Cybersecurity Policy.

Version 2.1 | Last updated October 17, 2026

At 7 Knots Digital, we take the security of our company and our clients' information very seriously. In order to maintain the highest level of integrity and confidentiality, we have implemented the following cybersecurity measures: This policy applies to all employees and contractors of 7 Knots Digital Inc. and 7 Knots Digital SIA, and to every device and account used to access company or client data. It also covers the platforms we operate, including Dock, Navigator, DelegateX Rewards and our campaign registration sites.

1. 1

   Security controls: All employees and contractors are required to use strong, unique passwords and enable multi-factor authentication (MFA) across all company systems and accounts, not just email, including Google Workspace, 1Password, and any client-facing platforms.

2. 2

   Data ownership responsibilities: All employees and contractors are responsible for protecting the data they access and handle. This includes keeping passwords confidential, using secure methods for sending and receiving sensitive client data, including PII (such as HTTPS-based platforms and OneTimeSecret for sharing sensitive information), and logging out of systems when not in use. Client lead files are shared through our Navigator client portal or approved integrations, not as email attachments.

3. 3

   Maintenance of security infrastructure: Our IT systems are managed by our internal team. All company devices must be enrolled in JumpCloud, which enforces disk encryption, patch compliance, and device-level security policy before granting access to company systems. All devices must run Malwarebytes for endpoint threat protection.

4. 4

   Confidentiality: We treat our clients' affairs as confidential and take all necessary precautions to prevent unauthorized disclosure of proprietary processes and confidential information.

5. 5

   Device Security: Employees and contractors are required to protect their company laptops or company smartphones with strong passwords and up-to-date security software, enforced through JumpCloud device management. They are also required to report any lost or stolen device immediately to itadmin@7knotsdigital.com. Devices must lock automatically when idle. Personal phones may be used for company email and chat only with multi-factor authentication and a screen lock, and client data must not be downloaded to personal devices.

6. 6

   Email security: Employees are trained quarterly, via KnowBe4, on how to identify phishing emails and other cyber threats, including simulated phishing tests, and are required to report any suspicious emails to itadmin@7knotsdigital.com.

7. 7

   Network security: We have secure, cloud-based access controls in place, enforced through Google Workspace and JumpCloud identity and access management and device compliance checks, to prevent unauthorized access. Employees are required to use only company-approved devices and software to access company systems, including Shared Team Drive and Client Folders. On public or shared Wi-Fi, use a personal hotspot where possible, and never turn off security tools to get connected.

8. 8

   Remote work security: Access to company systems and sensitive data is secured through multi-factor authentication and device-compliance verification rather than a traditional VPN. Employees may access company systems from any location, provided their device meets current JumpCloud compliance requirements (encryption, patch status, and endpoint protection).

9. 9

   Password management: We have a password management policy in place to ensure that employees use strong and unique passwords for all company systems and accounts. Employees are required to use 1Password, our approved password manager, to generate and store secure passwords, with dedicated vaults maintained per client to segregate access. Passwords must never be shared by email or chat; shared credentials are kept only in the relevant 1Password vault.

10. 10

    Acceptable use: Company systems, accounts and data are for business use. Do not install unapproved software or browser extensions, turn off security tools, or sign up for new apps or online services for company work without approval; new tools that will handle client data go through vendor review first.

11. 11

    AI tools: Use only approved AI tools, such as Claude and Fireflies, under company accounts. Client personal data and confidential information may be entered only into approved AI tools used under business terms that prohibit the provider from training on our or our clients' data. Review AI-generated output before it is used in client work, and tell meeting participants when a call is being recorded.

12. 12

    Data handling: Client lead data, personal information and credentials are confidential. Store them only in approved company systems (Google Shared Drives, Navigator, Dock and 1Password), never on USB drives or other removable media, and delete local downloads once the task is done. Share client data only with people who need it for their work.

13. 13

    Screen and workspace: Lock your screen whenever you step away, avoid showing client data on screen shares that don't need it, and shred any printed documents that contain client data.

14. 14

    Access: Access is granted on a least-privilege basis and must be requested and approved before it is given. Access is reviewed quarterly and removed when someone leaves or changes role, and departing employees and contractors must return company devices.

15. 15

    Incident reporting: Report any suspected security incident immediately to itadmin@7knotsdigital.com and the security lead (currently James Karklins). This includes clicking a phishing link, sending client data to the wrong person, or noticing unusual account activity. Do not try to investigate or fix the issue yourself. The security lead logs every reported incident, including severity, root cause and actions taken, and manages it under our incident response plan.

16. 16

    Exceptions: Any exception to this policy needs written approval from the security lead and is recorded with its reason and an expiry date.

17. 17

    Enforcement: Violations of this policy may lead to disciplinary action, up to and including termination of employment or of a contractor agreement.

18. 18

    Client notification: If a security incident is confirmed to affect client data, the security lead will notify the affected client without undue delay, and in any event within seventy-two (72) hours of confirmation, and will cooperate on investigation and remediation in line with the client's agreement and Data Processing Agreement.

19. 19

    External reporting: Clients, partners, program members and researchers can report a suspected security issue or vulnerability to security@7knotsdigital.com. Privacy questions and requests about personal data, including access and deletion requests, go to privacy@7knotsdigital.com. Reports are acknowledged within two (2) business days and handled under our incident response process.

20. 20

    Data retention and vendors: Client data is kept for the term of the client agreement and deleted or returned within thirty (30) days of termination, except routine backups and records required by law. New vendors that will handle client data are reviewed before use, bound by written data protection terms, and listed at 7knotsdigital.com/subprocessors; clients receive forty-five (45) days' notice of new sub-processors.

By acknowledging this policy when they join and every year after through KnowBe4, employees and contractors agree to adhere to these cybersecurity measures and protect the confidentiality of our company and our clients.