Security Policy

1. Scope

This Policy applies to:

• All Carbuki personnel, contractors, and systems
• All data processed through Carbuki's platform, including consumer data handled on behalf of dealership clients
• All third-party subprocessors used in delivering Carbuki's services

2. Security Governance

2.1 Ownership

Security governance at Carbuki is owned by the CTO. Policies are reviewed at minimum annually, or following a material security incident, significant architectural change, or change in regulatory requirements.

2.2 Access Governance

Access to systems and data is granted on a need-to-know, least-privilege basis. Access rights are:

• Assigned by role and job function
• Reviewed when roles change or employment ends, and reviewed comprehensively at least every six months
• Revoked promptly upon departure or role change

3. Data Classification

Carbuki processes the following categories of data on behalf of dealership clients:

Carbuki does not collect, store, or process the following categories in the normal course of service: Social Security Numbers, driver's license numbers, financial account numbers, payment card data, or credit application data. If a dealership integration would require Carbuki to handle any of these categories, a separate data processing addendum is required.

4. Access Control

5. Data Protection

5.1 Encryption

5.2 Data Isolation

• Each dealership client's data is logically isolated through tenant identifier enforcement at both the application and database layers. Cross-tenant data access is prevented by design and verified through automated testing.
• Production and development/testing environments are fully segmented, with separate credentials, networks, and data stores. Production data is not copied to non-production environments; synthetic or anonymized data is used for testing.

5.3 Secure Deletion

"Secure deletion" throughout this Policy refers to data destruction methods consistent with NIST SP 800-88 Guidelines for Media Sanitization, including cryptographic erasure for cloud-hosted data and overwrite or physical destruction for any local media.

6. AI Systems and Voice Technology

Carbuki operates AI-driven voice and conversational systems. The following controls apply specifically to those systems:

7. Compliance and Certifications

7.1 Consumer Rights Requests

Carbuki supports dealership clients in responding to consumer requests under CCPA/CPRA and analogous state laws, including requests for access, deletion, and opt-out of sale/sharing. Carbuki acts as a service provider and does not sell consumer data. Requests are processed within statutory timeframes. Full details are available in the Carbuki Privacy Policy at https://carbuki.com/privacy.

8. TCPA and Telephony Compliance Controls

While certification of consent and DNC list compliance is the dealership's contractual responsibility, Carbuki provides the following technical controls to support dealership compliance:

• DNC list scrubbing supported via integration with internal DNC database
• Time-of-day calling restrictions enforced by recipient area code (default 8am–9pm local time, configurable per dealership within statutory limits)
• Per-campaign frequency caps to prevent over-contacting
• Consent metadata capture and audit trail at the lead-record level
• Call recording disclosure prompts configurable per state requirement
• Immediate honoring of in-call opt-out requests with propagation to all active campaigns

9. Secure Development

• Material changes to customer-facing systems require review and approval by the CTO or designated engineering lead before deployment
• Developers follow secure coding practices aligned with the OWASP Top 10; all code changes require peer review before merging to production
• Dependencies are scanned for known vulnerabilities as part of the CI/CD workflow; high and critical findings block deployment
• Independent third-party penetration testing performed at least annually; results and remediation status available to dealership clients under NDA
• Static application security testing (SAST) and software composition analysis run on every pull request

10. Incident Response

10.1 Process

Carbuki maintains a documented incident response process covering:

• Detection and classification of potential security events
• Containment, investigation, and remediation
• Post-incident review and documented lessons learned
• Tabletop exercises conducted at least annually

10.2 Notification

In the event of a security incident reasonably believed to involve dealership client data or consumer personal information:

• Carbuki will notify affected dealership clients within 72 hours of becoming aware of the incident
• Initial notification will include: nature of the incident, data categories affected, estimated scope, containment actions taken, and known remediation steps
• Carbuki will provide updates as the investigation progresses and a post-incident summary upon closure
• Carbuki will cooperate with the dealership's own incident response and regulatory notification obligations, including any applicable state breach notification laws, GLBA Safeguards Rule notification, and FTC reporting requirements

10.3 Point of Contact

Security incidents and concerns should be reported to:

• Email: security@carbuki.com
• Subject Line: [SECURITY INCIDENT] — Carbuki
• Response SLA: Acknowledgment within 4 business hours; substantive response within 24 hours

11. Vendor and Subprocessor Management

Carbuki evaluates third-party vendors and subprocessors before engagement and limits their access to what is reasonably necessary. Material changes to the subprocessor list are communicated to dealership clients with reasonable advance notice.

A complete and current subprocessor list is available to dealership clients upon request under NDA.

12. Data Retention and Disposal

Upon termination of a dealership engagement, all client data is deleted within 30 days unless a longer retention period is required by law or contractually agreed.

13. Personnel Security

13.1 Employee and Contractor Responsibilities

• Protect credentials and never share passwords or access tokens
• Use only approved systems and processes for handling company or client data
• Report suspected security incidents or vulnerabilities promptly to the CTO at security@carbuki.com
• Follow applicable policies; written acknowledgment required upon onboarding and annually thereafter
• Background checks conducted on all employees and contractors with access to production systems, consistent with applicable law

13.2 Training and Awareness

• Security awareness training required during onboarding and at least annually thereafter via KnowBe4
• Quarterly phishing simulations
• Periodic reminders on phishing, credential hygiene, and data handling
• Role-specific training for engineers on secure coding practices

14. Physical Security and Endpoint Management

• Unauthorized physical access to work environments and equipment is restricted
• Remote work follows the same security standards as in-office access; use of public Wi-Fi requires VPN
• Lost or stolen devices must be reported to the CTO immediately for remote wipe and credential rotation
• Personal devices (BYOD) are not permitted to access production systems or store dealership data

15. Business Continuity and Disaster Recovery

• Critical data backed up daily with 30-day rolling retention
• Backups stored in a separate region from primary data stores
• Backup integrity tested quarterly through restoration exercises
• Recovery objectives for core platform services:
  • RTO (Recovery Time Objective): 8 hours
  • RPO (Recovery Point Objective): 1 hour
• Disaster recovery plan reviewed and tested at least annually

16. Policy Review and Change Management

This Policy is reviewed at minimum annually and updated to reflect changes in operations, technology, or legal requirements. Material changes will be communicated to dealership clients with at least 30 days' advance notice where practicable. A version history is maintained and prior versions are available upon request.

17. Contact

This document represents Carbuki's security posture as of the Effective Date. It is provided for the information of dealership clients and prospective clients under NDA and does not create contractual obligations except as incorporated by reference into a signed agreement.