Information Security Program Overview

This Information Security Program Overview describes how My Waypoint Technologies Inc. governs information security across its products, services, and operations.

This is a high-level overview. It is not an Information Security Management System (ISMS) or a technical security specification. Specific security controls, configurations, procedures, and architecture details are maintained internally and are not published to avoid creating security risk.

For product-specific security information, see the applicable product addendum. For vulnerability reporting, see our Responsible Disclosure Policy.

My Waypoint Technologies Inc. approaches information security as an organizational responsibility rather than a purely technical function. Security governance at MyWaypoint includes:

• Defined ownership of security responsibilities within the organization
• Integration of security considerations into product design, development, and operations
• Periodic review of security practices, controls, and configurations
• Alignment of security practices with applicable Canadian privacy and data protection requirements
• Engagement of qualified external advisors where appropriate

Security governance is proportionate to the operational scale and risk profile of the organization.

My Waypoint Technologies Inc. applies a risk-based approach to information security. Security controls and investments are prioritized based on the likelihood and potential impact of identified risks.

Our risk-based approach considers:

• The sensitivity of information processed across our products and services
• The threat landscape relevant to our technology stack and operational profile
• The potential impact of security failures on clients, individuals, and the organization
• Applicable legal and regulatory requirements
• The operational and financial constraints of a small technology organization

We do not claim to eliminate all security risk. Our objective is to apply reasonable and proportionate controls to manage identified risks.

My Waypoint Technologies Inc. applies the following access control principles across its systems and services:

• Least privilege — access to systems and data is limited to what is necessary for the authorized purpose
• Authentication — access to sensitive systems requires appropriate authentication
• Account management — accounts are created, modified, and removed through defined processes
• Credential security — credentials are managed securely and not shared unnecessarily
• Periodic review — access rights are reviewed periodically to ensure they remain appropriate

For products with customer-facing accounts (such as MyCleanData), customers are responsible for maintaining the security of their own credentials and access controls.

My Waypoint Technologies Inc. applies security considerations throughout the software development lifecycle. Our secure development approach includes:

• Security review as part of the design and development process
• Evaluation of third-party dependencies for known vulnerabilities
• Use of version control and code review practices
• Testing of security-relevant functionality before deployment
• Prompt response to identified security vulnerabilities in deployed software

Most MyWaypoint products are delivered as static websites. Static architecture reduces the attack surface compared to traditional web applications by eliminating server-side application code from the public-facing layer.

Security testing, penetration testing, or vulnerability scanning against our systems requires prior written permission. See our Responsible Disclosure Policy for the appropriate process.

My Waypoint Technologies Inc. considers security as part of its vendor evaluation and management process. Our vendor security approach includes:

• Review of vendor security practices and certifications as part of onboarding
• Preference for vendors with established security programs and published compliance certifications
• Contractual requirements for vendors to protect personal information and use it only for authorized purposes
• Monitoring of vendor security communications and incident notifications

See our Vendor and Subprocessor Disclosure for the named list of vendors and their security certifications.

Information security incident management is integrated into our broader security governance practices. Our approach to security incidents includes:

• Defined internal processes for detecting, assessing, and responding to security incidents
• Escalation procedures for significant incidents
• Coordination with affected clients and third-party providers where appropriate
• Compliance with applicable breach notification obligations
• Post-incident review and improvement activities

See our Security Incident & Breach Notification statement for our public-facing incident response commitments.

My Waypoint Technologies Inc. maintains security awareness as part of its organizational culture. Our approach includes:

• Awareness of current security threats relevant to our technology stack and operational profile
• Monitoring of security advisories and vulnerability disclosures for technologies we use
• Incorporation of security considerations into operational decision-making
• Engagement with the security community through responsible disclosure practices

My Waypoint Technologies Inc. reviews and improves its information security practices as part of its broader governance activities. Security improvements may be driven by:

• Lessons learned from security incidents or near-misses
• Changes in the threat landscape
• Changes in technology, products, or services
• Evolving legal and regulatory requirements
• Feedback from clients, security researchers, or advisors

See our Security Statement for our product-level security commitments, and our Disaster Recovery Overview for our resilience approach.