Safety & Compliance

DEOS Trust Management System

Governance, Risk Management, Policy Oversight, And Continuous Improvement

Company: I REVLAB, INC.
Platform: DEOS
Program Owner: DEOS Management, supported by Engineering, Security, Operations, and Legal
Prepared by: DEOS Engineering, Management, and Legal Departments
Version: 2.1
Last Updated: November 4, 2026
Review Cycle: At least annually and following material changes

The DEOS Trust Management System (DTMS) provides the management structure through which we direct, operate, evaluate, and improve our security, privacy, reliability, and compliance programs. It connects leadership accountability, documented policies, risk assessment, control ownership, recurring reviews, and corrective action. Its purpose is to protect dealership and Company information while supporting dependable, authorized operation of DEOS and its connected AI services. This document explains the program's governing principles, the responsibilities of the DEOS Trust Management Forum, our review cadence, and the evidence used to support management decisions and customer assurance.

Contents

01. Why Structured Trust Management Matters

Customer trust depends on more than individual security tools or written policies. It requires an operating process that identifies risks, assigns responsibility, makes informed decisions, and follows through on corrective action. The DTMS establishes that process across the functions responsible for DEOS.

The program connects business commitments to the systems, people, providers, and controls that support them. Leadership receives a consistent view of significant risks, service dependencies, security findings, incidents, and resource needs. Teams receive clear requirements and a defined route for raising issues and obtaining decisions.

Customer feedback, reported concerns, operating experience, and changes in technology inform the program. We evaluate that input against security, privacy, reliability, legal, and contractual requirements. A requested feature or commercial objective does not override a protected data boundary or an applicable individual right.

02. Framework Alignment And Program Scope

The DTMS uses ISO/IEC 27001:2022 as a management-system reference for risk-based information security, leadership oversight, performance evaluation, and continual improvement. The Cloud Security Alliance Cloud Controls Matrix (CSA CCM) informs assessment of cloud controls, provider responsibilities, and shared-service dependencies.

The program also supports the DEOS SOC 2 Type 1 compliant-ready management position and preparation for an independent CPA examination and report. Control mapping considers the AICPA Trust Services Criteria and the system scope described in the DEOS readiness statement. Framework alignment, management readiness, and independent assurance are distinct descriptions and are communicated according to their actual basis.

The DTMS encompasses DEOS personnel and contractors, corporate and cloud systems, applications, APIs, integrations, data stores, AI models and agents, communications, and material contracted services. It includes production, development, testing, support, recovery, and offboarding activities according to their access and risk.

Control selection considers the defined service boundary, information sensitivity, legal duties, customer commitments, threats, and provider dependencies. Applicability decisions and the reasons for exclusions are documented. A control cannot be disregarded merely because it is inconvenient, and a framework reference does not replace a binding requirement.

The DTMS provides management oversight of the Information Security Management Program (ISMP) described in the DEOS Security & Technology Policies. Detailed policies and procedures implement the controls; the Trust Management System coordinates ownership, review, and improvement.

03. Leadership And The Trust Management Forum

The DEOS Trust Management Forum (Trust Forum) brings together the functions responsible for security, engineering, privacy, reliability, operations, and compliance, with management participation appropriate to the decision. Responsibilities may be held by designated individuals rather than separate departments, but every material action has an identified owner.

The Trust Forum's responsibilities are to:

Management remains accountable for the program's direction, risk acceptance, and resources. Engineering and control owners implement technical requirements. Security coordinates threat and control review. Legal and privacy responsibilities address applicable processing, notices, contracts, rights, and regulatory changes. Operations coordinates service delivery, escalation coverage, and recovery responsibilities.

The Trust Forum does not replace an incident-response lead, a service owner's immediate operational authority, or a legally required decision-maker. Urgent risks and incidents are escalated promptly rather than deferred until the next scheduled meeting.

04. Policy Management Program

The Policy Management Program (PMP) establishes how DEOS policies are created, approved, communicated, maintained, and retired. Policies have an owner, defined scope, version, review cycle, and appropriate approval. Standards and procedures translate policy requirements into the activities needed to operate controls.

The following principles govern policy management:

An exception cannot authorize unlawful processing, waive a nonwaivable right, or override contractual confidentiality, dealer separation, or approved AI-processing restrictions. Material deviations requiring a contractual change must follow the applicable agreement process before implementation. Repeated or expired exceptions are escalated for remediation or a formal design decision.

The DEOS Security & Technology Policies provide the domain overview for access, assets, data handling, networks, encryption, devices, operations, personnel, physical security, privacy, AI, incidents, providers, development, testing, and assurance.

05. Risk Management And Control Selection

Risk assessment identifies what could adversely affect dealership information, customer commitments, Company operations, and individual rights. Assessments consider likelihood, impact, existing controls, dependencies, and the consequences of control failure. Security, privacy, reliability, and compliance risks are considered together where they affect the same workflow.

Risk records identify the relevant system or process, affected information, accountable owner, assessment basis, treatment decision, and review or completion date. Treatment may include reducing the risk, changing or discontinuing the activity, transferring an appropriate portion through contract or insurance, or accepting residual risk within authorized limits. A transfer arrangement does not remove a direct legal duty.

Assessments are refreshed following material changes, relevant incidents, significant findings, new provider dependencies, or a change in processing purpose. Risk and vulnerability reviews occur quarterly under Section 07, with earlier escalation for significant concerns.

The Trust Forum tracks actions to closure using appropriate evidence. An action is not considered resolved solely because a ticket was closed or a revised policy was written; the responsible owner must establish that the required change was implemented and the identified issue addressed.

06. Dealership Data And AI Governance

Trust oversight includes the separation of dealership environments, authorized vendor connections, controlled access, and the treatment of customer information throughout its lifecycle. Dealer group, agency, and OEM relationships do not automatically authorize access across stores or pooling of customer records.

The AI Governance Policy governs model and agent purposes, processing boundaries, tools, permissions, evaluation, release, and escalation. The Trust Forum reviews material changes affecting private DDU processing, tenant separation, shared improvement, or autonomous execution. Private customer records, prompts, conversations, biometric information, and likeness assets remain excluded from shared or general-purpose training for unrelated customers.

Customer communications require separate attention to consent, suppression, recipient eligibility, permitted content, scheduling, and human assistance. The Trust Forum monitors material control issues and recurring failure patterns; it does not replace the dealership's ownership of approved business instructions or the Company's own legal and contractual duties.

Significant decisions about new models, data sources, outside providers, or agent authority must have a documented purpose, impact review, accountable approval, and appropriate implementation evidence. An AI-generated proposal or a commercial request is not itself an approved change.

07. Review Cadence And Decision Records

The following reviews maintain the program's operating rhythm. Related reviews may be conducted together when the agenda, participants, and records preserve each review's purpose.

Review Frequency Primary Focus And Recorded Outcome
Management Review Annually, aligned with business planning and budgeting Program performance, significant risks and incidents, objectives, and management decisions.
Resource Review Annually, aligned with budgeting Required personnel, training, tooling, provider capacity, and investment priorities.
Risk And Vulnerability Review Quarterly Material risks, significant findings, treatment progress, exceptions, and overdue actions.
Security Health Review Monthly Access and control concerns, relevant threats, monitoring results, incidents, and remediation.
Compliance Health Review Monthly Policy adherence, applicable legal and contractual changes, privacy issues, assurance work, and evidence readiness.
Functional Management Review Weekly within each function Active delivery and control issues, operational dependencies, action ownership, and escalation needs.

Reviews record the responsible participants, relevant evidence, material decisions, assigned actions, target dates, and escalation. Decisions involving accepted risk or an exception also identify the approving authority and review conditions. Access to review records reflects their sensitivity.

The schedule is a minimum management cadence, not a reason to delay urgent action. Material incidents, suspected unlawful processing, cross-dealer exposure, or a failure of a critical control require prompt escalation through the appropriate response process.

08. Annual Information Security Program Review

The individual assigned to oversee the information security program prepares a written annual report for senior management. The report supports management's review of the program and decisions about priorities and resources. Its content also supports relevant customer oversight and applicable requirements addressed in the FTC Safeguards Rule, according to the Company's role and activities.

The report covers the program's overall status and material matters, including:

Management's response identifies approved priorities, assigned owners, and follow-through requirements. Material unresolved issues remain visible in subsequent reviews rather than disappearing after the annual reporting cycle.

09. Measurement, Testing, And Continuous Improvement

The DTMS evaluates both whether controls are designed for their purpose and whether evidence indicates that they are being operated as required. Measures may include overdue access reviews, significant unresolved vulnerabilities, time to contain incidents, repeated integration failures, recovery outcomes, and the status of corrective actions. Definitions and reporting periods must be clear enough to support meaningful comparison.

Testing and exercises follow the relevant DEOS policy and risk. The Security & Technology Policies retain quarterly continuity and recovery exercises. Security testing, incident exercises, model evaluations, and provider reviews contribute findings to the same action and risk-management process.

Improvement follows a documented cycle: identify an issue or opportunity, evaluate risk and impact, approve the action, implement it through the appropriate change process, assess the result, and update relevant documentation and training. A change must preserve existing dealer-data protections, lawful permissions, and agreed service boundaries.

The program distinguishes management metrics and internal evaluations from the scope of an independent assurance report. A SOC 2 Type 1 examination's point-in-time design scope is described accurately; broader internal monitoring does not change the examination into a different report type.

10. Customer Transparency And Assurance

Customers should be able to understand how DEOS governs their information and service commitments. We provide public policy information and support appropriate diligence through the DEOS Dealership Data Safeguards, Security & Technology Policies, AI Governance Policy, Privacy Policy, TCPA Policy, Federal And State Regulatory summary, and SOC 2 Type 1 Readiness statement.

Deployment-specific obligations and agreed protections are established through the applicable Subscription Terms, Order, and controlling addenda. Customer concerns, reported incidents, and relevant feedback enter the appropriate support, privacy, security, or governance process.

Assurance information is shared according to its actual scope and the need to protect other dealerships' information, sensitive security detail, and intellectual property. Appropriate confidentiality terms and redaction may apply. Provider certifications, framework references, and independent DEOS reports are identified separately and accurately.

11. Program Maintenance

DEOS reviews the DTMS at least annually and following material changes in operations, technology, risk, or legal obligations. Management approves significant changes and ensures that policy owners, affected teams, and relevant customers receive the communications required by the change and the applicable agreement.

12. Information Security Policies Notice

This document summarizes the DEOS security policy framework and communicates requirements for the personnel and providers within its scope. It does not, by publication alone, amend a customer agreement, create a separate service-level commitment, or change contractual remedies. Security or processing obligations expressly incorporated into an Agreement remain enforceable according to that Agreement.

DEOS reviews and updates its policies to reflect operational requirements, risks, technology, and law. Material changes follow applicable governance, contractual notice, and acceptance requirements. A policy revision does not retroactively authorize prohibited processing or reduce a nonwaivable right or duty.

Security controls are designed to manage risk and protect information; they do not guarantee that every incident or vulnerability will be prevented. This notice does not exclude responsibility for Company's own breach, negligence, unlawful conduct, or other liability contrary to law or the applicable Agreement. Customers and users remain responsible for the security duties assigned to them under their agreements.

Security, privacy, governance, and diligence inquiries: legal@deos1.com
Operational support and suspected account compromise: support@deos1.com

I REVLAB, INC.
4910 Communications Ave, Suite 120
Boca Raton, FL 33431