Effective Date: 8 September 2026

Owner: Head of CyberSecurity & Infrastructure

Applies To: All employees, contractors, and third-party partners

1. Purpose

The purpose of this Security Policy is to protect Horizon’s systems, data, and customer information from unauthorized access, disclosure, alteration, and destruction. It outlines the principles, responsibilities, and controls we follow to ensure information security across the organization.

2. Scope

This policy applies to all employees, contractors, vendors, and systems that access, process, or store Horizon data, including:

• Cloud infrastructure (e.g., AWS, GCP)
• Internal tools and platforms
• Customer data
• Endpoint devices (laptops, mobile phones)
• Third-party services

3. Security Principles

We follow the following guiding principles:

• Least Privilege: Access is granted based on job responsibilities and minimized wherever possible.
• Defense in Depth: Multiple layers of controls are used to protect data and systems.
• Security by Design: Security is considered at every stage of development and deployment.