Information Security Policy

Security Compliance

Cadence OneFive is SOC 2 Type 2 certified, demonstrating our commitment to maintaining robust security controls for data protection, availability, and confidentiality. Our security policies are designed to meet and exceed these industry standards.

This document is a preamble to all policies in this folder.

Purpose

The purpose of this Information Security Policy Manual is to provide a comprehensive framework for:

• Protecting the confidentiality, integrity, and availability of Cadence OneFive information assets and information resources.
• Protecting Cadence OneFive, its employees, and its clients from illicit use of Cadence OneFive information assets and information resources.
• Ensuring the effectiveness of information security controls over information assets and information resources that support Cadence OneFive operations.
• Recognizing the highly networked nature of the current computing environment and providing effective company-wide management and oversight of those related information security risks.
• Providing for development and maintenance of minimum controls required to protect Cadence OneFive’s information assets and information resources.
• Ensuring that regular review of this manual is conducted at minimum annually or more frequently as needed.

Scope

These policies, procedures, standards, and guidelines apply to all employees, contractors, subcontractors, consultants, temporaries, guests, and third parties that use Cadence OneFive information assets or information resources. All information assets and information resources used by and in support of Cadence OneFive business operations must comply with the provisions of this policy.

Responsibility

Responsibility for the policies contained in this manual are as follows:

• The Cadence OneFive Head of Platform, François Huet, is ultimately responsible for the policies contained within this manual and approval thereof.
• The Head of Platform will inform all staff members of these policies upon initial approval as well as upon revision.
• All employees are responsible for reporting any violation of policy to the Head of Platform.
• The CEO and Head of Platform are responsible for the enforcement of Cadence OneFive policies and procedures.
• All Cadence OneFive employees are responsible for adherence to the policies contained within this manual.

Policy

Employee Awareness and Acceptance

It is Cadence OneFive policy to inform and educate employees on the importance of maintaining a secure environment and abiding by the policies as set forth in this manual. All employees must participate in Information Security Awareness Training upon hire and annually thereafter. Training on these policies and procedures, as well as additional safeguards selected by Cadence OneFive Management, are to be presented. All employees must sign a Cadence OneFive Information Security Policy Manual Acknowledgement prior to gaining unattended physical or logical access to Cadence OneFive confidential information.

Policy Review

• This policy will be reviewed annually and updated as necessary to reflect changes in technology, business needs, or regulatory requirements.
• Last reviewed/updated: 2026-08-25