Information Security Policy and AI Policy

Information Security Policy

To ensure our business of "developing and providing the AI-powered SaaS platform (GENFLUX)" and to provide peace of mind and earn the trust of all our stakeholders, we hereby establish our Information Security Policy.

1. We will establish an in-house team to promote information security and build a robust information security framework.
2. We will minimize the occurrence of information security incidents through regular information security risk assessments.
3. We will improve the information security awareness and risk sense of all staff through regular, systematic information security education.
4. We will clearly define information security objectives (goals) and achieve an effective Information Security Management System (ISMS) through the PDCA cycle for reaching those goals.
5. We will establish a response framework for when incidents occur, ensuring the promptest possible response at the time and effective prevention of recurrence afterward.
6. We will ensure compliance with the requirements applicable to our Information Security Management System (ISMS), including laws and regulations such as the Act on the Protection of Personal Information, and requirements from stakeholders.
7. We will continuously improve our Information Security Management System (ISMS) through regular internal audits, management review activities, and improvement through corrective actions.

AI Policy

Appropriate use of AI is an essential theme in ensuring our business of "developing and providing the AI-powered SaaS platform (GENFLUX)," and to provide peace of mind and earn the trust of all our stakeholders, we hereby establish our AI Policy.

1. We recognize that data handled by AI may affect customers and society, and we will establish an AI governance framework to ensure data is handled in an appropriate environment.
2. We will minimize the occurrence of AI-related risks through regular AI system impact assessments and AI risk assessments.
3. We will improve all staff's crisis awareness and risk sense in the use of AI through regular, systematic education to understand the characteristics and limitations of AI.
4. We will clearly define AI-related objectives (goals) and achieve an effective AI Management System (AIMS) through the PDCA cycle for reaching those goals.
5. We will establish a response framework for AI-related incidents, ensuring the promptest possible response at the time and effective prevention of recurrence afterward.
6. We will ensure compliance with the requirements applicable to our AI Management System (AIMS), including laws and regulations such as the Act on the Protection of Personal Information, and requirements from stakeholders.
7. We will continuously improve our AI Management System (AIMS) through regular internal audits, management review activities, and improvement through corrective actions.
8. Our policy regarding information security is set out in the "Information Security Policy."

April 28, 2026 Elith Inc. Representative Director Koki Inoue