Safety & Compliance

DEOS Security & Technology Policies

Information Security Management Program And Control Framework

Company: I REVLAB, INC.
Platform: DEOS
Policy Owner: DEOS Management, supported by Engineering and Legal
Prepared by: DEOS Engineering, Management, and Legal Departments
Version: 2.1
Last Updated: November 4, 2026
Review Cycle: At least annually and following a material security, operational, regulatory, or architectural change

Purpose And Scope

DEOS maintains an Information Security Management Program (ISMP) governing the confidentiality, integrity, availability, and authorized use of its systems and information. The program combines documented policies, assigned responsibilities, risk assessment, technical safeguards, monitoring, and corrective action. Management oversees its operation and the resources needed to protect dealership and Company information.

These policies apply to personnel, contractors, approved service providers, corporate systems, cloud environments, applications, APIs, devices, AI models and agents, integrations, and information processed for DEOS. Relevant controls also apply to development, testing, support, backups, and service exit. Beta, trial, pilot, and free-access use does not remove applicable security or privacy requirements.

This document is the policy overview for the DEOS security program. Detailed standards, inventories, procedures, and response plans implement its requirements. Each control has an accountable owner and evidence appropriate to its purpose. Exceptions require documented approval, scope, compensating controls, and an expiration or review date; they cannot waive law, contractual data protections, or binding consumer restrictions.

Contents

01. Governance, Risk, And SOC 2 Readiness

DEOS's control framework supports its management-designated SOC 2 Type 1 compliant-ready position and ongoing preparation for an independent CPA examination and report. The related readiness statement organizes the Security Common Criteria and relevant Availability, Processing Integrity, Confidentiality, and Privacy criteria. Examination scope follows the agreed system description and selected criteria.

Management assigns ownership for security, engineering, privacy, operations, and material risk decisions. Risk review considers dealership data, business processes, dependencies, personnel access, cyber threats, AI-enabled actions, and reasonably foreseeable misuse. New systems, providers, integrations, and material changes enter this process before approved production use.

Significant risks, incidents, control exceptions, and corrective actions are escalated to management. Control requirements and responsibilities are communicated to the people performing the work. Review must distinguish a written control design, evidence that the control is implemented, and evaluation of its operation.

02. Access Management And Authentication

Access is granted through individually attributable human accounts or separately identified service and workload identities. Permissions follow least privilege, approved business need, role, and dealership scope. Shared human credentials are prohibited. Granting access requires an authorized request and appropriate approval; an agent or integration cannot grant itself additional permissions.

Multifactor authentication is required for workforce remote access to DEOS systems, privileged administration, customer administrative access, and other access designated by the applicable standard. Strong app-based or hardware-backed methods support protection against phishing and credential theft, with phishing-resistant methods prioritized for sensitive access. Service identities use controlled noninteractive authentication rather than shared employee credentials.

Conditional-access rules assess relevant device, session, location, and risk signals without silently removing mandatory authentication requirements. Sensitive and administrative access is restricted, reviewed, and logged. Segregation of duties or documented independent review applies to sensitive approvals and changes.

Access is reviewed on a risk-based schedule and after relevant role or organizational changes. Departing personnel lose access at the authorized termination time, with immediate action for involuntary departures or suspected compromise. Emergency access is limited, attributable, and subject to retrospective review. Users must protect credentials and promptly report suspected compromise.

03. Asset Management

DEOS maintains inventories appropriate to its hardware, endpoints, software, cloud resources, data stores, integrations, models, agents, and material service dependencies. Inventoried assets have identified owners, environment and business purpose, relevant data classification, and lifecycle responsibilities.

Approved use, configuration, licensing, support, and disposal requirements apply throughout an asset's life. Unknown, unsupported, or unnecessary components require assessment and remediation. Credential inventories identify the controlled secret reference and owner rather than exposing the secret value.

Company assets must be returned, access removed, and retained Company information addressed when employment or an engagement ends. Ownership and disposition are recorded. Assets containing sensitive information require secure erasure or destruction before reuse, return, or disposal.

04. Data Security, Classification, And Lifecycle Management

Information is classified according to sensitivity, purpose, legal obligations, contractual commitments, and business impact. The following baseline guides handling; a stricter applicable requirement controls.

Classification Typical Information Required Handling
Public Approved website copy, published product information, authorized sanitized demonstrations. Approved publication and change controls; no private information included by inference or metadata.
Internal Nonpublic general procedures, routine internal planning, nonsensitive operating material. Authorized business access and approved storage and communication channels.
Confidential Nonpublic contracts, financial planning, proprietary methods, sensitive architecture and business information. Need-to-know access, encryption, controlled disclosure, and defined retention.
Restricted Dealership customer records, DDU context, private prompts and conversations, regulated financial information, credentials, biometric and replica assets. Explicit purpose and access authorization, dealer separation, protected processing paths, encryption, restricted exports, and applicable deletion controls.

Derived information, logs, embeddings, summaries, and generated assets inherit the protection appropriate to their content. Masking a name does not automatically make information anonymous or Public. Reclassification requires authorized review of the actual information and intended use.

Data-flow documentation identifies sources, destinations, permitted fields, processing purposes, owners, and material providers. Collection and retention are limited to authorized needs. Changes, exports, and relevant access are traceable. Secure transport, handling, disposal, and recovery controls apply to operational copies and supporting systems.

Retention and deletion follow the Privacy Policy, Agreement, legal requirements, and applicable schedules. Replica and regulated biometric assets follow their separate, stricter destruction requirements. Backups and legal holds must not become a general basis for indefinite retention or continued production use. Restored data must have current deletion, permission, and suppression restrictions reapplied.

05. Dealership Separation And Integration Safeguards

Each dealership has a separately identified, access-controlled tenant environment. Tenant and role restrictions extend across APIs, records, retrieval, model context, conversations, caches, queues, scheduled work, generated assets, reporting, support tools, and exports. Shared infrastructure does not authorize shared customer access.

Dealer group, agency, and OEM access requires authority for the particular dealership environments and functions. A shared brand, similar customer name, or common vendor does not permit cross-dealer customer matching or pooling. Approved consolidated reporting preserves the participating environments' permissions and does not create an unrestricted pooled customer DDU.

Integrations use authorized vendor access methods, protected credentials, approved data mappings, and defined read and write scope. The DMS, CRM, scheduler, and other designated source systems retain their agreed authority for material records. An approved connection does not give one vendor unrestricted access to another vendor's information.

Before live use, owners validate the intended data path, authentication, dealer scope, permitted operations, and failure behavior. Credentials and permissions must be revoked when access ends. Necessary operational exchanges remain subject to confidentiality, security, and purpose restrictions.

06. Communications And Network Security

Network and service access is controlled according to business purpose, criticality, and information sensitivity. Production, development, administrative, and other relevant environments are segregated, with authorized connectivity between them. Externally exposed interfaces receive appropriate access, traffic, and abuse controls.

Administrative access uses approved secure channels. Firewall rules, service permissions, outbound destinations, and significant network changes follow controlled review. Unneeded connectivity and services are restricted. Personnel must use approved communication and file-transfer channels for Company and dealership information.

Email and collaboration safeguards address phishing, impersonation, unsafe attachments, and unauthorized disclosure. Suspected messages and requests for credentials or unusual access must be reported rather than acted on solely because they appear to come from a colleague, vendor, or dealership.

07. Cryptography, Encryption, And Key Management

DEOS protects sensitive information through approved encryption in transit and at rest, using current, appropriate cryptographic protocols and implementations. Cryptographic strength and handling reflect information classification and service requirements. Obsolete or prohibited algorithms and configurations must not be used for protected processing.

Keys, certificates, API secrets, and other cryptographic material have defined owners and restricted access. Generation, storage, distribution, renewal, rotation, revocation, and destruction follow approved procedures. Compromised or exposed material requires prompt response. Sensitive secrets must not appear in source code, ordinary logs, prompts, tickets, or public repositories.

Encryption complements authorization and purpose limitations; possession of a decryption capability does not create permission to access or reuse the underlying information.

08. Mobile Devices, Endpoints, And BYOD

Company-owned and approved personal devices must meet the security requirements of the information and systems they access. Relevant controls include supported software, security updates, device locking, encryption, approved authentication, and protection against malicious software. Nonconforming or compromised devices may have access restricted.

BYOD access requires approval and an appropriate managed-work or equivalent protection arrangement. DEOS limits administrative visibility and remote action to the authorized business scope where technically and legally practicable. Personal-device ownership does not permit uncontrolled storage or forwarding of Restricted information.

Loss, theft, or compromise must be reported promptly. Offboarding addresses sessions, credentials, business applications, and retained Company data. Remote removal of business information follows the applicable agreement and authority; it is not a general right to erase unrelated personal content. Required controls apply before sensitive access is enabled.

09. Technology Operations And Logging

Operational procedures define authorized activities, ownership, dependencies, escalation, and recovery steps. Capacity, service health, scheduled work, backup handling, software installation, and significant operational changes are managed through documented processes. Unnecessary or unapproved software is restricted.

Relevant security and operational events are forwarded to approved centralized monitoring or equivalent controlled collection. Logs are access-restricted, protected against unauthorized alteration, time-correlated, and retained according to their purpose. Logging must not unnecessarily capture full prompts, credentials, payment information, biometric assets, or unrestricted customer records.

Operational alerts and incidents follow the documented incident and escalation process. Material actions distinguish intent, attempt, destination acceptance, and final outcome. Failed jobs and retries preserve tenant scope and must not bypass permissions or create duplicate customer actions.

10. Business Continuity And Disaster Recovery

Owners of mission-critical systems and services maintain continuity and recovery plans proportionate to business impact and tolerance for disruption. No mission-critical production deployment proceeds without an appropriate continuity plan and assigned recovery responsibilities.

Service tiers define approved recovery time objectives (RTOs), recovery point objectives (RPOs), dependencies, and priorities. RTO specifies the targeted interval for restoring the defined service capability after disruption; RPO specifies the targeted recoverable-data position. Plans document their measurement points, with detection and escalation delays tracked separately rather than used to obscure customer impact.

Plans identify approved fallback capability, recovery prerequisites, communications, and return to normal operation. A reduced-function environment must preserve required data protection and permissions. Recovery must not route private dealership information to an unapproved external AI application or restore expired access and suppressed outreach.

Continuity and recovery plans are exercised quarterly, using scenarios appropriate to the service. Exercise scope and results are recorded, with identified issues assigned for correction. Backup restoration and material dependencies form part of the test program. Approved RTO/RPO targets do not create a separate customer SLA unless incorporated into the Agreement.

11. Personnel Security And Awareness

Job and engagement responsibilities include applicable security and confidentiality duties. Personnel receive role-appropriate security awareness at onboarding, regularly thereafter, and following relevant changes or incidents. Training addresses phishing, credential protection, dealer information, privacy, incident reporting, and permitted AI-tool use.

Employees and contractors must report suspected incidents, weaknesses, lost devices, and unauthorized access without unnecessary delay. Managers must arrange prompt permission changes when duties change and coordinate access removal and asset return when an engagement ends.

Personnel must not copy dealership information into unapproved AI, development, messaging, or support tools. Employment or administrative status does not grant unrestricted access to customer records. Necessary provider and support access remains limited to approved tasks.

12. Physical And Environmental Security

DEOS protects Company work areas, equipment, and information against unauthorized physical access, loss, and environmental risks. Access to controlled offices and storage areas is restricted; visitors and sensitive materials are handled according to their purpose and risk. Portable equipment and paper records require appropriate protection wherever work occurs.

For hosted infrastructure, physical and environmental responsibilities are allocated through the cloud-provider relationship and assessed through provider oversight. DEOS remains responsible for its own access and service configuration. Home or remote work must preserve screen privacy, device security, and secure handling of confidential material.

13. Privacy And Authorized Use

Privacy requirements are considered when selecting technology, designing workflows, configuring integrations, and managing data through its lifecycle. The assessment considers purpose, necessity, affected individuals, sensitivity, expected use, and potential harm. Privacy-enhancing technologies must support, rather than obstruct, lawful access, correction, deletion, and other applicable rights.

Dealership instructions and individual permissions have distinct roles. Account acceptance does not replace required marketing consent, recording permission, or a biometric release. Communication eligibility and suppression must be preserved across source synchronization, campaigns, retries, and recovery.

DEOS does not sell dealership customer records or authorize independent provider marketing or shared-model training on protected information. Necessary service processing remains restricted by the applicable agreements. Privacy safeguards and incident procedures must remain effective when information is copied, transformed, exported, or restored.

14. AI Systems, Models, And Agent Security

The AI Governance Policy controls model, agent, retrieval, media, and tool use. Models and material AI components have an identified purpose, owner, version, processing path, and approved input classes. Protected DDU context must remain within the approved DEOS processing boundary, without an uncontrolled fallback to an outside shared AI application.

Private customer records, prompts, conversations, biometric information, and likeness assets are excluded from shared or general-purpose training for unrelated customers. Common platform improvements use permitted inputs and controlled releases. Deidentification labels, embeddings, or model parameters do not automatically remove information protections.

Agents operate within approved dealership authority, tenant scope, tools, action limits, and escalation rules. Backend controls enforce permissions before retrieval and action. Customer content, retrieved documents, websites, and tool responses are treated as potentially untrusted inputs; embedded instructions cannot authorize a new operation or change security policy.

Evaluation addresses prompt injection, cross-tenant exposure, prohibited routing, unreliable outputs, unauthorized delegation, and unsafe execution. Failed controls require a held action, restricted workflow, or appropriate human review. Stop mechanisms and meaningful outcome records support accountable operation.

15. Security Incident Management

Incident management draws on NIST SP 800-61 Revision 3. All actual or suspected incidents affecting confidentiality, integrity, availability, or authorized processing must be reported, assessed, and handled through the security incident process. This includes cyber intrusions, credential exposure, cross-dealer access, defective suppression, unauthorized agent actions, and prohibited data routing.

Response procedures identify responsibility for triage, severity, containment, eradication, recovery, and management escalation. Protecting people and sensitive information is prioritized alongside preservation of evidence and essential customer commitments. Relevant legal and security owners assess notification recipients, deadlines, contractual duties, and regulatory requirements.

Critical incidents are escalated promptly to DEOS management. Customer communications provide appropriate available facts and updates without waiting beyond a governing deadline. Corrective action must address affected records, permissions, copies, and model or workflow artifacts where applicable, not merely the visible symptom.

The incident process is exercised regularly and reviewed after material events. Lessons learned inform risk assessment, procedures, training, and system changes.

16. Service Provider Management

Provider selection and onboarding use risk-based due diligence proportionate to data access, service criticality, and processing location. The business owner identifies the need, purpose, permitted information, dependencies, and responsible internal contacts. Appropriate security and privacy terms must precede access to protected data.

Provider requirements address confidentiality, access, authorized processing, independent-use and training restrictions, onward providers, incident cooperation, retention, and termination or return of information. Oversight evaluates continuing suitability and material changes. A provider's audit or certification is considered according to its actual scope.

Access is removed when its authorized purpose ends. Offboarding addresses credentials, active jobs, data return or deletion, retained records, and continuity dependencies, consistent with the provider agreement and law. Ending a service need does not itself override negotiated termination terms or mandatory record preservation.

17. System Acquisition, Secure Development, And Change Management

Security, privacy, availability, and integration requirements are incorporated into acquisition and development decisions. Secure development practices draw on NIST SP 800-218 Secure Software Development Framework (SSDF) and include appropriate code review, testing, dependency review, and controlled deployment. Significant changes have an identified owner, required approval, and rollback or disablement plan.

Production and preproduction access and data are separated. Synthetic or otherwise specifically authorized material is preferred for testing. Any approved use of production information in preproduction preserves its classification, purpose, access, and retention restrictions. Masking or pseudonymization is not presumed to eliminate personal-data obligations.

Third-party and open-source components undergo appropriate provenance, license, security, support, and dependency review. Unauthorized package installation, secret exposure, and unreviewed production changes are prohibited. Emergency changes follow a controlled process with subsequent review.

AI model versions, prompts, retrieval configuration, tool schemas, data mappings, and routing are included in change control where their modification can affect security or material service behavior.

18. Application Assessments And Threat Management

Applications and externally developed components that access, transmit, or store protected information receive risk-appropriate security assessment before approved use and after material changes. Assessments address authorization, tenant boundaries, authentication, input handling, secrets, data exposure, dependencies, and relevant AI threats.

The testing program uses code review, vulnerability assessment, scanning, penetration testing, and other appropriate methods according to system risk and applicable obligations. Findings are prioritized by severity, exposure, exploitability, and customer impact, with accountable remediation and documented treatment of accepted residual risk.

Vulnerability and threat management covers internal and hosted environments, endpoints, application components, integrations, and material dependencies. Relevant advisories and emerging threats inform patches, updates, configuration changes, and customer communications where appropriate. Malware protection, monitoring, and restricted execution reduce the opportunity for compromise.

Testing, deployment, or a resolved finding does not justify a claim that every vulnerability has been eliminated. Significant control failures are addressed through the incident, risk, and change processes as applicable.

19. Audit, Compliance, And Control Evidence

DEOS maintains a consolidated view of relevant control objectives, control activities, owners, evidence, and findings. Internal assessments and independent examinations are coordinated according to their defined scope and purpose. Evidence must be attributable, relevant, access-controlled, and retained under an appropriate schedule.

The program supports the DEOS SOC 2 Type 1 readiness statement. A SOC 2 Type 1 examination addresses the system description and suitability of control design as of a specified date; assessment of operating effectiveness over a period is distinguished from that scope. External assurance is described according to its actual entity, system boundary, criteria, date, and findings.

Legal and regulatory requirements are evaluated for the relevant processing role, information, jurisdiction, and activity. Required documentation, rights handling, consent records, provider oversight, and incident obligations are addressed through the applicable DEOS policies and agreements. Company does not treat a cloud provider's certification as its own or substitute framework alignment for a direct legal duty.

This overview is read together with the DEOS SOC 2 Type 1 Readiness statement, AI Governance Policy, Dealership Data Safeguards, Privacy Policy, TCPA Compliance And Communications Acceptable Use Policy, Federal And State Regulatory summary, and applicable Subscription Terms and addenda. Detailed operational standards and restricted security records are maintained through the Company's controlled internal processes.

21. Information Security Policies Notice

This document summarizes the DEOS security policy framework and communicates requirements for the personnel and providers within its scope. It does not, by publication alone, amend a customer agreement, create a separate service-level commitment, or change contractual remedies. Security or processing obligations expressly incorporated into an Agreement remain enforceable according to that Agreement.

DEOS reviews and updates its policies to reflect operational requirements, risks, technology, and law. Material changes follow applicable governance, contractual notice, and acceptance requirements. A policy revision does not retroactively authorize prohibited processing or reduce a nonwaivable right or duty.

Security controls are designed to manage risk and protect information; they do not guarantee that every incident or vulnerability will be prevented. This notice does not exclude responsibility for Company's own breach, negligence, unlawful conduct, or other liability contrary to law or the applicable Agreement. Customers and users remain responsible for the security duties assigned to them under their agreements.

Security, privacy, governance, and diligence inquiries: legal@deos1.com
Operational support and suspected account compromise: support@deos1.com

I REVLAB, INC.
4910 Communications Ave, Suite 120
Boca Raton, FL 33431