Information Security Policy
Version 1.0 · Last updated
English translation for convenience — the Spanish version is the governing text.
TITLE I. GENERAL PROVISIONS
Chapter 1. Purpose and Scope
1.1 Purpose
This Information Security Policy (hereinafter, the "Policy") is intended to establish the governance framework, guiding principles and security controls governing the protection of the information processed by Ancuria™ Inteligencia Inmobiliaria (hereinafter, "Ancuria", the "Platform" or the "Data Controller"), including its Users' information, their end clients' information, and the Data Controller's own confidential and intellectual-property information.
1.2 Nature of the document
This Policy constitutes, in a dual manner: (i) an internal governance framework documenting the Data Controller's information-security approach, for transparency purposes toward Users, investors, auditors and competent authorities; and (ii) a technical reference instrument for the preparation of future certification processes under international information-security standards, such as ISO/IEC 27001 or SOC 2, without this Policy, by itself, constituting or implying the attainment of such certifications.
1.3 Relationship to other documents
This Policy supplements the security provisions already contained in the Terms and Conditions of Service (particularly its Chapter 11, Account Security, and its Chapter 25, Security, Confidentiality and Retention Measures), in the Full Privacy Notice (particularly its Chapter 19, Security Measures, and its Chapter 20, Notification of Security Breaches), and in the Responsible Artificial Intelligence Policy (particularly its Chapter 9, Security, Robustness and Prevention of Misuse), documents with which it must be interpreted jointly. In case of discrepancy regarding the specific technical subject matter of information security, the provisions of this Policy shall prevail.
1.4 Material scope
This Policy applies to the entirety of the Data Controller's information assets, including, without limitation: the technology infrastructure hosting the Platform; the databases of Users, end clients, properties and Market Indicators; the source code and the technological intellectual property described in Title V of the Terms and Conditions of Service; the Artificial Intelligence models and components; and any device, system or process through which the Data Controller processes such information.
1.5 Personal scope
This Policy is applicable to the Data Controller, its personnel, collaborators, and the data processors and technology providers that process information on its behalf, to the extent of the contractual obligations applicable to them pursuant to Chapter 11.
1.6 Consequences of non-compliance
Non-compliance with this Policy by the Data Controller's personnel or collaborators shall give rise to the corresponding internal disciplinary measures; non-compliance by data processors or providers shall be governed by the contractual instruments executed with them, pursuant to Chapter 11.
Chapter 2. Definitions
2.1 "Information asset"
Any data, system, application, infrastructure, or document, in any format, that has value for the Data Controller and requires protection according to its classification level.
2.2 "Confidentiality"
The property of information whereby it is not made available or disclosed to unauthorized individuals, entities or processes.
2.3 "Integrity"
The property of information consisting of its accuracy and completeness, protected against unauthorized modification.
2.4 "Availability"
The property of information whereby it is accessible and usable by an authorized individual, entity or process, when required.
2.5 "Security incident"
Any event that compromises, or could reasonably compromise, the confidentiality, integrity or availability of an Information Asset, as detailed in Chapter 13 of Deliverable 2 of this Policy.
2.6 "Vulnerability"
A weakness of an Information Asset that could be exploited by a threat to compromise its confidentiality, integrity or availability.
2.7 "Security control"
An administrative, technical or physical measure implemented by the Data Controller to manage information-security risk.
2.8 "Cloud infrastructure provider"
A legal entity providing the Data Controller with the computing, storage or network services on which the Platform operates.
2.9 "Least privilege"
A security principle under which a person or system should only have the access permissions strictly necessary to perform their function.
2.10 "Encryption"
The technical process through which information is transformed to render it unintelligible to unauthorized persons who do not hold the corresponding decryption key.
Chapter 3. Guiding Principles of Information Security
3.1 Legal objective
To establish the principles governing the Data Controller's information-security governance decisions, as the interpretive framework of this Policy.
3.2 Principle of confidentiality, integrity and availability (CIA Triad)
The Data Controller orients its security controls to the joint protection of the confidentiality, integrity and availability of its Information Assets, recognizing that over-protecting one of those properties must not disproportionately compromise the others.
3.3 Principle of least privilege
The Data Controller grants its personnel, collaborators and systems only the access permissions strictly necessary to perform their functions, as developed in Chapter 7.
3.4 Principle of defense in depth
The Data Controller implements multiple layers of complementary security controls, so that the failure of an individual control does not, by itself, compromise the Platform's overall security.
3.5 Principle of security by design and by default
The Data Controller incorporates security considerations from the early stages of the design and development of new Platform features, as developed in Chapter 12 of Deliverable 2, configuring those features with conservative security defaults.
3.6 Principle of proportionality
The Data Controller implements security controls proportional to the actual risk faced by the Platform, considering its size, the nature of the information processed, and the reasonably available resources, without this implying the adoption of standards lower than those required by applicable legislation.
3.7 Principle of continuous improvement
The Data Controller periodically reviews and updates its security controls as the threat landscape, the Platform's infrastructure, and industry best practices evolve.
3.8 Principle of accountability
The Data Controller maintains reasonable documentation of its security controls and decisions, allowing it to handle audits, Due Diligence processes, and requests from competent authorities.
TITLE II. SECURITY GOVERNANCE
Chapter 4. Governance Structure and Roles
4.1 Legal objective
To describe the structure through which the Data Controller administers information security, developing the accountability principle indicated in section 3.8.
4.2 Information security officer
According to its organizational structure, the Data Controller will designate a person or role responsible for coordinating compliance with this Policy, whose identity and contact details may be made known to auditors, investors or competent authorities that so require, without such formal designation, as of the date of this document, being a requirement for the validity of this Policy, given Ancuria's early stage of organizational development.
4.3 Cross-cutting responsibilities
Independently of the formal designation indicated in the preceding section, information security is the responsibility of all the Data Controller's personnel and collaborators, who must observe this Policy and report any detected Security Incident or Vulnerability, pursuant to Chapter 13 of Deliverable 2.
4.4 Periodic review of the Policy
The Data Controller will review this Policy at least annually, or when a significant change occurs in the technology infrastructure, the business model, or the applicable regulatory landscape, documenting such review pursuant to section 3.8.
4.5 Consequences of non-compliance
Failure to designate a security officer or to periodically review the Policy does not, by itself, generate liability toward individual Users, without prejudice to such omission being considered a relevant factor in determining the Data Controller's diligence in a claim based on a Security Incident.
Chapter 5. Information Classification
5.1 Legal objective
To establish the categories under which the Data Controller classifies its Information Assets, in order to apply security controls proportional to their sensitivity, developing the proportionality principle indicated in section 3.6.
5.2 Public information
Comprises the information the Data Controller makes available to the general public, such as the corporate website content and Marketplace listings configured as public by the User.
5.3 Internal information
Comprises the Data Controller's internal-use information that, while not strictly confidential, is not intended for public disclosure, such as operational documentation and internal communications.
5.4 Confidential information
Comprises information whose unauthorized disclosure could cause harm to the Data Controller or its Users, including the source code, the Artificial Intelligence prompts and architectures described in Chapter 14 of the Terms and Conditions of Service, the Data Controller's financial information, and the business data of Users loaded into their CRM modules.
5.5 Highly confidential information or Personal Data
Comprises Users' and end clients' Personal Data under the Full Privacy Notice, payment-instrument data, and system access credentials, the category to which the strictest security controls provided in this Policy apply.
5.6 Application of controls according to classification
The access, encryption, backup and retention controls described in the subsequent Chapters of this Policy apply proportionally and increasingly as the classification level of the information involved rises, the Highly Confidential Information or Personal Data category receiving the strictest protection level.
5.7 Consequences of non-compliance
Processing an Information Asset with a lower level of control than that corresponding to its classification shall constitute a breach of this Policy.
Chapter 6. Security Risk Management
6.1 Legal objective
To describe the Data Controller's approach to identifying, assessing and mitigating information-security risks.
6.2 Risk identification
The Data Controller carries out, reasonably and proportionally to its stage of development, the identification of security risks associated with its technology infrastructure, internal processes, and providers, including risks deriving from the use of Artificial Intelligence components pursuant to Chapter 6 of the Responsible Artificial Intelligence Policy.
6.3 Assessment and prioritization
The Data Controller assesses the identified risks considering their likelihood of occurrence and the potential impact on the confidentiality, integrity or availability of its Information Assets, prioritizing the implementation of controls according to that assessment.
6.4 Risk mitigation and acceptance
With respect to each identified risk, the Data Controller may choose to mitigate it by implementing additional controls, transfer it through contractual or insurance mechanisms where applicable, or consciously accept it when its likelihood and impact are reasonably low and the cost of mitigation is disproportionate.
6.5 Periodic risk review
The Data Controller will periodically review its security risk assessment, particularly upon the incorporation of new modules, providers, or significant changes in its technology infrastructure.
6.6 Consequences of non-compliance
The absence of a reasonable risk-management process may be considered a relevant factor in determining the Data Controller's diligence in a claim based on a Security Incident.
TITLE III. ACCESS AND AUTHENTICATION CONTROLS
Chapter 7. Logical Access Control
7.1 Legal objective
To establish the controls through which the Data Controller restricts access to its Information Assets pursuant to the least-privilege principle indicated in section 3.3.
7.2 Assignment of access according to function
The Data Controller grants its personnel and collaborators access to the systems and information strictly necessary to perform their functions, avoiding the generalized assignment of broad administrative permissions.
7.3 Periodic access review
The Data Controller will periodically review the access granted to its personnel and collaborators, timely revoking access that is no longer necessary, particularly upon conclusion of the corresponding employment or collaboration relationship.
7.4 Segregation of duties
To the extent its organization's size permits, the Data Controller seeks to segregate the functions of development, infrastructure administration, and data administration, in order to reduce the risk of misuse of privileged access.
7.5 Activity logging
The Data Controller maintains, to the extent technically reasonable, activity logs of access to systems containing Confidential or Highly Confidential Information, enabling traceability of such access for audit and Security Incident investigation purposes.
7.6 Consequences of non-compliance
Granting access that does not observe the least-privilege principle, or failing to timely revoke unnecessary access, shall constitute a breach of this Policy.
Chapter 8. Identity and Authentication Management
8.1 Legal objective
To establish the controls through which the Data Controller verifies the identity of those accessing its systems and the Platform.
8.2 Authentication of Platform Users
User access to the Platform is governed by the Account security mechanisms described in Chapter 11 of the Terms and Conditions of Service, including the possibility of multi-factor authentication pursuant to section 11.2 of that document.
8.3 Authentication of the Data Controller's personnel and collaborators
The Data Controller requires its personnel and collaborators with access to systems containing Confidential or Highly Confidential Information to use strong passwords and, to the extent technically available, multi-factor authentication, to access those systems.
8.4 Credential lifecycle management
The Data Controller implements reasonable processes for the creation, modification and timely revocation of its personnel's and collaborators' access credentials, particularly upon role changes or conclusion of the corresponding relationship.
8.5 Prohibition of shared credentials
The Data Controller's personnel or collaborators are prohibited from sharing their internal-system access credentials with unauthorized third parties, consistent with the analogous prohibition applicable to Users pursuant to section 4.1 of the Acceptable Use Policy.
8.6 Consequences of non-compliance
Non-compliance with the authentication controls provided in this Chapter by the Data Controller's personnel or collaborators shall give rise to the corresponding internal disciplinary measures.
Chapter 9. Encryption and Data Protection
9.1 Legal objective
To establish the Data Controller's approach regarding the use of encryption as a security control for protecting the confidentiality and integrity of information.
9.2 Encryption in transit
The Data Controller protects, through industry-recognized encryption protocols (such as TLS), all data communication between Users' devices and the Platform's infrastructure, as well as communications between the internal components of that infrastructure, where technically applicable.
9.3 Encryption at rest
The Data Controller seeks to encrypt Highly Confidential Information stored in its databases and backup systems, to the extent of the technical capabilities of its infrastructure and its Cloud Infrastructure Providers.
9.4 Encryption key management
When the Data Controller directly manages encryption keys, it will implement reasonable controls for their safekeeping, periodic rotation, and restricted access pursuant to the least-privilege principle.
9.5 Payment-instrument data
Pursuant to section 32.3 of the Terms and Conditions of Service, complete payment-instrument data is not stored directly by the Data Controller, its protection being the responsibility of the corresponding payment gateway provider, under the card-payment industry standards (PCI DSS) that provider observes.
9.6 Consequences of non-compliance
Storing or transmitting Highly Confidential Information without the reasonably required encryption measures under this Chapter shall constitute a breach of this Policy and of the accountability principle provided in applicable Personal Data protection legislation.
TITLE IV. INFRASTRUCTURE AND THIRD-PARTY SECURITY
Chapter 10. Cloud Infrastructure Security
10.1 Legal objective
To establish the Data Controller's approach regarding the security of the technology infrastructure hosting the Platform, considering that such infrastructure is provided, wholly or partially, by Cloud Infrastructure Providers.
10.2 Shared responsibility model
The Data Controller acknowledges and operates under the shared responsibility model typical of cloud computing services, in which the Cloud Infrastructure Provider is responsible for the physical security of its data centers and the underlying infrastructure, while the Data Controller is responsible for the secure configuration of that infrastructure, access management, and the security of the applications and data it hosts on it.
10.3 Selection of Cloud Infrastructure Providers
The Data Controller selects its Cloud Infrastructure Providers considering, among other factors, their industry-recognized security certifications, their track record, and the contractual availability and security guarantees they offer.
10.4 Infrastructure segmentation
The Data Controller seeks to segment its infrastructure so that a security compromise of one component does not, by itself, compromise the entirety of the Platform.
10.5 Technical vulnerability management
The Data Controller implements reasonable processes for the identification and timely remediation of technical Vulnerabilities in its infrastructure, including the periodic updating of software components as their providers publish security updates.
10.6 Security testing
The Data Controller may conduct, with the frequency proportional to its stage of development and the reasonably available resources, security tests on its infrastructure, such as vulnerability analyses or penetration tests, either with its own resources or through specialized third parties.
10.7 Consequences of non-compliance
Failure to reasonably manage known Vulnerabilities in the Platform's infrastructure may be considered a relevant factor in determining the Data Controller's diligence in a claim based on a Security Incident.
Chapter 11. Provider and Third-Party Management
11.1 Legal objective
To establish the controls the Data Controller applies regarding Cloud Infrastructure Providers, third-party Artificial Intelligence Providers, and other data processors processing Information Assets on its behalf.
11.2 Prior provider assessment
Before engaging a new provider that will process Confidential or Highly Confidential Information, the Data Controller conducts a reasonable assessment of its security practices, considering its certifications, public policies, and available contractual guarantees.
11.3 Contractual security obligations
The Data Controller incorporates into its contractual instruments with such providers obligations of confidentiality, implementation of reasonable security measures, and notification of Security Incidents those providers may identify, consistent with the provisions of Chapter 10 of the Full Privacy Notice.
11.4 Continuous monitoring of critical providers
The Data Controller reasonably follows the security performance of its critical providers, including review of incident or vulnerability reports those providers make public.
11.5 Contingency plan for critical provider failure
The Data Controller considers, within its business-continuity planning pursuant to Chapter 14, scenarios of failure or discontinuation of a critical provider, including Cloud Infrastructure Providers and third-party Artificial Intelligence Providers.
11.6 Consequences of non-compliance
Engaging a provider without the reasonable assessment indicated in this Chapter, when that provider processes Confidential or Highly Confidential Information, may be considered a relevant factor in determining the Data Controller's diligence in a claim based on a Security Incident originating from that provider.
Chapter 12. Security in the Software Development Lifecycle
12.1 Legal objective
To establish the Data Controller's approach to incorporating security considerations throughout the Platform's development lifecycle, developing the security-by-design principle indicated in section 3.5.
12.2 Code review
The Data Controller seeks to ensure that significant changes to the Platform's source code undergo reasonable review prior to production deployment, in order to identify potential Vulnerabilities or security errors.
12.3 Environment separation
The Data Controller seeks to maintain reasonable separation between its development, testing and production environments, avoiding the use of real Highly Confidential Information in development or testing environments, unless such information is previously anonymized or replaced with synthetic data.
12.4 Third-party dependency management
The Data Controller reasonably tracks known Vulnerabilities in the third-party libraries and software components it integrates into the Platform, updating those components as necessary to address those Vulnerabilities.
12.5 Secure management of secrets and technical credentials
The Data Controller implements reasonable mechanisms for the safekeeping of API keys, database access credentials, and other technical secrets used in the Platform's development and operation, avoiding their exposure in source code or in unrestricted-access repositories.
12.6 Consequences of non-compliance
The incorporation of known and avoidable Vulnerabilities into the Platform's production code, due to failure to reasonably observe this Chapter, may be considered a relevant factor in determining the Data Controller's diligence in a claim based on a Security Incident.
TITLE V. INCIDENT AND CONTINUITY MANAGEMENT
Chapter 13. Security Incident Management
13.1 Legal objective
To establish the procedure through which the Data Controller identifies, contains, investigates and remediates Security Incidents affecting the Platform, consistent with the provisions of Chapter 20 of the Full Privacy Notice regarding breaches involving Personal Data.
13.2 Internal and external reporting channel
Personnel, collaborators and Users may report a suspected Security Incident via the email address legal@ancuria.com, specifically enabled for that purpose.
13.3 Severity classification
The Data Controller will classify every reported or detected Security Incident according to its severity, considering the type of Information Asset involved, the volume of data affected, and the potential impact on Users, in order to determine the corresponding response priority and resources.
13.4 Containment and remediation
Upon a confirmed Security Incident, the Data Controller will take reasonable immediate containment measures aimed at limiting its scope, followed by investigation of its root cause and implementation of remediation measures preventing its recurrence.
13.5 Notification to affected Users
When a Security Incident involves Personal Data and is significant pursuant to section 20.1 of the Full Privacy Notice, the Data Controller will notify the affected Data Subjects pursuant to the procedure established there.
13.6 Incident documentation
The Data Controller will document every confirmed Security Incident, including its nature, scope, root cause, and the remediation measures implemented, documentation that may be made available to auditors or competent authorities as applicable.
13.7 Consequences of non-compliance
The absence of a reasonable Security Incident management procedure, or the omission of notification when legally required, shall constitute a breach of this Policy and, where applicable, of applicable Personal Data protection legislation.
Chapter 14. Business Continuity and Disaster Recovery Plan
14.1 Legal objective
To establish the Data Controller's approach to guaranteeing the continuity of Platform operations in disruptive events, and the recovery of its infrastructure from a disaster.
14.2 Identification of critical processes
The Data Controller identifies the processes and technology components critical to the Platform's continuous operation, prioritizing its continuity and recovery efforts on them.
14.3 Recovery objectives
The Data Controller seeks to define, as its infrastructure's maturity evolves, reasonable recovery time objectives (RTO) and recovery point objectives (RPO) for its critical processes — that is, the maximum tolerable service interruption time and the maximum tolerable data loss in an incident, respectively.
14.4 Redundancy of critical infrastructure
The Data Controller seeks, to the extent of the capabilities offered by its Cloud Infrastructure Providers and the reasonably available resources, to incorporate redundancy mechanisms for its most critical infrastructure components.
14.5 Continuity plan testing
The Data Controller seeks to periodically test its recovery mechanisms, including backup restoration tests pursuant to Chapter 15, in order to verify their real effectiveness.
14.6 Consequences of non-compliance
The absence of a reasonable business-continuity approach may be considered a relevant factor in determining the Data Controller's diligence in a prolonged Service interruption, without prejudice to the provisions of Chapter 41 (Force Majeure and Acts of God) of the Terms and Conditions of Service regarding events beyond its control.
Chapter 15. Backup and Information Retention
15.1 Legal objective
To establish the Data Controller's approach regarding the generation of backups of Platform information, as a control complementary to that information's availability and integrity.
15.2 Periodic backup generation
The Data Controller generates, with a frequency reasonable for the criticality of each Information Asset, backups of the Platform's databases and systems.
15.3 Secure backup storage
The backups generated under this Chapter are stored under the same encryption and restricted-access controls applicable to the original information, according to its classification level.
15.4 Backup retention
The Data Controller retains the generated backups for the period reasonably necessary for disaster-recovery purposes, without exceeding the applicable data retention periods pursuant to Chapter 21 and Chapter 35 of the Terms and Conditions of Service and of the Full Privacy Notice, respectively.
15.5 Consequences of non-compliance
The absence of reasonable backups of the Platform's critical information may be considered a relevant factor in determining the Data Controller's diligence in a loss of information deriving from a Security Incident.
TITLE VI. COMPLIANCE AND FINAL PROVISIONS
Chapter 16. Training and Awareness
16.1 Legal objective
To establish the Data Controller's commitment regarding the training of its personnel and collaborators in information security matters, recognizing the human factor as a central element of security risk management.
16.2 Onboarding training
The Data Controller seeks to ensure its personnel and collaborators receive, at the start of their relationship with the Data Controller, reasonable information about the information-security obligations applicable to them under this Policy.
16.3 Ongoing awareness
The Data Controller seeks to keep its personnel and collaborators informed about relevant security threats, such as social engineering or phishing techniques, as the threat landscape evolves.
16.4 Consequences of non-compliance
The provisions of this Chapter describe the Data Controller's training commitment, without this generating specific result obligations other than those expressly agreed in the Terms and Conditions of Service.
Chapter 17. Audit and Compliance
17.1 Legal objective
To establish the Data Controller's approach regarding verification of compliance with this Policy, and its willingness to handle external audit processes.
17.2 Internal audit
The Data Controller may conduct, with a frequency proportional to its stage of development, internal reviews of compliance with this Policy.
17.3 Handling Due Diligence audits
The Data Controller will make available to investors, auditors or potential acquirers, under the corresponding confidentiality agreements, the reasonable documentation evidencing compliance with this Policy, including the Security Incident documentation pursuant to section 13.6.
17.4 Aspiration to future certifications
The Data Controller declares its intention to assess, as the organization grows and the Platform reaches greater operational maturity, the convenience of obtaining international information-security certifications, such as ISO/IEC 27001 or SOC 2, without this declaration constituting a binding commitment to obtain such certifications within a determined period.
17.5 Collaboration with competent authorities
The Data Controller will collaborate diligently with the competent authorities in data protection and information security matters, in the terms indicated in Chapter 23 of the Full Privacy Notice.
17.6 Consequences of non-compliance
Failure to reasonably collaborate in an audit or Due Diligence process may be considered a relevant warning sign for the corresponding auditor or investor, without that constituting, by itself, a contractual breach toward the Users.
Chapter 18. Validity and Final Provisions
18.1 Entry into force
This Policy shall enter into force on the date stated on the cover page of this document.
18.2 Modifications
The Data Controller may modify this Policy at any time, particularly to reflect the evolution of its technology infrastructure, providers, or industry best practices, pursuant to the periodic review mechanism indicated in section 4.4.
18.3 Severability
Should any provision of this Policy be declared null, illegal or unenforceable by a competent authority, such declaration shall not affect the validity and enforceability of the remaining provisions.
18.4 Governing language
In the event of translation into another language, the Spanish (Mexico) version shall prevail for interpretation purposes in case of discrepancy.
18.5 Interpretation according to guiding principles
In case of any ambiguity in the interpretation of this Policy, the interpretation most consistent with the guiding principles established in Chapter 3 must be favored.
Version Control Annex
| Version | Effective date | Description of the change |
|---|---|---|
| 1.0 | September 22, 2026 | Initial version of the document |