Safety standards

1. Our Commitment to Security

At Viuzi, the safety of our users is a fundamental priority. Viuzi is a B2B services marketplace designed to connect service providers (professionals, technicians and companies) with service requesters (businesses and facilities) for maintenance and professional services. The platform is intended to be used by legal entities and professionals in the exercise of their commercial activity. We understand the importance of maintaining a safe and reliable environment for all parties involved.

We are committed to implementing and maintaining rigorous security standards that protect our users, their data and the integrity of every transaction carried out through our platform. These standards apply to all participants in the Viuzi ecosystem, including service providers, service requesters and the platform's operational team.

The obligations set out in Sections 2 to 4 of this document constitute contractually binding commitments incorporated by reference into the Terms of Service. The recommendations and best practices in Sections 5 to 7 are provided as guidance and do not create additional contractual obligations.

2. Provider Verification and Assessment

2.1 Profile Review and KYC Verification

All service providers registered on Viuzi are subject to a profile review process carried out by platform administrators. This process includes:

• Identity verification (Know Your Customer — KYC) in accordance with applicable regulations.
• Review of the information provided in the provider's profile, including personal details, address and contact information.
• Validation of the consistency and accuracy of the information submitted.

2.2 Professional Certification Verification

Viuzi requires service providers to evidence their professional qualifications where the nature of the service so requires. This includes:

• Submission of valid certifications, licences or professional qualifications.
• Verification of the authenticity of the credentials provided.
• Confirmation that the certifications correspond to the services offered by the provider.

Verification Limitation. Viuzi performs reasonable verification checks but does NOT guarantee the integrity, accuracy, currency or continued validity of any Provider's qualifications, certifications, licences or insurance. Verifications are based on documentation provided by the Provider themselves and may not detect forged, expired or revoked documents. Users must exercise their own due diligence before hiring or allowing access to their premises. Viuzi does not replace the competent regulatory bodies for professional authorisation matters.

Criminal Background Checks. Viuzi does NOT carry out criminal background checks on Service Providers. Verification is limited to the professional documentation voluntarily provided by the Provider (certifications, insurance, company documents). Requesters are advised to request references and carry out their own additional due diligence as they consider necessary.

2.3 Insurance Documentation Requirements

Service providers must submit documentation evidencing adequate insurance coverage for the services they offer. This includes:

• Professional liability insurance.
• Employers' liability insurance, where applicable.
• Valid and verifiable documentation of the corresponding policies.

Insurance Assessment Exclusion. Viuzi does NOT assess the adequacy, sufficiency, geographical scope or coverage limits of any insurance policy. Users are solely responsible for ensuring that their insurance coverage meets the requirements of their specific services and jurisdiction. Verification of the existence of an insurance document does not constitute a validation of its content or currency.

Important note for Requesters: Requesters must independently verify that the Provider's insurance coverage is adequate for the contracted service.

2.4 Company Registration Verification

For providers operating as companies or legal entities, Viuzi verifies:

• The legal registration of the company with the competent authorities.
• The tax identification number or equivalent.
• The currency and good standing of the company registration.

2.5 Continuous Compliance Monitoring

Provider verification is not a one-off process. Viuzi carries out continuous monitoring that includes:

• Periodic reviews of providers' documentation and certifications.
• Continuous performance assessment through the ratings and reviews system.
• Verification of the currency of insurance policies and professional licences.
• Immediate response to non-compliance reports from other users.

2.6 Occupational Health and Safety

Service Providers are independent professionals, NOT employees of Viuzi or of the Requesters. Each Provider assumes full responsibility for compliance with occupational health and safety regulations in accordance with Framework Directive 89/391/EEC and its national transpositions, including: risk assessment, personal protective equipment, safety training and the protection of any workers they employ. Requesters who control the premises where the work will be carried out are responsible for the safety conditions of the site, disclosure of known hazards and safe access, in accordance with Article 6 of Directive 89/391/EEC.

3. Platform Security Features

3.1 Secure Payment Processing

Viuzi uses Stripe as its payment processor, which complies with the most demanding security standards in the industry:

• PCI DSS Level 1 Certification: Stripe maintains Level 1 PCI DSS (Payment Card Industry Data Security Standard) certification, the highest level of security certification in the payments industry.
• Credit card data and payment methods are never stored on Viuzi's servers.
• All transactions are processed through encrypted connections.
• Integrated fraud detection and prevention on every transaction.

3.2 Payments Exclusively Through the Platform

To ensure the protection of both parties, all payments for services contracted through Viuzi must be made exclusively through the platform:

• Making payments outside the platform for services contracted on Viuzi is prohibited.
• The integrated payment system provides a complete and verifiable record of all transactions.
• In the event of disputes, the platform's payment records serve as documented evidence.

3.3 Secure Messaging System

Communication between service providers and requesters takes place through Viuzi's integrated messaging system, which ensures:

• Encrypted communications between users.
• Recording of conversations for reference and dispute resolution.
• Filtering of inappropriate content or attempts to share sensitive information.

3.4 Reviews and Ratings System

Viuzi has a bidirectional reviews and ratings system that promotes accountability and transparency:

• Requesters can rate and review providers after a service has been completed.
• Providers can rate requesters.
• Reviews are publicly visible and contribute to each user's reputation.
• Mechanisms are implemented to prevent false or manipulated reviews.

3.5 Reporting and Flagging System

Viuzi users have tools to report inappropriate behaviour, safety issues or any situation requiring the attention of the platform team:

• Ability to report inappropriate profiles, messages or services.
• Mechanism for flagging suspicious content or behaviour.
• Dedicated team for reviewing and managing reports.
• Timely response to all reports received.

4. Service Quality Standards

4.1 Expected Professional Conduct

All service providers on Viuzi must maintain professional behaviour at all times, which includes:

• Respectful and courteous treatment of requesters and their property.
• Personal presentation appropriate to the type of service provided.
• Compliance with the standards of conduct set out in Viuzi's Code of Conduct.

4.2 Work Quality Expectations

Services provided through Viuzi must meet reasonable quality standards:

• The work performed must correspond to the agreed description and specifications.
• Materials used must be of adequate quality and in accordance with what was agreed.
• The final result must be functional and comply with applicable codes and regulations.

4.3 Communication Standards

Effective communication is essential for safety and service satisfaction:

• Providers must respond to messages in a timely manner.
• Any changes to the scope, cost or schedule of the service must be communicated immediately.
• Providers must report any risk or issue identified during the provision of the service.

4.4 Timely Completion Requirements

Service providers must comply with agreed deadlines:

• Services must be completed within the estimated and agreed timeframe.
• In the event of unavoidable delays, the provider must notify the requester as far in advance as possible.
• Repeated and unjustified delays may result in platform penalties.

5. Safety Guidelines for Users

5.1 For Service Requesters

Service requesters should take the following precautions to ensure their safety:

• Verify the provider's identity: Before allowing access to your premises, confirm the identity of the provider assigned through the information available on the platform.
• Clear job descriptions: Provide detailed and accurate descriptions of the work to be carried out, including scope, expectations and any special conditions.
• Safe working environments: Ensure that the area where the service will be rendered is safe and accessible. Inform the provider of any potential hazards (hazardous materials, structural conditions, presence of pets, etc.).
• Presence or delegation: Where possible, be present during the service or designate a trusted person to supervise the work.
• Documentation: Take photographs of the state of the premises before and after the service for a documented record.
• Site safety conditions: Requesters who control the work premises are responsible for the site's safety conditions, including hazard disclosure, safe access and compliance with local health and safety regulations. The Provider is responsible for assessing site conditions before commencing work.

5.2 For Service Providers

Service providers should follow these safety guidelines:

• Professional equipment: Use appropriate professional tools and equipment for the type of service to be provided. Keep your equipment in good condition and in compliance with safety standards.
• Insurance coverage: Maintain a valid professional liability insurance policy covering the services you offer through the platform.
• Safety protocols: Follow the safety protocols established for your industry or speciality, including the use of personal protective equipment (PPE) where necessary.
• Site assessment: Before commencing any work, assess the premises to identify potential hazards or unsafe conditions.
• Risk communication: If you identify unsafe conditions or hazards that prevent the service from being carried out, immediately communicate this to the requester and, if necessary, to the Viuzi support team.

Tools and Equipment. Viuzi assumes no liability for defects, failures or damages arising from tools, equipment or materials provided by Providers. Providers are solely responsible for the safety, suitability and maintenance of their equipment, in accordance with Directive 85/374/EEC on liability for defective products.

6. Incident Reporting

6.1 How to Report Safety Issues

Users can report safety issues through the following channels:

• Within the platform: Use the reporting function available in the application to flag safety issues related to a specific service, provider or requester.
• Email: Send an email to safety@viuzi.com with a detailed description of the incident, including dates, users involved and any available evidence.
• Customer support: Contact our support team via hola@viuzi.com for immediate assistance.

6.2 Platform Response to Safety Reports

Upon receiving a safety report, Viuzi commits to:

• Acknowledging receipt of the report within a maximum of 24 hours.
• Initiating an internal investigation of the reported incident.
• Taking immediate precautionary measures where the safety of a user is at risk (including temporary account suspension).
• Informing the parties involved about the outcome of the investigation.
• Implementing corrective measures to prevent recurrence of the incident.

6.3 Escalation Procedures

In the event that a safety issue is not satisfactorily resolved through regular channels, Viuzi has an escalation procedure that includes:

• Level 1: Review by the customer support team.
• Level 2: Escalation to the platform's security and compliance team.
• Level 3: Review by VIUZI ESP, SL management.
• Competent authorities: In cases involving illegal activities, threats to personal safety or emergency situations, Viuzi will cooperate fully with the competent authorities and recommends that users contact emergency services immediately.

6.4 Incident Classification and Response SLAs

Security incidents are classified according to their impact and urgency in accordance with the following table:

6.5 NIS2 Significant Incident Definition

In accordance with Article 23 of NIS2 Directive (EU) 2022/2555, an incident is considered significant when it meets at least one of the following criteria:

• It has caused or may cause a serious operational disruption to Viuzi's services or significant financial losses for VIUZI ESP, SL.
• It has affected or may affect other natural or legal persons causing considerable material or non-material damages.
• It has compromised personal data of a relevant number of users (threshold: more than 500 affected users or data in special categories).
• It has involved unauthorised access to critical infrastructure systems (production databases, payment systems, authentication).
• It has generated or may generate significant media coverage or reputational damage.

7. Insurance and Liability

7.1 Insurance Requirements for Providers

Viuzi requires service providers to maintain adequate insurance coverage:

• Professional liability insurance covering the services offered.
• Employers' liability insurance for providers with employees.
• Insurance documentation must be current and available for verification.

7.2 Viuzi's Role as Intermediary

Viuzi acts as an intermediary platform that facilitates the connection between service providers and requesters. In this regard:

• Viuzi is not a party to the service contract between the provider and the requester.
• Viuzi does not guarantee the quality, safety or outcome of services provided by providers.
• Responsibility for the correct execution of the service lies with the service provider.
• Responsibility for the accurate description of the work and site conditions lies with the requester.
• Viuzi commits to facilitating the resolution of disputes between the parties but assumes no liability for damages arising from the provision of services.

7.3 Recommendation for Adequate Insurance Coverage

Viuzi strongly recommends that all users:

• Providers: Take out and maintain professional liability insurance with sufficient coverage for the types of services they offer. Coverage should include damage to third-party property, personal injury and professional errors and omissions.
• Requesters: Verify that their own insurance policies (property insurance, business insurance) cover the presence of external contractors on their premises.

8. Data Security

8.1 TLS Encryption for All Communications

All communications between users' devices and Viuzi's servers are protected by TLS (Transport Layer Security) encryption:

• TLS 1.3 as the preferred protocol, with TLS 1.2 as the minimum acceptable. Connections with earlier versions are automatically rejected.
• HSTS (HTTP Strict Transport Security) enabled with a minimum max-age value of one year (31,536,000 seconds), including subdomains.
• Perfect Forward Secrecy (PFS) mandatory through cipher suites based on ephemeral key exchange (ECDHE).
• TLS certificates are renewed and verified regularly through automated procedures.
• Unencrypted connections are automatically rejected and redirected to HTTPS.

8.2 Encrypted Data Storage

Data stored in Viuzi's systems is protected by encryption:

• AES-256 for encryption at rest of all data stores: MongoDB Atlas, Amazon S3, ElastiCache Redis and backups.
• Key management via AWS KMS (Key Management Service), with automatic key rotation enabled.
• Access credentials are stored using robust hashing algorithms with salting and an appropriate cost factor in accordance with industry standards.
• Payment data is managed exclusively by Stripe and is never stored on Viuzi's servers.

8.3 Regular Security Audits

Viuzi carries out security audits on a regular basis to ensure the integrity of its systems:

• Internal audits at a minimum annual frequency, including review of security controls, access and configurations.
• Annual external penetration tests carried out by an independent provider with recognised certification (CREST, OSCP or equivalent). Results are treated as confidential and are available under NDA for clients who require it.
• Continuous review and update of security policies and procedures.
• Continuous monitoring of infrastructure to detect and respond to threats.

8.4 NIS2 Directive (EU) 2022/2555 Compliance

VIUZI ESP, SL periodically assesses its position with regard to Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive). VIUZI ESP, SL, as an online marketplace services provider, is classified as an "important entity" under Annex II, Sector 8 of NIS2 Directive (EU) 2022/2555. Accordingly, VIUZI ESP, SL complies with the obligations of Articles 21 (cybersecurity risk management measures) and 23 (incident notification). VIUZI ESP, SL implements the following measures aligned with the requirements of the NIS2 Directive:

Risk management measures include: vulnerability disclosure and handling policies, cryptographic controls (TLS 1.3 preferred / TLS 1.2 minimum, AES-256), and supply chain security (sub-processor assessment).

• Cybersecurity risk management: Periodic risk assessments of critical information systems, following the ISO 27005 methodology (see Section 8.9).
• Incident management: Documented procedures for the detection, response, mitigation and notification of cybersecurity incidents.
• Business continuity: Contingency and disaster recovery plans for critical platform services (see Section 8.10). Reference: NIS2 Art. 21(2)(c).
• Supply chain security: Security assessment of technology service providers (AWS, MongoDB, Stripe). See Section 8.12.
• Significant incident notification: In the event of a significant incident in accordance with Article 23 of the NIS2 Directive, Viuzi will follow the three-stage notification process: (a) Early warning: within 24 hours of becoming aware of a significant incident, to the RIA (Riigi Infosüsteemi Amet); (b) Incident notification: within 72 hours, with an initial assessment of impact and severity; (c) Final report: within one (1) month of the incident notification, with a detailed description, root cause, measures applied and cross-border consequences.
• Immutable audit logs for critical actions (payments, contract changes, access to sensitive data), with a minimum retention of 12 months in accordance with NIS2 Art. 21.

This assessment is reviewed annually and when significant changes in the volume of operations occur.

Web Application Firewall (WAF). The Platform uses AWS WAF (Web Application Firewall) as a perimeter protection layer against common web attacks, including: SQL injection, Cross-Site Scripting (XSS), remote file inclusion and malformed requests. WAF rules are updated periodically in accordance with identified threats and OWASP Top 10 best practices.

DDoS Attack Mitigation. The Platform's infrastructure incorporates AWS Shield Standard as base protection against distributed denial-of-service (DDoS) attacks at the network and transport layer. Additionally, the Platform's architecture includes application-level rate limiting (30 requests per 5-minute window per user) and automatic scaling mechanisms to absorb peaks of legitimate traffic.

8.5 Security Incident Response Plan

VIUZI ESP, SL maintains a documented Security Incident Response Plan that includes:

• Phase 1 — Detection: Continuous infrastructure monitoring using logging tools and automated alerts.
• Phase 2 — Containment: Immediate isolation of affected systems to limit the impact of the incident.
• Phase 3 — Eradication: Identification and elimination of the root cause of the incident.
• Phase 4 — Recovery: Restoration of affected services to their normal operational state.
• Phase 5 — Lessons learned: Post-incident analysis and update of security measures.

The Plan is tested through simulated exercises at least once a year. Results and improvements implemented are documented and available to supervisory authorities upon request.

Incident response team: Chief Technology Officer (lead), Systems Administrator, Privacy Officer (privacy@viuzi.com). Communications plan: affected users will be notified by email and in-platform notification within 72 hours of incident confirmation.

8.6 Personal Data Breach Notification (GDPR Arts. 33 and 34)

Where a security incident involves personal data of Users, VIUZI ESP, SL will apply the notification obligations established in the General Data Protection Regulation (GDPR), integrated with the Security Incident Response Plan described in Section 8.5.

8.6.1 Notification to the Supervisory Authority (Art. 33 GDPR)

VIUZI ESP, SL will notify the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) within 72 hours of becoming aware of a personal data breach, unless it is unlikely that the breach will result in a risk to the rights and freedoms of the affected natural persons. The notification will include, at a minimum:

• The nature of the personal data breach, including, where possible, the categories and approximate number of data subjects affected, as well as the categories and approximate number of personal data records affected.
• The name and contact details of the contact point for further information (privacy@viuzi.com).
• A description of the likely consequences of the personal data breach.
• A description of the measures taken or proposed to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where it is not possible to provide all information simultaneously, it will be provided gradually without undue delay, in accordance with Art. 33(4) GDPR.

8.6.2 Communication to Affected Data Subjects (Art. 34 GDPR)

Where the personal data breach is likely to result in a high risk to the rights and freedoms of the affected natural persons, VIUZI ESP, SL will communicate the breach to the affected data subjects without undue delay. The communication will be made through the following channels:

• Email: Individual notification to the registered email address of each affected data subject.
• In-application notification: Notification within the Viuzi platform to ensure immediate visibility.

The communication will describe in clear and plain language the nature of the breach, the likely consequences, the measures taken and recommendations for data subjects to protect their data.

8.6.3 Integration with NIS2 Notification Timelines

The GDPR notification timelines are integrated with those established by the NIS2 Directive (Section 8.4) as follows:

• Early warning (24 hours): Initial notification to the RIA (Riigi Infosüsteemi Amet) in accordance with NIS2.
• Incident notification (72 hours): Notification to the Spanish Data Protection Agency (AEPD) in accordance with Art. 33 GDPR and detailed notification to the RIA in accordance with NIS2.
• Final report (1 month): Full report to the RIA in accordance with NIS2, including root cause analysis, impact and corrective measures taken.

Where an incident simultaneously affects the security of information systems (NIS2) and personal data (GDPR), both notifications will be made in a coordinated manner and within the stricter applicable deadlines.

8.6.4 Register of Personal Data Breaches (Art. 33(5) GDPR)

VIUZI ESP, SL will maintain a documented record of all personal data breaches, regardless of whether they have been notified to the supervisory authority. The register will include the facts relating to the breach, its effects and the corrective measures taken. This register will be available to the Spanish Data Protection Agency (AEPD) upon request.

8.6.5 Sub-Processor Obligations

All of VIUZI ESP, SL's sub-processors (including, but not limited to, AWS, MongoDB and Stripe) are contractually required to notify Viuzi within 24 hours of detecting any potential or confirmed personal data breach affecting data processed on Viuzi's behalf. This obligation is established in the Data Processing Agreements concluded with each sub-processor.

8.7 Data Handling in Accordance with GDPR

Viuzi complies with the European Union's General Data Protection Regulation (GDPR):

• Personal data is collected and processed only on an adequate legal basis.
• Users have rights of access, rectification, erasure and portability of their data.
• Technical and organisational measures are implemented to protect personal data.
• International data transfers are made via Standard Contractual Clauses (SCC) in accordance with Implementing Decision (EU) 2021/914, complemented by the EU-US Data Privacy Framework where applicable, in accordance with the legal mechanisms established by the GDPR.
• A record of processing activities is maintained in accordance with Article 30 of the GDPR.
• The principle of Privacy by Design (Art. 25 GDPR) is applied in the development of new features, ensuring that data protection is integrated from the design stage and by default.
• Data Protection Impact Assessments (DPIAs) are carried out in accordance with Article 35 of the GDPR for all processing operations that may pose a high risk to the rights and freedoms of natural persons, including large-scale profiling, processing of special categories of data and processing with new technologies.

For more information on the processing of personal data, please refer to our Privacy Policy available on the platform.

8.8 Access Control and Authentication

Viuzi implements robust access controls based on the principles of least privilege and defence in depth:

User authentication:

• User authentication is performed exclusively via Google OAuth 2.0, eliminating direct password management on the platform.
• Access tokens have a validity of 30 minutes; refresh tokens have a validity of 7 days.
• Session revocation is immediate following security changes or user requests.

Multi-factor authentication (MFA):

• MFA is mandatory for all internal administrative access to production systems (AWS console, MongoDB Atlas, Viuzi admin panel).
• TOTP (Time-based One-Time Password) authenticator applications are used as the preferred MFA method.

Role-Based Access Control (RBAC): Platform roles are documented and assigned in accordance with the principle of least privilege:

Principle of least privilege:

• AWS IAM policies follow the principle of least privilege: each service and role receives only the permissions strictly necessary for its function.
• MongoDB Atlas roles are segmented by environment (production, staging, development) and by function.
• Access to production data is restricted to strictly necessary personnel and is audited.

Access revocation policy:

• The employee and contractor offboarding process includes the immediate revocation of all access (AWS IAM, MongoDB Atlas, code repositories, internal tools) on the day of departure.
• Active permissions are reviewed quarterly to identify obsolete or unnecessary access.

Secret and API key management:

• All API keys for third-party services (Stripe, email services, etc.) are stored in AWS Secrets Manager, never in source code or unencrypted environment variables.
• Secret rotation is automated where the service allows.

8.9 Risk Assessments

Cybersecurity risk assessments are conducted following the ISO 27005 methodology, with an annual frequency and following significant changes to infrastructure or the business model. Risks are identified, analysed and prioritised according to their potential impact and likelihood of occurrence, generating an updated risk register with associated treatment plans. Results directly feed into the review of implemented security measures and continuous improvement investments.

The risk register is available for external audit upon formal request addressed to security@viuzi.com, subject to the signing of a confidentiality agreement. The results of annual risk assessments are shared in summary format in security transparency reports.

8.10 Business Continuity and Disaster Recovery

VIUZI ESP, SL maintains a business continuity and disaster recovery strategy aligned with the requirements of Article 21(2)(c) of the NIS2 Directive:

Recovery objectives:

• RTO (Recovery Time Objective): Objective of restoring critical services within 4 hours of a serious incident.
• RPO (Recovery Point Objective): Objective of maximum data loss of 1 hour for production systems.

Backup strategy:

• Daily backups of all production data (MongoDB Atlas, S3, configurations).
• All backups are encrypted with AES-256 and stored in multiple availability zones (Multi-AZ) on AWS.
• Backup retention: 90 days for daily backups.
• Backups are automatically replicated to a secondary AWS region to ensure recovery from regional disasters.
• Backup integrity is verified monthly through restoration tests.

High availability architecture:

• Production infrastructure on AWS is deployed in Multi-AZ configuration (multiple availability zones) to eliminate single points of failure.
• MongoDB Atlas operates with replica sets with at least three nodes, ensuring automatic failover.
• Load balancers and critical services are configured with automatic redundancy.

Disaster recovery tests:

• Semi-annual DR tests are conducted simulating complete failure scenarios for one availability zone.
• Test results are documented and findings are incorporated into the improvement plan.

Communication during unavailability:

• In the event of an incident affecting platform availability, Viuzi will communicate status to users via: (a) public status page; (b) email notifications to affected active users; (c) updates on the platform's official communications channel.
• The objective is to publish an initial status update within 30 minutes of detecting the incident.

8.11 Vulnerability Management

VIUZI ESP, SL implements a formal vulnerability management programme that includes:

Proactive identification:

• Annual external penetration tests carried out by an independent certified provider (CREST, OSCP or equivalent certification).
• Monthly automated vulnerability scanning of infrastructure and applications using specialised tools.
• Continuous analysis of security advisories from vendors (AWS, MongoDB, .NET, third-party dependencies).

Responsible disclosure programme:

• Viuzi has a responsible vulnerability disclosure channel at security@viuzi.com.
• Security researchers who report vulnerabilities in good faith will receive acknowledgement of receipt within 48 hours and will be informed of the resolution status.

Safe Harbour for Security Researchers. Viuzi commits not to take legal action against security researchers who: (a) discover and report vulnerabilities in good faith in accordance with this responsible disclosure programme; (b) do not access, modify or delete other users' data; (c) do not disrupt Platform availability; (d) do not publicly disclose the vulnerability before resolution or the agreed deadline. Viuzi will publicly acknowledge (with the researcher's consent) significant contributions to Platform security. The bug bounty programme is under evaluation and its availability will be communicated in this section when activated.

Remediation SLAs by CVSS severity:

8.12 IT Supply Chain Management

VIUZI ESP, SL implements a formal process for the assessment and management of the security of its technology supply chain, in accordance with the requirements of Article 21(2)(d) of the NIS2 Directive:

Assessment of new suppliers:

• Every new technology supplier or data sub-processor is assessed before onboarding via a standardised security questionnaire covering: access controls, encryption, incident management, business continuity and regulatory compliance.
• Available security certifications of the supplier (ISO 27001, SOC 2, PCI DSS or other equivalents) are reviewed.
• Assessment results are approved by the security officer before contracting.

Sub-processor register:

• VIUZI ESP, SL maintains an updated register of all data sub-processors that access personal data of Viuzi users.
• All sub-processors have concluded Data Processing Agreements (DPAs) in accordance with Art. 28 GDPR.
• The sub-processor register is available to data subjects upon request.

Annual review of critical suppliers: The following critical suppliers are reviewed annually with regard to their security posture, certification updates and changes to their terms of service:

• AWS (Amazon Web Services): cloud infrastructure, storage, network and managed services.
• MongoDB Atlas: database as a service.
• Stripe: payment processing and PCI DSS compliance.

8.13 Secure Software Development Lifecycle (SSDLC)

VIUZI ESP, SL integrates security into all phases of the software development lifecycle:

Code review:

• Code reviews are mandatory for every change that reaches the main production branch. No change can be merged without approval from at least one reviewer different from the author.
• Main branches (main, develop) are protected by branch policies in the version control system, preventing direct commits and history rewriting.

Automated tools in CI/CD:

• SAST (Static Application Security Testing): Static code analysis on every pull request to detect common vulnerabilities (injection, secret exposure, etc.).
• DAST (Dynamic Application Security Testing): Dynamic security tests on staging environments before each production deployment.
• SCA (Software Composition Analysis): Third-party dependency analysis to identify components with known vulnerabilities (CVEs). Dependencies with critical vulnerabilities block deployment.

Secret management in development:

• Secrets and credentials are never included in source code or version control repositories. Environment variables managed via AWS Secrets Manager are used.
• Repositories have automatic secret scanning enabled.

8.14 Mobile Application Security

Viuzi's mobile application (iOS and Android) implements the following security measures specific to mobile environments:

Communications protection:

• Certificate pinning implemented for communications with the Viuzi API, preventing man-in-the-middle attacks using fraudulent certificates.

Secure credential storage:

• Authentication tokens (access token and refresh token) are stored in the iOS Keychain (on iOS devices) and in the Android Keystore (on Android devices), never in unencrypted storage (unencrypted SharedPreferences, plain files).

Compromised environment detection:

• The application implements jailbreak detection (iOS) and root detection (Android). Upon detecting a compromised environment, the application restricts access and warns the user of the security risk.

Code protection:

• Code obfuscation is applied in production builds to impede reverse engineering and extraction of sensitive application logic.

9. Emergency Procedures

In the event of an emergency during the provision of a service contracted through Viuzi, the following procedures should be followed:

9.1 Life-Threatening or Personal Safety Emergencies

• Contact emergency services immediately by calling 112 in the European Union or the emergency number of your jurisdiction.
• Once the immediate situation is under control, notify Viuzi via safety@viuzi.com or through the platform's reporting system.

Emergency Liability Disclaimer. Viuzi assumes no liability for the outcome of any emergency situation. Users must contact local emergency services directly (112 in the EU). Viuzi's incident reporting channels do NOT replace emergency services and do not guarantee any specific response time.

9.2 Platform Security Incidents

In the event of detecting an IT security incident (unauthorised account access, suspicious activity, etc.):

• Revoke your active sessions immediately from the security settings of your Viuzi account.
• If you use password authentication for other linked services, change it immediately.
• For users who use exclusively Google OAuth, revoke Viuzi's access from the third-party apps section in your Google account settings (myaccount.google.com > Security > Third-party apps).
• Notify Viuzi via safety@viuzi.com.
• Do not share information about the incident with unauthorised third parties.

9.3 Property Damage or Personal Injury

If property damage or personal injury occurs during the provision of a service:

• Document the incident with photographs and detailed descriptions.
• Seek medical attention if necessary.
• Report the incident through the platform and to safety@viuzi.com.
• Contact your insurance company to initiate the corresponding claims process.

10. Security Training and Awareness

VIUZI ESP, SL maintains a structured security training programme for all its personnel:

Mandatory general training (all personnel):

• Annual mandatory training on security subjects: GDPR and data protection, phishing identification and response, password and access management, incident reporting and security best practices.
• Completion of annual training is a requirement for maintaining access to production systems.

Specialised technical training (development team):

• Specific training in OWASP Top 10 and secure coding principles.
• Annual update on new threats and vulnerabilities relevant to Viuzi's technology stack (.NET, MongoDB, AWS).
• Participation in industry security communities and resources.

Phishing simulations:

• Quarterly phishing simulations are conducted to assess staff awareness and reinforce secure behaviours.
• Simulation results are used to customise training content and prioritise areas for improvement.

Training records:

• VIUZI ESP, SL maintains a documented record of all security training completed by each member of staff, including dates, content and assessment results.
• This record is available for internal and external audits.

11. Reference Frameworks and Certifications

VIUZI ESP, SL aligns its security programme with the most widely recognised international reference frameworks:

Current reference frameworks:

• ISO/IEC 27001:2022: VIUZI ESP, SL conducts periodic self-assessments of its security controls in accordance with the requirements of the ISO/IEC 27001:2022 standard (Information Security Management System).
• NIST Cybersecurity Framework (CSF) 2.0: The functions of NIST CSF 2.0 (Govern, Identify, Protect, Detect, Respond, Recover) are used as a reference for structuring and evaluating the security programme.
• PCI DSS: PCI DSS compliance for payment processing is managed through Stripe (PCI DSS Level 1 certified), in accordance with the shared responsibility model.

Certification roadmap:

• VIUZI ESP, SL aims to achieve ISO/IEC 27001 certification within an 18-month horizon from the effective date of this document.
• The roadmap includes: gap analysis, implementation of missing controls, pre-certification internal audit and certification audit by an accredited body.

Additional planned assessments:

• SOC 2 Type II: A SOC 2 Type II assessment is planned to facilitate entry into the Anglo-Saxon market and meet the due diligence requirements of international enterprise clients.

12. Continuous Improvement

Viuzi is committed to the continuous improvement of its security standards. This includes:

• Periodic policy review: Security standards are reviewed and updated on a regular basis, with a minimum semi-annual frequency, to incorporate industry best practices and respond to new risks.
• User feedback: We value feedback from our users and use it to identify areas for improvement in our security processes.
• Team training: The Viuzi team receives regular training in security, data protection and incident handling (see Section 10).
• Technology updates: We keep our technology infrastructure up to date to incorporate the latest available security measures.
• Industry collaboration: We participate in industry initiatives and communities to share and adopt security best practices.