We fully understand the importance of data security and the significance of compliance with industry standards. Our commitment to safeguarding data and maintaining robust security practices remains a top priority. However, based on our internal assessment, the data we handle does not include sensitive information and SOC 2 security certification is not necessary for us at this time. We, of course, remain open to revisiting this decision in the future should our data processing requirements change or expand to include sensitive information.

To provide further assurance regarding our data security practices, we would like to outline some key points that support our belief that an external audit is unnecessary:

1. Nature of Data: The full list of data we process can be found in Section 24 of our Privacy Policy, which can be viewed in Section 16 of our Terms of Service. While we acknowledge the importance of protecting all data entrusted to us, we do not handle sensitive information such as personally identifiable information (PII), financial records, etc.
2. Risk Assessment: We have conducted a thorough risk assessment of our systems and processes, considering factors such as data access controls, encryption, network security, and incident response protocols. Our internal controls and security measures align with industry best practices for protecting non-sensitive data.
3. Ongoing Security Monitoring: We maintain vigilant monitoring and detection systems to promptly identify and mitigate any potential security threats or breaches. Our dedicated IT team conducts regular internal audits and assessments to ensure that security measures remain effective.

Our internal controls and security measures include:

• Access Controls: We have implemented strict access controls to ensure that only authorized individuals have access to our systems and data. User access is granted based on the principle of least privilege, meaning that employees are only granted access to the data and systems necessary to perform their job responsibilities. User access is regularly reviewed and revoked promptly upon an employee's departure or change in roles.
• Data Encryption: We employ industry-standard encryption protocols to protect data both at rest and in transit. This includes using strong encryption algorithms to secure sensitive information, such as passwords, financial data, or any other data that may be subject to potential breaches.
• Network Security: Our network infrastructure is secured through firewalls, intrusion detection and prevention systems, and regular vulnerability assessments. We regularly update and patch our systems to protect against known vulnerabilities and emerging threats.
• Incident Response: We have a comprehensive incident response plan in place to swiftly and effectively address any security incidents or breaches. Our plan includes predefined steps to contain the incident, investigate its root cause, mitigate its impact, and restore normal operations. We conduct regular drills and exercises to ensure the effectiveness of our incident response procedures.
• Employee Training and Awareness: We prioritize employee training and awareness programs to foster a security-conscious culture within our organization. Our employees undergo regular training on data security best practices, including topics such as password hygiene, phishing awareness, and the proper handling of data. This helps to ensure that all staff members are knowledgeable about their responsibilities in maintaining data security.
• Auditing and Monitoring: We maintain comprehensive auditing and monitoring systems to track and log activities within our systems. This enables us to identify any suspicious or unauthorized behaviour promptly. Regular audits of system logs and security controls are conducted to identify and address any potential weaknesses or vulnerabilities.