Incident Notification and Cooperation Policy

1. Purpose

The purpose of this policy is to define AlignAI Labs, Inc.’s obligations for the notification, investigation, cooperation, and reporting of information security incidents that may affect customer information, in accordance with contractual commitments and applicable data protection and security laws.

2. Scope

This policy applies to:

• All information security incidents or suspected incidents that may affect:
  • customer information;
  • Systems used to process, store, or transmit customer information; or
  • The availability, confidentiality, or integrity of services provided to the customer.
• All employees, contractors, and third parties acting on behalf of AlignAI Labs, Inc.

3. Policy Statement

AlignAI Labs, Inc. commits to the following incident notification and cooperation obligations with respect to the customer.

4. Incident Identification and Assessment

AlignAI Labs, Inc. shall maintain an incident management process that enables the organization to:

• Detect, identify, and assess security incidents;
• Classify incidents based on severity, scope, and potential impact to customer information;
• Prioritize incidents to meet contractual, regulatory, and operational reporting obligations.

5. Notification Obligations

5.1 Immediate Notification

AlignAI Labs, Inc. shall notify the affected customer immediately upon becoming aware of any actual or reasonably suspected security incident that:

• Affects or may affect customer information; or
• Renders, or may render, any customer systems or service inoperable for any length of time.

5.2 Notification Channel

All initial incident notifications shall be reported in the first instance to:

the designated customer security contact

Additional contacts may be used where agreed contractually or operationally.

6. Incident Notification Content

To the extent known at the time of notification, AlignAI Labs, Inc. shall provide the affected customer with:

• A description of the nature of the incident;
• The date and time the incident was detected;
• The systems, services, and data potentially affected;
• Whether there has been any unauthorised or unlawful access, disclosure, loss, alteration, or destruction of customer information, including personal data;
• The categories of customer information impacted;
• Immediate containment and mitigation actions taken or planned.

Follow-up updates shall be provided without undue delay as additional information becomes available.

7. Investigation and Cooperation

AlignAI Labs, Inc. shall:

• Cooperate fully with the affected customer in investigating any incident affecting customer information;
• Support the affected customer’s internal, regulatory, or legal investigation requirements;
• Preserve relevant system logs, evidence, and forensic data in a manner that maintains integrity and chain of custody;
• Consider the engagement of specialist forensic support where appropriate;
• Respond promptly to all reasonable requests for information from the affected customer related to the incident.

8. Regulatory and Statutory Reporting Support

AlignAI Labs, Inc. acknowledges that the affected customer may be subject to statutory or regulatory reporting obligations under applicable data protection and cybersecurity laws.

Accordingly, AlignAI Labs, Inc. shall:

• Provide information and assistance required for the affected customer to meet regulatory reporting timelines;
• Support the affected customer in assessing notification obligations to regulators, supervisory authorities, and data subjects;
• Coordinate incident communications to avoid inaccurate, inconsistent, or premature disclosures.

9. Incident Tracking and Documentation

AlignAI Labs, Inc. shall maintain an internal incident tracking system documenting, at a minimum:

• Incident type and classification;
• Timeline of events and response actions;
• Impact to customer information and services;
• Remediation actions taken;
• Lessons learned and corrective measures implemented.

Such records shall be retained in accordance with internal policy and made available to the affected customer upon reasonable request.

10. Post-Incident Review

For incidents affecting customer information, AlignAI Labs, Inc. shall conduct a post-incident review to:

• Identify root causes;
• Evaluate the effectiveness of response actions;
• Implement corrective and preventive measures to reduce the likelihood or impact of similar incidents.

11. Governance and Review

This policy shall be reviewed at least annually and updated as necessary to reflect:

• Changes in contractual obligations to the affected customer;
• Changes in applicable laws and regulations; or
• Material changes to AlignAI Labs, Inc.’s incident response processes