This Information Security & Cybersecurity Policy provides details about how Atypical Motions Publishing Inc. (AMPINC) protects information, technology, systems, services, and other assets under its control against unauthorized access, use, disclosure, alteration, loss, destruction, disruption, and other security threats.

AMPINC is committed to maintaining appropriate and proportionate administrative, technical, physical, and organizational safeguards based on the nature and sensitivity of information, the risks faced by the organization, applicable legal and regulatory requirements, and the services and technologies used by AMPINC.

AMPINC Website — atypicalmotions.com

This policy applies to AMPINC’s information, systems, devices, applications, websites, digital services, business processes, personnel, contractors, and third-party service providers where applicable.

AMPINC’s approach to information security is informed by recognized security and risk-management frameworks, including ISO/IEC 27001 and the NIST Cybersecurity Framework, as appropriate to the size, nature, and operational requirements of the organization. These frameworks promote risk management, governance, confidentiality, integrity, availability, resilience, and continual improvement.

Information Security Principles

AMPINC is committed to protecting information according to the following principles:

Confidentiality : Information will only be accessed, used, disclosed, or shared by authorized individuals or systems for legitimate and approved purposes.

Integrity : Information and systems will be protected against unauthorized or accidental alteration, destruction, corruption, or manipulation.

Availability : Critical information and systems will be maintained and recoverable to support legitimate business, research, publishing, and operational requirements.

Accountability : Security responsibilities will be assigned appropriately and AMPINC will maintain reasonable oversight of its information-security practices.

Risk-Based Protection : Security controls will be proportionate to the nature, sensitivity, volume, and potential impact of the information and systems involved.

Information Classification

AMPINC may classify information according to its sensitivity, business value, legal requirements, contractual obligations, and potential impact if compromised.

Information may include:

• Public information;

• Internal business information;

• Confidential information;

• Personal information;

• Sensitive or restricted information;

• Research or intellectual property;

• Credentials and authentication information;

• Financial, contractual, or legal information; and

• Information entrusted to AMPINC by clients, partners, contributors, participants, or other organizations.

Information requiring a higher level of protection will receive additional safeguards appropriate to the associated risks.

Access Control

AMPINC limits access to information and systems based on legitimate business requirements and, where appropriate, the principle of least privilege and need-to-know.

Access may include:

• User authentication;

• Strong and unique passwords;

• Multi-factor authentication where supported and appropriate;

• Role-based access;

• Administrative access restrictions;

• Periodic review of access privileges;

• Removal or modification of access when responsibilities change; and

• Prompt revocation of access when an individual no longer requires access.

Credentials must not be knowingly shared with unauthorized individuals.

AMPINC will make reasonable efforts to prevent unauthorized access to accounts, systems, devices, applications, documents, and information.

Authentication and Account Security

AMPINC will use reasonable safeguards to protect accounts and authentication information.

Where supported and appropriate, AMPINC may implement:

• Multi-factor authentication;

• Password managers;

• Strong password requirements;

• Account lockout or protective controls;

• Security alerts;

• Recovery controls; and

• Restrictions on administrative privileges.

Authentication credentials must be treated as confidential information and protected against unauthorized disclosure.

Device and Endpoint Security

Devices used to access AMPINC information or systems should be maintained in a secure and reasonably current state.

Reasonable safeguards may include:

• Supported operating systems and applications;

• Security updates and patches;

• Endpoint protection;

• Device encryption where appropriate;

• Screen locking;

• Secure configuration;

• Protection against unauthorized software;

• Secure disposal or reassignment of devices; and

• Restrictions on access from untrusted or compromised devices.

AMPINC will take reasonable precautions when using personal devices for business purposes.

Network and Communications Security

AMPINC will take reasonable measures to protect information transmitted through electronic communications and networks.

Where appropriate, AMPINC may use:

• Encrypted connections;

• Secure email and file-transfer services;

• Firewall and network-security controls;

• Secure wireless networks;

• Access restrictions;

• Monitoring and security alerts; and

• Other appropriate technical safeguards.

Sensitive information should not be transmitted through insecure channels where a reasonably secure alternative is available.

Encryption

AMPINC will consider encryption and other security technologies when appropriate to the sensitivity of information and the risks associated with its storage or transmission.

Personal, confidential, authentication, financial, research, intellectual-property, and other sensitive information may require stronger protection, including encryption at rest or in transit where appropriate.

Encryption requirements will be determined based on risk, available technology, contractual requirements, applicable law, and the sensitivity of the information.

Information Storage

AMPINC information may be stored using secure cloud services, third-party platforms, organizational systems, devices, physical records, or other appropriate storage environments.

AMPINC will take reasonable steps to protect information against:

• Loss;

• Theft;

• Unauthorized access;

• Unauthorized disclosure;

• Unauthorized copying;

• Unauthorized modification;

• Destruction;

• Corruption; and

• Other reasonably foreseeable security threats.

Where third-party service providers are used, AMPINC will consider the provider’s security practices, contractual obligations, privacy requirements, data location, access controls, and security risks as appropriate to the service.

Third-Party and Cloud Security

AMPINC may use third-party technology, cloud, communications, payment, website, hosting, research, analytics, collaboration, or other service providers.

Before using a third-party service for sensitive information, AMPINC will, where appropriate and reasonably practicable, consider:

• The type and sensitivity of information involved;

• The provider’s security practices;

• Privacy and data-protection requirements;

• Access controls;

• Encryption;

• Data storage and transfer locations;

• Contractual protections;

• Incident and breach notification practices;

• Data retention and deletion practices; and

• The potential impact of a security incident.

AMPINC will seek to limit third-party access to the information reasonably required to provide the applicable service.

Website and Application Security

AMPINC will take reasonable measures to protect atypicalmotions.com and other AMPINC digital services against unauthorized access, malicious activity, automated abuse, and other foreseeable threats.

Security measures may include:

• Secure website hosting;

• HTTPS/TLS encryption;

• Access controls;

• Bot and abuse protection;

• Software updates;

• Security configuration;

• Vulnerability monitoring;

• Backup and recovery measures; and

• Third-party security services where appropriate.

AMPINC may use third-party security technologies, including services that detect or prevent automated abuse, malicious traffic, or other threats.

Malware, Phishing and Cyber Threats

AMPINC will take reasonable precautions against malware, phishing, ransomware, social engineering, credential theft, unauthorized access, and other cyber threats.

Personnel and authorized users are expected to exercise reasonable care when:

• Opening attachments;

• Clicking links;

• Downloading software;

• Providing credentials;

• Responding to unexpected requests;

• Using removable media; or

• Accessing AMPINC systems from unfamiliar environments.

Suspected phishing, malware, credential compromise, or other security incidents should be reported promptly.

Security Awareness

AMPINC recognizes that information security is both a technical and organizational responsibility.

Where applicable, AMPINC will provide or encourage appropriate security awareness and training relating to:

• Confidentiality;

• Password and authentication security;

• Phishing and social engineering;

• Privacy and data protection;

• Secure handling of information;

• Device security;

• Incident reporting; and

• Applicable organizational security procedures.

AMPINC may require contractors, partners, or other authorized individuals to comply with applicable security requirements as part of contractual or working arrangements.

Physical Security

AMPINC will take reasonable measures to protect physical information, devices, equipment, and work environments.

Such measures may include:

• Secure storage of confidential records;

• Restricted access to sensitive materials;

• Protection of laptops and mobile devices;

• Secure handling of paper records;

• Protection of devices from theft or unauthorized use; and

• Secure disposal of physical records and equipment.

Data Minimization and Secure Handling

AMPINC will seek to limit the collection, creation, use, disclosure, and retention of information to what is reasonably necessary for legitimate business, research, publishing, operational, contractual, or legal purposes.

Information should be handled according to its sensitivity and the risks associated with unauthorized access, disclosure, alteration, or loss.

Where appropriate, AMPINC may use anonymization, pseudonymization, aggregation, access restrictions, or other privacy-enhancing techniques.

Research and Intellectual Property Security

AMPINC may conduct independent research involving information obtained from public sources, research participants, collaborators, organizations, datasets, or other legitimate sources.

Research information will be handled according to applicable legal, ethical, contractual, privacy, and security requirements.

AMPINC will take reasonable measures to protect confidential research materials, unpublished work, intellectual property, proprietary information, source materials, datasets, manuscripts, audiovisual materials, and other research assets against unauthorized access or disclosure.

Where research involves personal or sensitive information, additional safeguards may be implemented based on the nature and risk of the research activity.

Artificial Intelligence and Emerging Technology

AMPINC recognizes that artificial intelligence and emerging technologies may introduce additional security, privacy, intellectual-property, confidentiality, and integrity risks.

AMPINC will consider security and privacy implications before using AI systems or other emerging technologies to process confidential, personal, proprietary, research, or otherwise restricted information.

AMPINC will restrict the submission of confidential or sensitive information to external AI systems and will consider the provider’s data-use, retention, security, and privacy practices.

Security Monitoring

AMPINC may use reasonable technical and administrative measures to identify security events, unauthorized access, suspicious activity, vulnerabilities, or other threats.

Security monitoring will be proportionate to AMPINC’s size, resources, systems, risks, and legal obligations.

Where monitoring information contains personal information, AMPINC will handle that information in accordance with applicable privacy requirements.

Vulnerability and Security Management

AMPINC will take reasonable steps to identify and address security weaknesses affecting systems and information under its control.

Depending on the nature and risk of the environment, this may include:

• Security updates and patches;

• Vulnerability assessments;

• Configuration reviews;

• Access reviews;

• Security testing;

• Vendor security reviews;

• Backup testing; and

• Periodic review of security controls.

Security measures will be reviewed as technology, threats, business activities, and applicable requirements evolve.

Security Incidents

A security incident includes any actual or suspected event that may compromise the confidentiality, integrity, or availability of AMPINC information or systems.

Examples include:

• Unauthorized access;

• Lost or stolen devices;

• Compromised credentials;

• Malware or ransomware;

• Phishing;

• Unauthorized disclosure;

• Accidental transmission of information;

• Data loss;

• Website compromise;

• Unauthorized modification of information;

• System disruption; or

• Other suspected security breaches.

AMPINC will take reasonable steps to identify, contain, investigate, remediate, document, and learn from security incidents.

Where an incident involves personal information, AMPINC will assess whether notification or other action is required under applicable privacy or data-protection laws, contractual obligations, or regulatory requirements.

Business Continuity and Recovery

AMPINC recognizes the importance of maintaining access to critical information and services.

Where appropriate, AMPINC may maintain:

• Backups;

• Recovery procedures;

• Alternative access methods;

• Business continuity measures;

• Disaster recovery arrangements; and

• Procedures for restoring critical systems and information following an incident.

The level of continuity and recovery protection will be proportionate to the importance and risk associated with the applicable system or information.

Secure Disposal

Information, devices, media, and records that are no longer required will be securely disposed of or destroyed in accordance with applicable retention requirements.

Depending on the format and sensitivity of the information, secure disposal may include:

• Secure deletion;

• Destruction of physical records;

• Device wiping;

• Secure destruction of storage media; or

• Deletion through appropriate third-party services.

Information will not be retained solely because it is technically possible to retain it where retention is no longer necessary and no legal, contractual, research, archival, or other legitimate requirement applies.

Legal and Regulatory Requirements

AMPINC will consider applicable information-security, privacy, cybersecurity, intellectual-property, contractual, and other legal requirements relevant to its activities.

AMPINC may interact with individuals and organizations internationally, security and privacy requirements may differ depending on the jurisdiction, nature of the activity, location of the individual or organization, and type of information involved.

Applicable requirements may include Canadian privacy legislation and, where applicable, international or foreign data-protection and security requirements.

This policy is intended to complement, and not replace, AMPINC’s Privacy Notice and any specific contractual, regulatory, research, or security requirements applicable to a particular activity.

Security Responsibilities

AMPINC is responsible for establishing and maintaining appropriate information-security practices.

The AMPINC privacy and security officer is responsible for coordinating the organization’s privacy and security practices, including:

• Maintaining this policy;

• Supporting risk identification and assessment;

• Coordinating security and privacy matters;

• Reviewing security incidents;

• Supporting appropriate security controls;

• Coordinating third-party security considerations;

• Promoting security awareness; and

• Reviewing the effectiveness of security practices.

Where AMPINC works with contractors, partners, vendors, or other third parties, applicable security responsibilities may be established through agreements or other appropriate arrangements.

Risk Management

AMPINC uses a risk-based approach to information security.

Security decisions may consider:

• The sensitivity of information;

• The likelihood and potential impact of a security event;

• The number of individuals or organizations affected;

• The nature of the systems involved;

• Legal and regulatory requirements;

• Contractual obligations;

• Available security technologies;

• The cost and feasibility of safeguards; and

• AMPINC’s size, resources, and operational environment.

Security controls may therefore differ depending on the circumstances and level of risk.

Policy Review

AMPINC will periodically review this policy and update it as appropriate to reflect changes in:

• Technology;

• Cybersecurity threats;

• Business activities;

• Research activities;

• Organizational structure;

• Third-party services;

• Applicable laws and regulations;

• Industry practices; and

• Recognized security frameworks.

The policy will be reviewed at least annually or following a significant security, technological, legal, or organizational change.

Amendments to the AMPINC Information Security & Cybersecurity Policy

AMPINC reserves the right to amend this policy as necessary to maintain appropriate information-security practices and respond to evolving risks and requirements.

Where amendments materially affect individuals or organizations using AMPINC services, AMPINC may provide appropriate notice through its website, communications channels, contractual arrangements, or other reasonable means.

Relationship With the AMPINC Privacy Notice

This Information Security & Cybersecurity Policy should be read together with the AMPINC Privacy Notice.

The Privacy Notice describes AMPINC’s practices regarding the collection, use, storage, disclosure, retention, and protection of personal information.

This policy describes AMPINC’s broader approach to protecting information, systems, technology, research materials, intellectual property, and other organizational assets.

Together, these documents establish AMPINC’s commitment to privacy, security, resilience, responsible technology use, and the protection of information entrusted to the organization.

Privacy and Security Officer

AMPINC’s privacy and security officer is the main contact for questions concerning this policy, information security practices, or suspected security incidents.

Email: atypicalmotions@gmail.com

Phone: +1 437 374 4761