How Ann-Connect approaches security, privacy and reliability.

At Ann-Connect, we understand that organisations do not simply choose a technology platform; they place a degree of trust in the organisation operating that platform. Workspace may be used to conduct business meetings, manage projects, collaborate on documents, communicate with teams, process information, use AI-assisted functionality, and support other critical organisational activities. As a result, security, privacy, reliability, and responsible technology practices are fundamental to how we build and operate Workspace.

Our Trust Center provides an overview of how Ann-Connect approaches the protection of information and the reliability of the services provided through Workspace. It is intended to provide customers, enterprise organisations, institutions, administrators, security teams, procurement teams, privacy professionals, and other stakeholders with greater transparency into our approach.

We believe that trust should be built through responsible design, appropriate controls, transparency, continuous improvement, and accountability rather than through marketing statements alone.

Security is considered throughout the lifecycle of Workspace. Our objective is to incorporate security considerations into product architecture, application development, infrastructure management, access control, data processing, deployment, monitoring, maintenance, and incident response.

Our security approach is based on multiple layers of protection rather than reliance on a single control. Depending on the service, these controls may include encryption, identity and access management, secure authentication, network protection, system monitoring, logging, vulnerability management, security testing, administrative controls, backup and recovery mechanisms, and incident-response procedures.

We continuously assess our security practices as Workspace evolves and as the threat landscape changes.

Privacy is an important component of Workspace's product development philosophy. We seek to incorporate privacy considerations into the design of products and features before they are deployed rather than treating privacy as an afterthought.

This includes considering data minimisation, purpose limitation, access restrictions, retention, transparency, user rights, security, international data transfers, and other relevant privacy considerations when designing and operating Workspace.

Our Privacy Policy provides detailed information about the categories of personal information that may be processed, the purposes of processing, data subject rights, retention, international transfers, confidentiality, security, and other privacy matters.

Ann-Connect recognises that Workspace may be used by customers operating under different legal and regulatory environments. Our data protection framework is therefore designed with international applicability in mind.

Where applicable, our privacy and data protection practices take into consideration South Africa's Protection of Personal Information Act (POPIA), the Promotion of Access to Information Act (PAIA), the General Data Protection Regulation (GDPR), and other applicable data protection requirements.

The specific obligations applicable to a customer will depend on factors including the customer's location, the location of its users, the type of information processed, the purpose of processing, and the contractual relationship between Ann-Connect and the customer.

We recognise that information processed through Workspace may include confidential business information, strategic plans, internal communications, customer information, intellectual property, financial information, meeting discussions, documents, project information, and other commercially sensitive material.

Ann-Connect applies confidentiality obligations to personnel and authorised service providers who may have access to information in connection with their responsibilities. Access to customer information is restricted according to legitimate operational requirements and appropriate access-control principles.

Our confidentiality obligations may also be supplemented by contractual confidentiality agreements, including Non-Disclosure Agreements, Master Services Agreements, Data Processing Agreements, or other agreements entered into with enterprise customers.

Access to Workspace systems and information is controlled through identity and access-management mechanisms appropriate to the relevant environment.

We seek to apply least-privilege principles, meaning that personnel and systems should only receive the level of access reasonably required to perform authorised functions. Depending on the service, security controls may include authentication, role-based permissions, privileged-access restrictions, administrative controls, logging, monitoring, and periodic review.

Enterprise customers are also provided with administrative capabilities appropriate to their subscription and service configuration, allowing them to manage users, permissions, and organisational access.

Workspace uses appropriate technical and organisational measures designed to protect information against unauthorised access, loss, misuse, alteration, destruction, or disclosure.

These measures may include encryption in transit, appropriate protection of stored information, secure infrastructure, access controls, authentication mechanisms, network security, monitoring, logging, vulnerability management, backups, redundancy, and other security mechanisms.

Security controls may differ depending on the Workspace service, type of data, customer configuration, and infrastructure supporting the relevant functionality.

Reliability is a fundamental component of Workspace because customers depend on the platform to support their day-to-day activities.

We design Workspace with operational resilience in mind and seek to reduce the impact of infrastructure failures, software defects, network interruptions, unexpected demand, security events, and other operational disruptions.

Depending on the service, our architecture may incorporate redundancy, monitoring, automated recovery mechanisms, scalable infrastructure, backups, fault tolerance, and other techniques designed to support service continuity.

Specific availability commitments, service credits, support commitments, recovery objectives, and other contractual service levels are governed by the applicable customer agreement or Service Level Agreement rather than this Trust Center.

Workspace is designed to support organisations ranging from individuals and small teams to larger enterprises requiring significantly greater capacity.

Our infrastructure and architecture are designed to support scalable workloads and varying levels of demand. We continuously monitor system performance and capacity requirements to identify potential bottlenecks and support the continued operation of Workspace as usage increases.

Performance may vary depending on factors such as network connectivity, device capability, geographic location, browser environment, customer configuration, integrations, and the specific Workspace service being used.

Ann-Connect recognises the importance of maintaining access to Workspace during unexpected operational events. Our approach to resilience includes measures intended to support recovery from infrastructure failures, software failures, data corruption, security incidents, service interruptions, and other events that may affect normal operations.

Business continuity and disaster recovery arrangements may include backups, redundancy, recovery procedures, infrastructure resilience, incident-response processes, and operational escalation mechanisms.

The specific recovery objectives and commitments applicable to an enterprise customer may be defined within its contractual arrangements with Ann-Connect.

Ann-Connect maintains processes intended to identify and respond to security incidents and other events that may affect Workspace.

Potential incidents may be investigated to determine their nature, scope, severity, affected systems, affected information, and potential impact. Depending on the circumstances, response measures may include containment, access restriction, system isolation, remediation, recovery, notification, and post-incident review.

Where a security incident constitutes a personal-information breach and applicable law requires notification, Ann-Connect will follow the applicable notification requirements and contractual obligations.

Workspace may incorporate artificial intelligence through Nexa AI and AI-assisted capabilities within Room and other services.

We recognise that AI systems introduce additional considerations relating to privacy, confidentiality, security, accuracy, transparency, accountability, and responsible use. We therefore seek to develop and operate AI-enabled functionality with appropriate safeguards and human oversight where appropriate.

AI-generated outputs may contain inaccuracies or may require human verification. Customers remain responsible for evaluating AI-generated information before relying on it for important business, legal, financial, educational, employment, or other consequential decisions.

Customers should also consider the sensitivity of information submitted to AI features and use available administrative, privacy, and security controls appropriately.

Security and privacy are shared responsibilities.

Ann-Connect is responsible for protecting the Workspace services and infrastructure within its control. Customers remain responsible for how they configure and use Workspace, including managing their users, administrator accounts, permissions, devices, integrations, meeting participants, shared content, documents, and other information.

Customers should ensure that their employees, contractors, and other authorised users understand their responsibilities when using Workspace.

We believe customers should have access to clear information about how Workspace operates and how Ann-Connect approaches security and privacy.

Our Trust Center is intended to provide a central point for information relating to our security, privacy, reliability, data protection, and responsible technology practices.

Enterprise customers may, depending on the nature of their engagement, request additional documentation relating to security architecture, data processing, subprocessors, business continuity, privacy practices, or other relevant areas. Access to certain sensitive security documentation may be subject to confidentiality restrictions or appropriate customer verification.

The Workspace trust documentation is intended to be read together with our other contractual and policy documents, including:

• Privacy Policy — explains how Ann-Connect collects, uses, stores, protects, and otherwise processes personal information.
• Cookie Policy — explains how cookies and similar technologies are used across our websites and services.
• Terms of Service — establishes the general terms governing use of Workspace.
• Master Services Agreement — establishes the contractual framework applicable to enterprise customers where an MSA is entered into.
• Data Processing Agreement — establishes applicable data-processing obligations where Ann-Connect processes personal information on behalf of a customer.
• Service Level Agreement — where applicable, defines specific service availability, support, performance, response, and service-credit commitments.
• Acceptable Use requirements — establish prohibited and restricted uses of Workspace.

Where there is a conflict between general Trust Center information and a specific executed contractual agreement, the applicable contractual agreement will govern to the extent permitted by law.

Security, privacy, and reliability are ongoing programmes rather than one-time projects. Technology changes, security threats evolve, regulations develop, and customer expectations continue to increase.

Ann-Connect therefore continually reviews its technology, processes, controls, policies, infrastructure, and operational practices with the objective of improving the security and reliability of Workspace.

Where appropriate, we may introduce new controls, update existing technologies, modify infrastructure, improve monitoring, strengthen access management, enhance privacy controls, or otherwise change how Workspace operates in order to improve the overall security and resilience of the platform.

Ann-Connect seeks to align its security and privacy practices with recognised industry principles and standards appropriate to the nature of the Workspace services.

However, references to security frameworks, standards, controls, or recognised practices should not be interpreted as a representation that Ann-Connect or Workspace holds a particular certification unless that certification has been formally obtained and is specifically identified as current.

Where Ann-Connect obtains formal certifications, attestations, independent assessments, or other recognised assurance reports, relevant information may be made available through the Trust Center or through appropriate enterprise security-assessment processes, subject to confidentiality and security considerations.

Workspace may depend on selected third-party providers to deliver infrastructure, payment processing, communications, analytics, authentication, AI functionality, storage, integrations, security, and other services.

Ann-Connect recognises that the security and privacy of Workspace can be influenced by the security practices of these providers. We therefore seek to evaluate third-party providers based on the nature of the services they provide and the information they may process, and where appropriate, establish contractual, security, confidentiality, and data-protection requirements.

A list or description of applicable subprocessors and third-party processing arrangements may be made available to customers where appropriate.

We understand that enterprise customers may have formal procurement, risk, security, privacy, legal, and compliance requirements before adopting Workspace.

Subject to the nature of the customer's engagement and appropriate confidentiality arrangements, Ann-Connect may support reasonable enterprise due-diligence processes, including security questionnaires, privacy assessments, data-processing reviews, technical discussions, documentation requests, and other reasonable assurance activities.

The extent of information provided may depend on the customer's subscription, services being procured, sensitivity of the information involved, and applicable confidentiality and security considerations.

Our objective is to make Workspace a platform that organisations can confidently use to communicate, collaborate, manage work, conduct meetings, access AI-assisted productivity tools, and manage their day-to-day activities.

We recognise that trust cannot be established through technology alone. It requires responsible governance, transparent policies, secure engineering, appropriate privacy practices, reliable infrastructure, accountable people, and a willingness to continuously improve.

Ann-Connect is committed to building Workspace with these principles at its foundation and to maintaining an ongoing focus on security, privacy, reliability, transparency, and responsible innovation as the platform grows.