Information security

Overview

The management of SMP Solutions Zrt. (hereinafter: the Company) is committed to maintaining and continuously improving the security of information, IT systems and related services. The Company’s objective is to ensure that the confidentiality, integrity and availability of the information and information processing systems it manages – including cloud-based services and environments – are guaranteed under all circumstances, in accordance with business, regulatory, contractual and standards-based requirements.

The scope of this Policy extends to the Company’s entire information and IT environment, the use and provision of cloud-based services, and all employees, contracted partners, suppliers and other stakeholders.

The Company manages information security using a risk-based approach, under which the protective measures implemented are determined in proportion to the sensitivity of the information, the business risks, and the extent of threats and vulnerabilities. The results of the risk management process are regularly reviewed by senior management.

The Company applies the shared responsibility model for cloud services, under which the boundaries of responsibility between the cloud service provider and the Company are clearly defined and documented. Within this framework, the Company is responsible for the security of the data, access rights, configurations and applications it manages.

The Company ensures that security requirements are incorporated at the design and implementation stages of its systems and that, subject to ongoing review during operation, they comply with statutory, standard and contractual requirements.

The tasks relating to the design, implementation, operation and monitoring of the information and communications, IT and information systems operated by the Company must be carried out in such a way that the protection of the systems complies with statutory requirements and the cost of such protection is proportionate to the potential value of the loss.

To this end:

We have designed, implemented and are continuously developing our Information Security Management System (ISMS) in accordance with the MSZ ISO/IEC 27001:2023 standard, taking into account the ISO/IEC 27017 and 27018 guidelines for cloud-based services.
We ensure that the occurrence of information security incidents is minimised, that incidents are investigated and documented, and that statutory reporting obligations are met.
We ensure that users are aware of information security threats and the rules that apply to them.
We protect information and information-processing equipment from unauthorised access, alteration, loss and destruction, including in cloud-based environments.
We operate the systems and manage changes in accordance with documented procedures, ensuring that changes are traceable and verifiable.
We carry out the procurement of new information systems and the development of existing systems whilst taking full account of information security considerations.
We regularly set and review measurable information security objectives that support the continuous improvement of the IBIR.
We are committed to complying with EU and Member State legislation on the processing and protection of personal data, as well as with the specific requirements regarding the processing of personal data set out in the contracts of customers using the Company’s services.
When providing cloud services, we ensure that the confidentiality, integrity and availability of customer data comply with industry standards and the requirements of ISO/IEC 27017 and 27018.
We ensure that, in the case of cloud services, the shared responsibility model is clearly defined and documented.
We ensure that risks arising from authorised insiders (including internal and external staff and suppliers with access to data) are identified, assessed and managed. Access is restricted to the minimum necessary, is reviewed regularly, and all privileged access requests are logged.
We ensure that users’ data is stored in a logically segregated manner, with appropriate security measures in place, even in a multi-tenant environment.
We ensure that only authorised personnel have access to customer data within the cloud service and that all access is logged. We regularly review access rights to ensure that only the necessary level of access remains in place. We ensure the protection of customer data through risk-proportionate technical and organisational measures, in accordance with access management principles and data protection requirements.
In the case of privileged and administrative access, we apply risk-based controls (e.g. strong authentication, logging, regular reviews).
We ensure that the entire lifecycle of accounts held by customers using our cloud service – creation, modification, suspension and termination – is carried out in accordance with regulated and documented processes. The granting and revocation of access rights takes place in a controlled manner, ensuring that access is restricted to the minimum necessary.
In the event of changes affecting cloud services – particularly those relating to security, configuration or operational changes – we ensure that customers are informed in a timely and transparent manner. This communication will detail the nature of the change, its impact and any actions required on the part of the customer.
In virtualisation environments, we ensure logical isolation, risk management and the secure configuration of virtual machines and containers. Access to the virtualisation layer is strictly controlled and logged, and changes to configurations can be tracked in a documented manner.
We manage the entire lifecycle of user accounts in a controlled manner.
We ensure that cloud services are logged and monitored, and that events are analysed on a regular basis.
In the event of an information security incident, we will immediately inform the affected customers and, within the legal and contractual framework, cooperate with the authorities and customers to support investigations. The retention and handover of log data and relevant information required for forensic investigations are carried out in a regulated manner.
We inform users about the specific features of using cloud services, with particular regard to provider access, multi-tenant operation and privileged access.
When using cloud services, we ensure that access is restricted, configurations remain secure, risk management is ongoing, and the cloud service provider operates only within an appropriate security and legal framework.
Data is stored and processed exclusively in geographical locations that comply with EU and relevant legal requirements.

Budapest, 15 June 2026.

Edward László Papp, Chief Executive Officer