or allow identification of the specific content of User queries, files, or conversations.

Administrative reports aggregate statistics at the company level, not at the individual user level. No personal identifiers are exposed in any dashboard or report.

The collection of usage statistics requires the User's prior consent. The User may revoke this consent at any time from the platform settings, which will immediately stop event capture and trigger the deletion of the User's associated historical events. Pseudonymized analytics events are retained while the User maintains an active account with active analytics consent. Each Service may apply shorter automatic cleanup cycles (for example, deletion of individual events after thirty (30) days and aggregated data after ninety (90) days). In all cases, all analytics data is deleted upon revocation of analytics consent or deletion of the User's account.

FaroNova does not have access to the content of conversations with the Conversational Assistant or the content of files stored by the User.

6. Frequently Asked Questions

ABOUT SECURITY

Is the data stored on the platform vulnerable to attacks?

Risk is mitigated through the following measures:

• Conversations with the Conversational Assistant: There is no stored information that could be compromised, as content is deleted immediately after processing.

• Files: In the event of unauthorized access to storage servers, files are encrypted with AES-256 and are unreadable without the encryption keys managed by AWS.

How can this information be verified?

The security practices described are publicly documented by Amazon Web Services and by Google Cloud Platform. Reference links are provided in the Technical Documentation section at the end of this Guide.

ABOUT ARTIFICIAL INTELLIGENCE

Is User data used to train artificial intelligence models?

No. This prohibition is established contractually with Enterprise AI and infrastructure Providers. It applies to conversations with the Conversational Assistant, stored files, and the automated alert relevance analysis.

Do the Services include content moderation mechanisms?

The artificial intelligence models used by the Services incorporate built-in safety mechanisms that reject the generation of potentially harmful, illegal, or inappropriate content. This moderation is performed directly by the Enterprise AI Provider as part of processing each request. In features that operate under Zero Data Retention (such as the Conversational Assistant), FaroNova does not store either the rejected content or the detection details, as it occurs within the provider's infrastructure.

ABOUT PRIVACY

Can FaroNova access the content of User queries or files?

No. By technical design and contractual restriction, FaroNova does not have access to the content of conversations with the Conversational Assistant or the content of stored files. FaroNova can access aggregated and anonymized statistics on platform usage, but never the specific content of User queries, responses, or files.

Does FaroNova share User information with third parties?

FaroNova does not sell, share, or transfer the content of User conversations or files to third parties. The third parties involved in personal data processing are Enterprise AI and infrastructure Providers: Amazon Web Services (processing, storage, and Conversational Assistant artificial intelligence), Anthropic (Conversational Assistant AI models), and Google (illustrative image generation in FaroPlanning and automated alert relevance analysis in FaroMonitor). All process data exclusively for service delivery and under contractual obligations of confidentiality and no-training; each one's retention regime is detailed in the Privacy Notice. FaroNova may use additional operational service providers that process exclusively public information or operational Service data, without access to User personal data.

7. Data Subject Rights

In accordance with Law 1581 of 2012 and its Regulatory Decree 1377 of 2013, the data subject has the following rights:

• Know: Know, update, and rectify their personal data, and request proof of the authorization granted for processing.

• Rectify: Request the correction of partial, inaccurate, incomplete, or fragmented data.

• Delete: Request the deletion of their data when it is no longer necessary for the purpose for which it was collected, or when the subject revokes the authorization.

• Revoke: Revoke the authorization granted for the processing of their personal data.

• Opposition: Object to the processing of their data in the cases provided by law.

Additionally, as a contractual benefit, FaroNova offers:

• Portability: Request the delivery of their data in a structured, commonly used, and machine-readable format.

To exercise any of these rights, the data subject may contact FaroNova at privacidad@faronova.co or through the rights request form available on the Platform. Response times and detailed procedures are described in FaroNova's Privacy Notice.

8. Regulatory Framework and Certifications

FARONOVA REGULATORY COMPLIANCE

FaroNova complies with the following regulations in the processing of personal data:

• Political Constitution of Colombia, Article 15: Right to privacy, good name, and habeas data.

• Statutory Law 1581 of 2012: General Personal Data Protection Regime.

• Law 1266 of 2008: General provisions on habeas data, particularly financial, credit, commercial, and services data.

• Decree 1377 of 2013: Regulatory Decree of Law 1581 of 2012.

• Decree 1074 of 2015: Single Regulatory Decree for the Commerce, Industry, and Tourism Sector (Title 26, Chapter 25).

• GDPR: FaroNova adopts the standards of the European Union's General Data Protection Regulation as a reference for international best practices.

INFRASTRUCTURE CERTIFICATIONS

FaroNova operates primarily on Amazon Web Services (AWS) infrastructure and additionally uses Google Cloud Platform for certain artificial intelligence features (see Sections 2 and 3). AWS holds the following certifications granted by independent auditors, covering the computing, storage, and artificial intelligence services that run on its infrastructure:

• SOC 2: Security standard for cloud services, verified through independent audit.

• ISO 27001: International information security management standard.

• ISO 27018: Code of practice for the protection of personal data in the cloud.

Google Cloud Platform, used for the artificial intelligence features described in Sections 2 and 3, also holds SOC 2, ISO 27001, and ISO 27018 certifications granted by independent auditors.

The aforementioned certifications correspond to Amazon Web Services, Inc. and Google LLC, FaroNova's infrastructure providers. FaroNova does not hold these certifications independently as of the publication date of this Guide.

9. International Transfer and Data Location

Personal data processed by FaroNova is stored and processed on servers located in the United States of America, operated by Enterprise AI and infrastructure Providers. The current providers are:

• Amazon Web Services, Inc.: storage, processing, authentication, and artificial intelligence (region us-east-1, Virginia).

• Google LLC (Google Cloud Platform / Google Vertex AI): artificial intelligence for illustrative image generation in FaroPlanning and, as planned under this version, for automated alert relevance analysis in FaroMonitor (region us-central1, Iowa).

The complete and up-to-date list of data processors, with details of the processing and retention regime of each, is published in the "Data Processors" section of the Privacy Notice.

Data flows to these providers constitute international transmissions to data processors, conducted under Article 26, paragraph a) of Law 1581 of 2012 (express and unequivocal authorization of the data subject) and governed by transmission contracts pursuant to Article 2.2.2.25.5.2 of Decree 1074 of 2015. The United States of America is not included in the list of countries with an adequate level of protection issued by the SIC, which is why the transmission is based on the express authorization of the data subject.

For more details on international transmissions and data processors, please consult FaroNova's Privacy Notice.

10. Glossary

• AES-256: Advanced Encryption Standard with 256-bit key length. Encryption standard used by governments and financial institutions to protect classified information.

• Amazon Bedrock: Amazon Web Services' managed artificial intelligence service that runs language models. Operates under a Zero Data Retention policy for enterprise customers.

• Amazon S3: Amazon Web Services' object storage service used for encrypted file storage.

• Anthropic: Developer of Claude, the artificial intelligence model used by FaroNova through two channels: Anthropic direct API and Amazon Bedrock. Operates under a Zero Data Retention policy on both channels.

• Bounded retention: regime under which an Enterprise AI Provider retains processed content transiently, for a limited period and for the sole purpose of security and abuse prevention, after which it is deleted. For Google Vertex AI (the provider planned for alert analysis), that period is up to ninety (90) days, in the selected region, and logging is triggered only when automated safety classifiers detect suspicious activity. Unlike Zero Data Retention, it does not imply immediate deletion, but it does prohibit use for training and processing outside the purpose of the Service.

• Encryption at rest: Protection of stored data through cryptographic algorithms that render it unreadable without the corresponding decryption key.

• Encryption in transit: Protection of data during transmission between the User's device and the servers, via HTTPS/TLS protocols.

• Enterprise AI Provider: corporate-grade artificial intelligence infrastructure provider (for example, services such as Google Gemini, Microsoft Copilot, OpenAI ChatGPT, or enterprise-deployed open-source models) that FaroNova uses to process information, selected for contractually meeting the guarantees of no-training, confidentiality, international transmission under Law 1581, and security. The list of providers actually used is published in the Privacy Notice.

• Gemini: family of artificial intelligence models developed by Google, used through Google Vertex AI for illustrative image generation in FaroPlanning and for automated alert relevance analysis in FaroMonitor.

• Google Vertex AI: Google Cloud's artificial intelligence platform used by FaroNova as an Enterprise AI Provider for illustrative image generation (FaroPlanning) and automated alert relevance analysis (FaroMonitor).

• SSE-S3: Server-Side Encryption with Amazon S3-managed keys. Encryption method used for stored files.

• Zero Data Retention (ZDR): policy applicable to certain features (such as the Conversational Assistant) under which the AI provider deletes the content of queries and responses immediately after processing, without retaining it. Not all features operate under ZDR; some operate under bounded retention (see that entry).

11. Technical Reference Documentation

The information contained in this Guide may be verified in the public documentation of the infrastructure providers:

AMAZON WEB SERVICES

• Data protection in Amazon Bedrock: docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html

• Amazon Bedrock security and compliance: aws.amazon.com/bedrock/security-compliance/

• Encryption in Amazon S3: docs.aws.amazon.com/AmazonS3/latest/userguide/UsingEncryption.html

• AWS data privacy policy: aws.amazon.com/compliance/data-privacy-faq/

• AWS compliance programs: aws.amazon.com/compliance/programs/

GOOGLE CLOUD PLATFORM

• Data governance in Vertex AI: cloud.google.com/vertex-ai/docs/generative-ai/data-governance

• Google Cloud privacy commitments: cloud.google.com/privacy

• Google Cloud compliance certifications: cloud.google.com/compliance

For inquiries related to data security, contact FaroNova at privacidad@faronova.co.