Compliance

Internal Information Management Policy

Regulations for managing internal information

Effective Date: October 15, 2025

Chapter 1: General Provisions

Article 1 (Purpose)

This policy establishes basic matters concerning the management of internal information at Stellar AI Inc. (hereinafter referred to as "Company") to protect the Company's information assets, clarify the responsibilities and obligations of executives and employees, and ensure compliance with relevant laws and regulations.

Article 2 (Scope of Application)

This policy applies to all executives, employees, and partner company staff of the Company.

  • All types of employees including full-time, contract, and dispatched workers
  • All partner company staff with access to Company information including outsourcing and subcontractors
  • Temporary workers including interns and probationary employees

Article 3 (Definitions)

Terms used in this policy are defined as follows:

  • Internal Information: All information related to the Company's business including management, sales, technology, and customer information
  • Confidential Information: Core trade secrets, AI technology-related information, customer data, and other information that could cause significant damage to the Company if leaked externally
  • Personal Information: Information that can identify individuals in accordance with the Personal Information Protection Act
  • Information Assets: All forms of assets containing information including documents, electronic documents, databases, software, and hardware

Chapter 2: Internal Information Management System

Article 4 (Information Security Officer)

Information Security Officer

Name: Jeong Ji-young

Position: CEO

Responsibilities: Overall responsibility for establishing, operating, and improving the internal information management system

Article 5 (Information Classification)

The Company's internal information is classified as follows:

Classification Definition Examples
Level 1: Top Secret Critical impact on Company existence if leaked AI algorithm source code, core technical documents, M&A information
Level 2: Confidential Significant damage to Company if leaked Customer contracts, sales strategies, financial information
Level 3: Internal Use General business information for internal use only Internal meeting minutes, work manuals, organizational charts
Public Information that can be disclosed publicly Company brochures, public job postings, press releases

Chapter 3: Information Security Measures

Article 6 (Access Control)

  • Access to information assets is limited to the minimum necessary for business purposes
  • Level 1 confidential information is accessible only to those approved by the CEO
  • Access rights are regularly reviewed and unnecessary permissions are immediately revoked
  • All access rights of departing employees are deleted immediately upon departure

Article 7 (Physical Security)

  • Access control systems are installed in major information asset storage locations such as server rooms and computer rooms
  • Confidential documents are stored in locked cabinets
  • ID cards must be worn when entering the office, and visitor passes are issued for external visitors
  • Work PCs have screen savers and automatic lock functions enabled

Article 8 (Technical Security)

  • All information systems apply the latest security patches
  • Critical information is encrypted for storage and transmission
  • Antivirus programs are installed with real-time monitoring enabled
  • Firewalls and intrusion detection systems are operated
  • Passwords must be at least 10 characters combining letters, numbers, and special characters

Article 9 (AI System Security)

Special security measures for AI systems, the Company's core business:

  • AI training data and models are encrypted for storage, and access logs are recorded
  • Customer AI system integration project information is classified as Level 1 confidential
  • AI algorithm source code is version-controlled through configuration management systems, and external removal is prohibited
  • De-identification of personal information is mandatory when analyzing customer data

Chapter 4: Employee Obligations

Article 10 (Confidentiality Obligations)

  • Employees must not disclose or improperly use internal information learned during employment, both during and after employment
  • Customer information obtained through work cannot be used for purposes other than work
  • Prior approval from the Information Security Officer is required when posting Company-related information on SNS, blogs, etc.

Article 11 (Information Export and Disposal)

  • External export of confidential information requires prior approval from the Information Security Officer
  • Unnecessary information must be completely destroyed using irrecoverable methods
  • Transmission of work information via personal email, cloud storage, etc. is prohibited
  • Upon resignation, all Company information must be returned and deleted from personal devices

Chapter 5: Security Incident Response

Article 12 (Incident Reporting and Response)

  • Information security incidents must be immediately reported to the Information Security Officer
  • The Company analyzes the cause of incidents and establishes prevention measures
  • In case of personal information leakage, reporting and notification procedures are followed in accordance with relevant laws

Article 13 (Training and Inspection)

  • Information security training is conducted for all employees at least twice a year
  • Information security inspections are conducted quarterly and vulnerabilities are addressed
  • New employees must complete information security training upon joining

Chapter 6: Violations

Article 14 (Disciplinary Action)

The following measures may be taken for violations of this policy:

  • Disciplinary actions including warnings, reprimands, salary reduction, suspension, and dismissal
  • Claims for damages
  • Criminal prosecution (for violations of the Unfair Competition Prevention Act, Personal Information Protection Act, etc.)

Supplementary Provisions

Article 15 (Effective Date)

This policy becomes effective on October 15, 2025.

Article 16 (Amendments)

Amendments to this policy require CEO approval and must be announced to all employees at least 7 days before implementation.