Valion OS Security Policy

Effective Date: 30 July 2026
Version: 1.0

1. Purpose

This Security Policy explains the administrative, technical, and organisational security measures implemented by Largify Solutions (SMC-Private) Limited ("Largify Solutions", "we", "our", or "us") to help protect the confidentiality, integrity, and availability of the Valion OS platform and Customer Data.

Valion OS is an AI-powered Business Operating System designed for service-based businesses. Security is incorporated throughout the platform's design, development, deployment, and operational processes.

This Security Policy provides an overview of our current security practices. Unless expressly incorporated into a separate written agreement, this document does not create contractual service level commitments or warranties.

2. Scope

This Security Policy applies to the security of:

• Valion OS web applications
• Mobile applications
• APIs and developer services
• Artificial Intelligence (AI) features
• Customer Portal
• Vendor Portal
• Internal administration systems
• Cloud infrastructure
• Customer Data processed by the platform
• Employees, contractors, and authorised personnel with access to production systems

This policy applies only to services operated by Largify Solutions and does not extend to third-party services that integrate with Valion OS.

3. Security Governance

Largify Solutions maintains administrative, technical, and organisational safeguards intended to protect our platform and Customer Data.

Security responsibilities are assigned to authorised personnel responsible for:

• platform security;
• secure software development;
• infrastructure operations;
• access management;
• incident response;
• vulnerability management;
• compliance activities;
• risk management.

Security practices are periodically reviewed and updated as our platform, infrastructure, and legal obligations evolve.

4. Security Principles

Valion OS is designed around recognised information security principles, including:

• Least Privilege
• Zero Trust principles
• Defence in Depth
• Secure by Design
• Privacy by Design
• Need-to-Know Access
• Continuous Monitoring
• Security Automation
• Risk-Based Security Management

These principles guide the development and operation of our products and services.

5. Secure Software Development Lifecycle (SSDLC)

Security is integrated throughout our software development lifecycle.

Development practices may include:

• secure architecture reviews;
• secure coding standards;
• peer code reviews;
• automated testing;
• dependency scanning;
• vulnerability remediation;
• source code management;
• change approval procedures;
• controlled production deployments;
• release verification.

Security considerations are incorporated throughout planning, development, testing, deployment, and maintenance.

6. Infrastructure Security

Valion OS operates on modern cloud infrastructure provided by trusted hosting providers.

Infrastructure security measures may include:

• encrypted communications;
• secure cloud networking;
• network segmentation where applicable;
• firewalls;
• traffic filtering;
• infrastructure monitoring;
• resource isolation;
• automated updates;
• infrastructure redundancy where supported;
• disaster recovery capabilities.

Infrastructure is continuously monitored to help identify operational and security issues.

7. Network Security

We implement multiple layers of network security designed to reduce unauthorised access.

Security measures may include:

• HTTPS encryption;
• TLS encryption;
• firewall protections;
• private networking where appropriate;
• API gateway protections;
• traffic monitoring;
• rate limiting;
• denial-of-service mitigation where supported by our infrastructure providers.

Network architecture is periodically reviewed to improve resilience against evolving threats.

8. Multi-Tenant Security

Valion OS operates as a secure multi-tenant Software-as-a-Service platform.

Each Customer organisation is logically separated through tenant-based security controls.

Platform requests are validated to ensure that:

• users access only their own organisation's information;
• data is isolated between tenants;
• permissions are enforced on every request;
• cross-tenant access is prohibited.

Logical separation is implemented throughout the application architecture to help prevent unauthorised access between Customer organisations.

9. Authentication and Identity Management

Valion OS supports secure authentication mechanisms, including:

• Email and Password authentication;
• Google Sign-In where available;
• Multi-Factor Authentication (MFA) where supported.

Passwords are never stored in plain text.

Password credentials are protected using strong cryptographic hashing techniques.

Authentication systems are designed to reduce the risk of credential compromise, unauthorised access, and account misuse.

Customers remain responsible for maintaining the confidentiality of their authentication credentials.

10. Authorisation and Access Control

Valion OS uses Role-Based Access Control (RBAC) to restrict access based on user responsibilities.

Permissions may be assigned to:

• Owners
• Administrators
• Managers
• Employees
• Contractors
• Vendors
• Custom Roles

Users receive only the permissions necessary to perform authorised business functions.

Administrative privileges are restricted and periodically reviewed to reduce unnecessary access.

Internal access to production environments follows the principle of least privilege.

11. Encryption and Data Protection

Valion OS uses industry-standard encryption technologies to help protect Customer Data.

Data in Transit

Communications between users and Valion OS are protected using HTTPS and TLS encryption.

Data at Rest

Where supported by our infrastructure providers, Customer Data is stored using technologies that provide encryption at rest.

Password Protection

Passwords are cryptographically hashed and cannot be recovered in their original form.

Encryption practices may evolve over time as industry standards and technologies improve.

12. Secrets Management

API keys, service credentials, authentication tokens, encryption secrets, and other sensitive configuration information are managed using secure operational practices.

Where appropriate:

• secrets are separated from application code;
• access is restricted to authorised systems and personnel;
• credentials are rotated when necessary;
• production secrets are protected from unauthorised disclosure.

Sensitive credentials are not intentionally stored within publicly accessible source code repositories.

13. Application Security

Security controls are incorporated throughout the Valion OS application.

Development practices may include:

• input validation;
• output encoding;
• authentication verification;
• authorisation enforcement;
• session management;
• error handling;
• dependency management;
• API security controls;
• security testing before release.

Applications are updated regularly to address newly identified security risks.

14. Artificial Intelligence (AI) Security

Valion OS includes Artificial Intelligence ("AI") capabilities to assist Customers with business operations, automation, content generation, analytics, reporting, and decision support.

To help protect Customer information:

• AI requests are processed only as necessary to provide requested functionality.
• Customer information is shared only with trusted AI service providers required to deliver AI features.
• AI processing is subject to appropriate security and privacy controls.
• AI-generated responses are intended to assist users and should not replace professional judgement.
• AI outputs may contain inaccuracies, omissions, or outdated information and should always be reviewed before being relied upon for business, financial, legal, medical, regulatory, or compliance decisions.
• Unless expressly authorised by the Customer or permitted by applicable agreements, Customer Business Data is not intentionally used by Largify Solutions to train public artificial intelligence models.

Customers remain responsible for reviewing and validating all AI-generated content before using or distributing it.

15. Logging and Security Monitoring

Valion OS maintains operational and security logging to support platform reliability, security investigations, auditing, and incident response.

Logging may include:

• user authentication events;
• successful and failed login attempts;
• administrator activities;
• permission and role changes;
• API requests;
• application errors;
• infrastructure events;
• security alerts;
• system performance metrics;
• audit events;
• platform health monitoring.

Logs are protected against unauthorised modification and are retained for operational, security, legal, and compliance purposes in accordance with our internal retention procedures.

Access to security logs is restricted to authorised personnel with legitimate operational or security responsibilities.

16. Vulnerability Management

Largify Solutions maintains a vulnerability management process designed to identify, assess, prioritise, and remediate security weaknesses.

Security activities may include:

• routine software updates;
• dependency monitoring;
• vulnerability scanning;
• security patch management;
• infrastructure reviews;
• code reviews;
• configuration assessments;
• risk evaluations.

Identified vulnerabilities are prioritised based on severity, potential business impact, exploitability, and operational risk.

Critical vulnerabilities are addressed as a priority, while lower-risk issues are remediated according to internal risk management procedures.

17. Security Testing

Security testing forms part of our ongoing platform maintenance and development activities.

Testing may include:

• automated security scanning;
• dependency analysis;
• application security testing;
• infrastructure assessments;
• configuration reviews;
• authentication testing;
• authorisation testing;
• code quality reviews;
• penetration testing where appropriate;
• remediation verification.

Security testing practices evolve over time as new technologies, threats, and industry standards emerge.

18. Incident Response

Largify Solutions maintains an incident response process designed to identify, investigate, contain, and recover from security incidents.

Our incident response process generally includes:

• Preparation
• Detection
• Analysis
• Containment
• Eradication
• Recovery
• Post-Incident Review

Where appropriate, we may:

• investigate the nature and scope of an incident;
• preserve relevant evidence;
• isolate affected systems;
• implement corrective actions;
• strengthen security controls;
• communicate with affected Customers where legally required or where the incident presents a material risk to Customer Data.

Incident response procedures are reviewed periodically to improve operational readiness and platform resilience.

19. Backup and Disaster Recovery

Valion OS maintains backup procedures intended to support disaster recovery and business continuity.

Current operational practices may include:

• encrypted backups of critical systems;
• scheduled backup cycles;
• backup integrity verification;
• secure backup storage;
• recovery testing where appropriate;
• disaster recovery planning.

Backups are intended to support platform recovery and are not designed to replace a Customer's own data retention, archival, or business continuity procedures.

Customers remain responsible for maintaining independent backups of business-critical information where appropriate.

20. Business Continuity

Largify Solutions maintains operational procedures intended to reduce the impact of unexpected service interruptions.

Business continuity measures may include:

• infrastructure redundancy where supported;
• automated monitoring;
• backup strategies;
• disaster recovery planning;
• controlled deployment processes;
• documented operational procedures;
• incident response coordination;
• recovery planning.

While we strive to maximise platform availability and resilience, uninterrupted or error-free service cannot be guaranteed.

21. Administrative Access

Access to production systems is limited to authorised personnel who require access to perform legitimate operational responsibilities.

Administrative access follows the principle of least privilege and may include:

• role-based permissions;
• access approvals;
• authentication controls;
• activity logging;
• periodic access reviews;
• revocation of unnecessary privileges.

Administrative access is monitored to help reduce the risk of unauthorised or excessive system access.

22. Customer Data Access

Largify Solutions personnel do not routinely access Customer Business Data.

Access may occur only when reasonably necessary for purposes such as:

• providing requested technical support;
• investigating security incidents;
• resolving platform issues;
• maintaining platform reliability;
• complying with legal obligations;
• protecting the security or integrity of Valion OS.

Where practical:

• access is limited to the minimum information necessary;
• access is restricted to authorised personnel;
• administrative actions are logged;
• confidentiality obligations apply to all authorised personnel.

23. Customer Security Responsibilities

Security is a shared responsibility between Largify Solutions and our Customers.

Customers are responsible for:

• maintaining strong passwords;
• enabling Multi-Factor Authentication where available;
• assigning appropriate user permissions;
• protecting endpoint devices;
• maintaining secure internal networks;
• safeguarding authentication credentials;
• keeping browsers, operating systems, and applications updated;
• reviewing AI-generated outputs before relying upon them;
• maintaining appropriate backups of important business information;
• promptly reporting suspected unauthorised account activity.

Failure to follow appropriate security practices may increase the risk of unauthorised access or data loss.

24. Fraud Prevention

Valion OS employs technical and operational measures intended to detect and reduce fraudulent or abusive activity.

Monitoring may include:

• suspicious login attempts;
• credential misuse;
• payment fraud indicators;
• unusual account behaviour;
• automated attacks;
• API abuse;
• excessive request activity;
• attempts to bypass platform security controls.

Accounts involved in fraudulent, malicious, or unlawful activity may be suspended, restricted, or terminated in accordance with our Terms of Service.

25. Third-Party Service Provider Security

Valion OS relies on carefully selected third-party service providers to support the delivery, operation, and security of the Services.

These providers may include services for:

• cloud infrastructure;
• data storage;
• payment processing;
• artificial intelligence;
• authentication;
• email delivery;
• monitoring;
• analytics;
• customer communications;
• security tooling.

Third-party providers are selected based on operational, security, reliability, and business requirements.

Where appropriate, we evaluate providers before adoption and periodically review their suitability.

Although we take reasonable care when selecting providers, each provider remains independently responsible for the security and operation of its own products and services.

Customers using optional third-party integrations may also be subject to the applicable terms and privacy policies of those providers.

26. Compliance and Privacy

Largify Solutions designs Valion OS with consideration for applicable privacy, security, and data protection requirements.

Our security programme is informed by recognised industry practices and guidance, including, where applicable:

• General Data Protection Regulation (GDPR);
• UK General Data Protection Regulation (UK GDPR);
• applicable privacy legislation in Pakistan;
• OWASP Secure Development guidance;
• recognised cloud security best practices;
• secure software development principles.

Compliance obligations may vary depending on a Customer's industry, jurisdiction, and use of the Services.

Customers remain responsible for ensuring that their own use of Valion OS complies with laws and regulations applicable to their organisation.

27. Vendor Risk Management

Largify Solutions recognises that third-party vendors form part of our operational environment.

Before integrating material third-party services, we may consider factors including:

• security capabilities;
• operational reliability;
• privacy practices;
• contractual protections;
• service availability;
• reputation;
• regulatory considerations.

Vendor relationships are periodically reviewed as our platform and operational requirements evolve.

28. Data Residency

Customer information may be processed or stored within infrastructure operated by trusted cloud service providers.

Depending on service configuration and infrastructure availability, Customer Data may be processed in different geographic regions.

Where Personal Data is transferred internationally, Largify Solutions implements appropriate safeguards consistent with applicable data protection laws and our Privacy Policy.

Customers are responsible for determining whether the geographic location of processing satisfies their own regulatory or contractual obligations.

29. Responsible Disclosure

We encourage responsible reporting of suspected security vulnerabilities affecting Valion OS.

If you believe you have discovered a security issue, please notify us promptly by providing, where possible:

• a description of the vulnerability;
• affected functionality;
• reproduction steps;
• potential security impact;
• supporting evidence.

We ask that security researchers:

• avoid accessing Customer Data without authorisation;
• avoid disrupting production services;
• avoid exploiting vulnerabilities beyond what is reasonably necessary to demonstrate the issue;
• avoid publicly disclosing vulnerabilities before reasonable remediation efforts have been completed.

Largify Solutions appreciates responsible security research that helps improve the security of our platform.

30. Security Reporting

Security reports should be submitted to:
Email: security@valionos.com

Where appropriate, reports should include sufficient technical detail to allow our engineering team to investigate the reported issue.

We will make reasonable efforts to acknowledge legitimate security reports and evaluate them in accordance with our internal security procedures.

Submission of a report does not guarantee financial compensation or participation in a bug bounty programme unless expressly announced by Largify Solutions.

31. Policy Updates

Technology, cybersecurity threats, regulatory requirements, and industry standards continue to evolve.

Accordingly, Largify Solutions may update this Security Policy from time to time to reflect improvements to our security practices, legal obligations, operational changes, or enhancements to the Valion OS platform.

When material changes are made, we will update the Effective Date at the beginning of this document and may provide additional notice through the Valion OS website, platform notifications, or email where appropriate.

Continued use of the Services following the effective date of an updated Security Policy constitutes acknowledgement of the revised policy.

32. No Warranty

This Security Policy is intended to describe our current security practices and operational approach.

It does not create contractual obligations, warranties, guarantees, or service level commitments unless expressly incorporated into a written agreement signed by Largify Solutions.

While we implement commercially reasonable administrative, technical, and organisational safeguards designed to protect Customer Data, no system connected to the Internet or electronic storage environment can be guaranteed to be completely secure.

Customers acknowledge that cybersecurity risks continue to evolve and agree to implement appropriate security practices within their own organisations.

33. Contact Information

Questions regarding this Security Policy or security practices may be directed to:

Largify Solutions (SMC-Private) Limited
Lahore, Punjab, Pakistan
Valion OS Website: https://www.valionos.com
General Support: support@valionos.com
Security Team: security@valionos.com
Privacy Enquiries: privacy@valionos.com

34. Related Documents

This Security Policy should be read together with the following documents, where applicable:

• Privacy Policy
• Terms of Service
• Data Processing Agreement (DPA)
• Refund Policy
• Cookie Policy
• Acceptable Use Policy (if published)
• Subprocessor List (if published)

Together, these documents describe how Largify Solutions protects Customer information, delivers the Valion OS platform, and manages legal, privacy, and security responsibilities.

Effective Date: 30 July 2026
Version: 1.0
© 2026 Largify Solutions (SMC-Private) Limited. All rights reserved.