Information Security Policy

ISMS-02 · Version 1.0 · Approved 2026-10-01 · Next review 2027-10-01

1. Statement of commitment

One Shot Ventures Pty Ltd, trading as VeroID, provides identity verification and screening services to Australian businesses. Our customers trust us with sensitive personal information and rely on our platform to meet their own legal obligations. Protecting the confidentiality, integrity and availability of that information is fundamental to our business and to the regulatory and contractual obligations under which we operate.

As Director, I am accountable for information security at VeroID. I commit to:

• maintaining an Information Security Management System (ISMS) that conforms to ISO/IEC 27001:2022 and to continually improving it;
• satisfying all applicable legal, regulatory and contractual requirements, including the Privacy Act 1988 (Cth), the Notifiable Data Breaches scheme and the DVS Gateway Service Provider Participation Agreement;
• providing the resources, time and tooling needed to operate the ISMS effectively;
• setting measurable information security objectives and reviewing progress against them at least annually; and
• ensuring that everyone who works for or with VeroID understands their security responsibilities.

2. Scope

This policy applies to all information assets, systems, people and suppliers within the scope of the VeroID ISMS as defined in the ISMS Scope and Context document. In summary, this covers the VeroID API, web applications, scheduled jobs, supporting cloud infrastructure in AWS (Sydney) and Vercel, the GitHub source repository, and the endpoint devices used to administer them.

3. Information security principles

1. Data minimisation. We collect and retain only the information required to deliver the service and meet our legal obligations. We do not store identity document images.
2. Australian data residency. Customer and verification data is processed and stored in AWS ap-southeast-2 (Sydney).
3. Least privilege. Access to systems and data is granted on a need-to-know basis, protected by multi-factor authentication wherever the service supports it, and reviewed regularly.
4. Defence in depth. Encryption in transit and at rest, network isolation, input validation, dependency vulnerability management and continuous monitoring operate together; no single control is relied upon.
5. Secure by design. Security requirements are considered at the start of every change. Infrastructure is defined as code and deployed through automated pipelines with separated test and production environments.
6. Prepared for incidents. We maintain and test incident response and business continuity plans, and we notify affected customers, the DVS Framework Administrator and regulators as required by law and contract.
7. Supplier assurance. We select suppliers with recognised security certifications, define security requirements in agreements and review them annually.
8. Accountability. Security-relevant actions are logged, roles are defined and compliance with this policy is audited.

4. Objectives framework

Information security objectives are set annually by the Director, documented in the Information Security Objectives document, and measured through the Monitoring and Measurement Plan. Objectives address, at minimum: vulnerability remediation timeliness, access control hygiene, service availability, incident readiness and supplier assurance.

5. Roles and responsibilities

The Director is the ISMS Owner and top management. All personnel, contractors and suppliers with access to VeroID systems are responsible for complying with this policy and the topic-specific policies that support it. Detailed responsibilities are set out in the ISMS Roles and Responsibilities document.

6. Topic-specific policies

This policy is supported by topic-specific policies covering access control, acceptable use, information classification, cryptography, change management, secure development, vulnerability management, logging and monitoring, incident response, business continuity, data retention, supplier management, privacy, security awareness, human resource security, endpoint and remote working, and network security. These are maintained in the ISMS document library and made available to all personnel.

7. Compliance and consequences

Compliance with this policy is mandatory. Non-compliance by personnel may result in disciplinary action under the HR Security Policy; non-compliance by suppliers may result in termination of the relationship. Suspected policy violations, security weaknesses or incidents must be reported immediately to security@veroid.com.au.

8. Communication

This policy is published on the VeroID website, made available to all personnel through the ISMS document library, and acknowledged by each person with access to in-scope systems on commencement and after each material revision.

9. Review

This policy is reviewed at least annually and after any significant change to the business, its risks or its obligations.

---

Approved by Luke Ford, Director, One Shot Ventures Pty Ltd trading as VeroID.