Information Security & AI Policy Statement

We provide secure, AI-enabled cloud software solutions, including HRMS, Payroll, and CRM systems, to support organizations of all sizes in their digital transformation initiatives. Our solutions are designed to address everyday business needs through practical innovation, accessibility, and scalability.

Security, privacy, and ethical use of artificial intelligence are embedded into our products and operations by design. By combining strong local expertise with globally recognized security, compliance, and governance standards, we deliver reliable and trustworthy software solutions that enable sustainable business growth.

2.aVision

To make AI enabled and secure software solutions easily accessible to organization of any size and industry that wish to embrace digital transformation and reach their maximum growth potential, thus making the cutting edge digital future an everyday reality for everyone.

2.bMission

To provide home-grown and world class cloud software solutions addressing everyday business requirements, hyper-configurable at affordable prices with localized support teams to help businesses grow.

2.cCore Values

• Customer-Centric Innovation: We design practical, secure, and hyper-configurable solutions that address real business needs.
• Accessibility & Inclusion: We make secure, AI-enabled software accessible to organizations of all sizes.
• Security & Trust by Design: Security, privacy, and resilience are embedded into everything we build.
• Ethical & Responsible Use of AI: We ensure AI is used responsibly, transparently, and with human oversight.
• Local Expertise, Global Standards: We combine local knowledge with global security and compliance standards.
• Agility & Continuous Improvement: We continuously improve our security, AI governance, and operations.

This Information Security Policy defines the framework and guidelines to protect the confidentiality, integrity, and availability of Nathan Digital's information assets. It provides the basis for establishing, maintaining, and continually improving an Information Security Management System (ISMS) that complies with ISO/IEC 27001:2022.

The policy applies to all employees, contractors, and third-party service providers with access to Nathan Digital's information and systems and covers all organizational processes, hardware, software, data, and communication channels.

3.aOur Information Security Policy

Nathan Digital is committed to securing the Confidentiality, Integrity, and Availability of all information related to the business and its operations. As part of our commitment to ethical AI, Data Privacy, and Information Security, Nathan Digital has adopted an Information Security Management System (ISMS) aligned with the ISO/IEC 27001:2022 standard and ISO/IEC 42001:2023 for AI Governance. In addition, our controls are aligned with the SOC 2 Type II Trust Services Criteria, further demonstrating our commitment to the highest standards of Security, Privacy, and Compliance.

4.aLegal and Regulatory Compliance

Nathan Digital shall comply with international standards and data protection laws, including:

• Kenya Data Protection Act, 2019 (KDPA)
• South Africa POPIA
• EU/UK GDPR & UK DPA 2018
• UAE PDPL (Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data)
• Saudi Arabia PDPL
• Singapore PDPA
• Canada PIPEDA

In addition to these regulations, we ensure that all AI systems are developed, deployed, and operated in line with ISO 42001 (AI Governance), which includes:

• Ethical AI Principles: Fairness, transparency, and accountability.
• Compliance with AI-Specific Legal Requirements: Meeting the legal requirements for AI models that process personal or sensitive data.
• Privacy Protections: Ensuring privacy when AI models process personal data.

See our Data Protection page for more information on how these laws are applied to personal data.

4.bAI Risk Management and Ethical AI Framework

We have established and implemented a comprehensive AI Risk Management Framework to identify, assess, and mitigate risks associated with AI models, including:

• Bias and Fairness Risks: Addressing potential biases in AI models and ensuring fairness in decision-making.
• Transparency and Explainability: Ensuring that AI models and their outcomes are explainable and understandable.
• Security and Privacy Risks: Protecting personal and sensitive data processed by AI systems.

This framework ensures that AI systems operate securely and ethically, meeting the requirements of both ISO 27001 and ISO 42001.

4.cIncident Management and AI Monitoring

We have established a comprehensive Incident Management Process as part of our Information Security Management System (ISMS) and AI Governance Framework. This process ensures that all information security incidents, including those involving AI systems, are reported, investigated, and remediated promptly.

We continuously monitor our AI models for issues like performance degradation, security vulnerabilities, and bias, ensuring that they remain secure, ethical, and aligned with our standards. All AI-related incidents are handled in accordance with our ISMS protocols, ensuring compliance with ISO/IEC 27001 and ISO 42001, and safeguarding the integrity and security of both our AI systems and the data they process.

To report a suspected security incident, contact us at privacy@nathandigital.com.

4.dResource Allocation for ISMS and AI Governance

Nathan Digital ensures that appropriate resources are allocated to:

• Implement, maintain, and continually improve our ISMS and AI governance frameworks.
• Conduct regular AI risk assessments, including AI-DPIAs (AI Data Protection Impact Assessments).
• Allocate personnel with the required expertise to manage both information security and AI ethics.

4.eCommunication of the Policy

This policy is communicated to:

• All Nathan Digital employees and relevant third-party providers.
• External stakeholders to ensure transparency and alignment with ISO 27001 and ISO 42001 governance practices, as well as applicable data protection laws.
• Customers and partners, ensuring their trust in our products and services.

4.fExternal Partnerships and AI Collaboration

We establish and enhance partnerships with external providers and relevant interested parties to:

• Provide improved AI-driven products and services.
• Ensure the ethical and secure use of AI systems in collaboration with external partners.

4.gInformation Security and AI Objectives

We establish, document, measure, monitor, review, and continually improve our Information Security and Artificial Intelligence (AI) objectives in alignment with our Information Security Policy Manual, ISMS, and AIMS, in accordance with the requirements of ISO/IEC 27001:2022 and ISO/IEC 42001:2023.

These objectives focus on protecting the confidentiality, integrity, and availability of information, strengthening cybersecurity controls, managing information security and AI-related risks, preventing security incidents and data breaches, and ensuring compliance with applicable legal, regulatory, contractual, and data protection requirements, including GDPR where applicable.

Additionally, our objectives promote the responsible, secure, transparent, and ethical development, deployment, and use of AI systems through effective AI governance, risk assessments, appropriate human oversight, and continuous improvement of AI security and ethical controls.

We regularly evaluate the effectiveness of these objectives through defined performance indicators, risk assessments, internal audits, management reviews, and corrective actions to ensure their continued relevance, effectiveness, and alignment with organisational goals.

4.hContinuous Improvement of Information Security & AI Governance

Management at Nathan Digital acknowledges the need for continual improvement. We have implemented various processes to ensure effective and continual improvement of our ISMS and AI governance practices, including:

• Regular reviews and updates of AI ethical practices and security controls.
• Regular management reviews of both the ISMS and AI Governance to align with emerging risks, regulatory changes, and technological advancements.
• Performance tracking of AI systems, data privacy, and security measures to ensure continual alignment with business objectives.

Further, information security objectives have been established and are reviewed periodically to ensure continual improvement of our ISMS and AIMS.

4.iCompliance with ISO 27001, ISO 42001 & SOC 2 Type II

This policy ensures that Nathan Digital is aligned with the core principles of ISO 27001 (Information Security Management), ISO 42001 (AI Governance), and SOC 2 Type II (Trust Services Criteria). We ensure:

• Confidentiality: Protecting sensitive information from unauthorized access.
• Integrity: Ensuring the accuracy and reliability of data and AI systems.
• Availability: Guaranteeing that systems and data are accessible when needed by authorized users.
• Privacy: Ensuring that personal data is processed securely and with respect to privacy rights, as set out in our Privacy Policy.

This policy is reviewed:

• Annually: As part of the ISO 27001, ISO 42001 and SOC 2 Type II management review cycle.
• Immediately: Following significant incidents, regulatory changes, or new jurisdictions of operation.

Reviews are conducted by the SOC team, Data Protection Officer (DPO), and Legal & Compliance team, with approval from senior management.

Updates are formally communicated to all employees, contractors, and third parties: to employees through the HRMS system, and to third parties through this website.