Security Questionnaire Accuracy & Change Notification Policy

1. Purpose

The purpose of this policy is to ensure that all information security–related information, including responses to customer security questionnaires, risk assessments, and due diligence requests, is accurate, complete, and kept up to date, and that material changes are promptly communicated to customers in accordance with contractual obligations.

2. Scope

This policy applies to:

• All written responses provided by AlignAI Labs, Inc. to customer security questionnaires, audits, assessments, or due diligence requests;

• All representations made regarding AlignAI Labs, Inc.’s information security controls, policies, processes, certifications, and system architecture;

• All employees, contractors, and third parties involved in preparing, reviewing, approving, or maintaining such responses.

3. Policy Statement

AlignAI Labs, Inc. commits that:

1. Accuracy of Information: All information provided in response to customer security questionnaires, assessments, or reviews shall be accurate, complete, and reflective of the current state of AlignAI Labs, Inc.’s information security controls at the time the information is provided.

2. Ongoing Validity: AlignAI Labs, Inc. shall take reasonable steps to ensure that such information remains up to date for the duration of the applicable customer relationship.

3. Material Change Notification: AlignAI Labs, Inc. shall notify the affected customer without undue delay, and in any event immediately upon becoming aware, of any material changes that would cause previously provided security information to become inaccurate or misleading.

Material changes may include, but are not limited to:

• Significant changes to security controls, policies, or procedures;

• Material changes to system architecture or hosting environments;

• Introduction of new sub-processors with access to customer information;

• Loss, suspension, or material modification of security certifications or attestations (e.g., SOC 2);

• Security incidents that materially impact the confidentiality, integrity, or availability of customer information.

4. Notification Method: Notifications of material changes shall be communicated through agreed customer communication channels or designated security contacts, in accordance with contractual requirements.

4. Roles and Responsibilities

• Security Leadership is responsible for:

  • Reviewing and approving security questionnaire responses;

  • Assessing whether changes are material and require customer notification.

• Legal and Compliance are responsible for:

  • Ensuring alignment with contractual obligations;

  • Supporting customer communications where required.

• Employees and Contractors must promptly escalate any known or suspected changes that could impact previously provided security information.

5. Enforcement

Failure to comply with this policy may result in disciplinary action, up to and including termination of employment or contract, and may expose AlignAI Labs, Inc. to contractual or legal risk.

6. Review and Maintenance

This policy shall be reviewed at least annually and updated as necessary to reflect changes in organizational practices, contractual obligations, or applicable laws and regulations.