Aspose Business Continuity Policy

Last updated: 13 March 2025

1. Introduction

Aspose Pty Ltd (Aspose) is a market-leading software development company that offers APIs for creating, editing, converting, and rendering various file formats such as Office, OpenOffice, PDF, Images, and CAD. Our APIs support multiple platforms, including .NET, Java, C++, Python, PHP, and Android.

Aspose is trusted by thousands of companies for our products’ performance, stability, and adaptability. We are committed to conducting business with integrity and in compliance with all applicable Australian laws and regulations.

This Business Continuity Policy outlines our commitment to maintaining uninterrupted operations of our downloadable, self-hosted products by safeguarding critical business functions identified in our Business Impact Analysis (BIA). The policy ensures that we minimize downtime, protect customer data, and maintain operational resilience to continue providing consistent, reliable services to our clients.

2. Purpose

The purpose of this policy is to establish a comprehensive framework that ensures the continued availability and reliable operation of Aspose’s self-hosted API solutions during any disruptions. By aligning with the findings of our BIA, this policy sets out strategies to:

Minimize Service Downtime: Meet the Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) established in the BIA for each critical function.
Protect Data Integrity and Security: Implement robust measures for data protection and cybersecurity.
Ensure Operational Resilience: Develop detailed recovery strategies for each critical function.
Mitigate Identified Risks: Proactively address risks highlighted in the BIA through targeted strategies.
Maintain Regulatory Compliance: Adhere to all relevant legal and contractual obligations.
Foster Trust and Transparency: Communicate effectively with stakeholders during disruptions.

3. Scope

This policy applies to all Aspose operations related to our downloadable, self-hosted products, including employees, contractors, infrastructure, and partnerships with external service providers. Specifically, it encompasses:

On-Premise API Solutions: All Aspose APIs deployed on customer environments for local file format manipulation.
Core IT Infrastructure: Hardware, software, networks, and systems supporting our self-hosted products.
Data Protection and Security: Measures to safeguard our codebase, customer data, and sensitive information.
Personnel and Key Business Functions: Roles involved in maintaining business continuity, including development, support, sales, and IT teams.
Vendor and Partner Dependencies: Third-party services essential to our operations.
Regulatory and Legal Compliance: Adherence to applicable laws and standards.

4. Business Continuity Objectives

Our primary objectives are to ensure the uninterrupted availability and reliability of Aspose’s self-hosted API services during disruptions. This includes:

Minimizing Operational Downtime: Restore critical functions within defined RTOs and RPOs.
Protecting Critical Assets: Safeguard our intellectual property, customer data, and infrastructure.
Maintaining Customer Trust: Deliver consistent, reliable services and transparent communication.
Ensuring Regulatory Compliance: Meet all legal, regulatory, and contractual obligations.
Continuous Improvement: Regularly update our business continuity strategies based on lessons learned.

5. Risk Assessment and Business Impact Analysis (BIA)

Aspose regularly conducts Risk Assessments and Business Impact Analysis (BIA) to identify potential threats and ensure business continuity.

5.1 Risk Assessment

This involves identifying and evaluating threats to Aspose’s services, infrastructure, and data. Key risks include:

Cybersecurity Threats: High likelihood and impact (e.g., malware, ransomware).
Software Failures: Moderate likelihood; high impact on product delivery.
Natural Disasters: Low likelihood; moderate impact on infrastructure.
Remote Workforce Risks: Moderate likelihood; moderate impact due to connectivity issues.
Third-Party Dependencies: Low likelihood; moderate impact if vendors fail.
Regulatory Compliance Risks: Low to moderate likelihood; moderate impact.
DevOps Challenges: Moderate likelihood; high impact on deployment efficiency.

5.2 Business Impact Analysis (BIA)

The BIA evaluates the effects of risks on critical business functions to prioritize recovery efforts. Recovery priorities and objectives are reflected in the Disaster Recovery Plan (Section 6.3):

Product Development and Engineering: High operational impact; delays affect customer satisfaction.
Customer Support and Technical Assistance: High reputational impact; downtime affects trust.
Sales and Marketing: Moderate financial impact; affects revenue growth.
IT Infrastructure and Security: High operational and reputational impact; essential for all functions.
Human Resources: Moderate operational impact; affects employee productivity.

RTOs and RPOs are established for each function based on impact levels.

5.3 Risk Mitigation

Aspose implements strategies to reduce risks:

Redundancy and Backups: Ensuring infrastructure and data storage backups.
Security Audits: Regular security checks to prevent vulnerabilities.
Third-Party Risk Management: Assessing vendors for continuity standards.
Employee Training: Training staff to prevent human error and handle incidents.

5.4 Ongoing Monitoring

Aspose monitors risks continuously and reviews its BIA annually or as needed, ensuring the business continuity plan remains effective and up-to-date.

5.5 Risk Management Plans

Aspose has established a structured framework for identifying, assessing, and mitigating business risks to enhance overall operational resilience. The risk management plan includes:

Risk Identification: Regular assessments to identify risks across product development, infrastructure, and customer support.
Business Impact Analysis (BIA): Aligning risk mitigation efforts with critical business functions and recovery priorities outlined in the BIA.
Mitigation Strategies: Developing targeted measures to reduce the likelihood and impact of identified risks, including:
Strengthening cybersecurity defenses
Ensuring redundant infrastructure
Establishing fallback mechanisms for customer support and service delivery
Incident Response Integration: Tying risk management directly into Aspose’s incident response plan to ensure seamless handling of risk-related disruptions.
Review and Improvement: Regularly reviewing and updating the risk management plan based on operational changes and emerging threats.

6. Business Continuity Planning (BCP) and Recovery Strategies

Aspose has developed strategies to protect infrastructure, maintain services, and minimize disruptions.

6.1 Business Continuity Framework

The framework includes:

Risk Identification: Regular assessments to identify risks like hardware failures, cyber threats, and natural disasters, alongside BIA to assess their impact.
Governance: A Business Continuity Management (BCM) team oversees all continuity efforts.
Plan Development: Business Continuity Plans (BCPs) for APIs, IT infrastructure, and customer support are reviewed annually or after major changes.

6.2 Continuity Strategies

Aspose ensures operational continuity through redundancy, advanced cybersecurity measures, and secure remote collaboration tools. A structured Disaster Recovery (DR) Plan (see Section 6.3) supports the rapid restoration of critical infrastructure and services after a disruption.

6.2.1 Continuity Strategies

Redundancy and Backups: Regular backups of code repositories and data, stored securely off-site.
Advanced Cybersecurity Measures: Firewalls, encryption, multi-factor authentication, and regular security audits.
Remote Collaboration Tools: Secure VPNs and collaboration platforms to support the remote workforce.
Vendor Management: Assessing and monitoring third-party providers for continuity capabilities.
DevOps Implementation: Adopting CI/CD pipelines to improve deployment efficiency and resilience.

6.2.2 Capacity and Performance Management

To ensure operational resilience during periods of increased demand or system load, Aspose has developed a comprehensive capacity and performance management strategy. This includes:

Handling Increased System Load: Implementing automated scaling and load balancing to handle spikes in customer activity.
Load Balancing: Deploying active load balancing across servers to ensure even distribution of processing and avoid bottlenecks.
System Redundancy and Backup: Maintaining redundant infrastructure and backup measures to prevent service interruptions during high-load periods.
Performance Monitoring: Continuously monitoring system performance and adjusting capacity based on real-time demand and usage patterns.

6.2.3 Recovery Procedures

Product Development and Engineering: Restore development environments and code access within 24 hours (RTO); recover codebase to within 4 hours of the last update (RPO).
Customer Support: Resume support operations within 4 hours (RTO); access to customer data within 8 hours (RPO).
Sales and Marketing: Re-establish systems within 24 hours (RTO); recover customer data within 12 hours (RPO).
IT Infrastructure and Security: Address incidents within 1 hour (RTO); maintain near real-time data recovery (RPO).
Human Resources: Restore HR systems within 48 hours (RTO); recover employee data within 24 hours (RPO).

6.2.4 Stakeholder Management

To maintain customer trust and operational integrity during business disruptions, Aspose has implemented a stakeholder management plan:

Critical Customer Contracts: Aspose maintains an up-to-date record of critical customer contracts and service-level expectations. During disruptions, Aspose prioritizes the restoration of services affecting high-priority contracts.
Customer Communication: Aspose follows a structured communication plan during service interruptions:
Initial customer notification within 4 hours of a disruption affecting services
Regular progress updates based on severity and expected resolution time
Final resolution update upon successful restoration of service
Expectation Management: Customers are informed of service recovery expectations aligned with defined RTO and RPO targets.
Post-Incident Follow-Up: After major disruptions, Aspose will engage with affected customers to review performance and identify opportunities for improving business continuity measures.

6.3 Disaster Recovery (DR) Plan

Aspose has implemented a structured Disaster Recovery (DR) Plan as part of its broader Business Continuity Policy to ensure the rapid recovery of critical IT infrastructure and services following a disruption. This plan defines the processes, responsibilities, and objectives for restoring IT services and mitigating operational impact.

6.3.1 Objectives

The Disaster Recovery Plan is designed to:

Restore critical IT infrastructure and services within defined Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) established in the Business Impact Analysis (BIA).
Minimize downtime and data loss through proactive failover mechanisms and structured recovery processes.
Ensure the integrity, confidentiality, and availability of Aspose’s data and systems during recovery efforts.

6.3.2 Backup and Recovery Strategy

Aspose maintains a robust backup strategy to enable rapid recovery:

Full backups of code repositories, infrastructure configurations, and customer data are conducted weekly.
Incremental backups are performed daily to minimize data loss.
Backups are encrypted and stored in multiple geographically diverse locations to ensure redundancy and protection against data loss.
Backup integrity is tested monthly, and recovery processes are tested quarterly.

6.3.3 Failover and Redundancy

Aspose has established automated failover mechanisms to minimize service disruption:

Network Failures: Automatic rerouting to backup servers and VPN configurations.
Server Failures: Load balancing and server redundancy to ensure minimal downtime.
Data Loss: Backups can be restored within the defined RTO, ensuring minimal data loss.

6.3.4 Handling of Critical Infrastructure Failures

Aspose has defined procedures for handling failures of critical infrastructure, including:

Cloud Outages: Backup servers and infrastructure are configured for rapid deployment in alternate data centers.
Cyber Attacks: Immediate isolation and containment of compromised systems, with recovery from clean backups.
Third-Party Failures: Rapid switching to backup service providers where possible; customer communication plan activated in case of significant third-party outages.

6.3.5 Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)

Aspose has defined specific RTO and RPO targets for each critical business function based on its BIA:

Function/Service	Recovery Time Objective (RTO)	Recovery Point Objective (RPO)
IT Infrastructure and Security	1 hour	Near real-time
Product Development and Engineering	24 hours	4 hours
Customer Support	4 hours	8 hours
Sales and Marketing	24 hours	12 hours
Human Resources	48 hours	24 hours

6.3.6 Testing and Validation

Aspose conducts regular disaster recovery tests to ensure readiness:

Tabletop Exercises: Conducted semi-annually to simulate recovery scenarios and identify gaps.
System and Data Recovery Tests: Performed quarterly to validate backup integrity and system recovery.
Performance Audits: Conducted annually to assess recovery process efficiency.

6.3.7 Incident Response and Communication

Aspose has a structured incident response framework:

Initial Notification: Within 30 minutes internally; customers informed within 4 hours.
Ongoing Updates: Regular communication until resolution.
Post-Incident Review: Analysis of the incident and recovery process to improve future response.

7. Incident Response and Crisis Management

Aspose’s emergency response plan ensures quick, efficient recovery from crises, maintaining customer trust and the company’s reputation.

7.1 Incident Response Framework

Identification and Classification: Early detection and categorization of incidents.
Escalation Procedures: Clear protocols for escalating incidents based on severity.
Response Actions: Steps to contain and resolve the incident promptly.

7.2 Crisis Management

Crisis Management Team (CMT): Activated for severe incidents impacting multiple functions.
Communication: Regular updates to stakeholders.
Post-Incident Review: Analyze response effectiveness and update plans.

8. Escalation Procedures

This section defines the escalation process to ensure that business continuity incidents are managed efficiently and resolved at the appropriate level. It complements the existing Roles and Responsibilities and Incident Response sections by providing clear criteria and a structured process for escalation.

8.1 When Escalation is Triggered

Escalation is required when:

An incident exceeds the defined recovery time objective (RTO).
A resolution is not achievable at the current management level.
Business operations, customer commitments, or compliance requirements are at risk.
External coordination or senior management involvement is needed.

8.2 Escalation Process and Responsibilities

Escalation follows a structured, tiered process based on the severity and impact of the incident:

Level	Escalation Criteria	Responsible Role	Action
Level 1	Initial incident detection; standard response fails.	Incident Response Team	Attempt resolution; escalate if not resolved within 2 hours.
Level 2	Operational impact increases; resolution not achieved at Level 1.	Department Head / Senior Manager	Coordinate response; escalate if not resolved within 4 hours.
Level 3	Major business impact or customer-facing issue.	Executive Team	Authorize strategic response measures; communicate with stakeholders.
Level 4	Critical business failure or regulatory impact.	CEO / Crisis Management Lead	Direct strategic decisions; initiate high-level crisis response.

8.3 Timeframes for Escalation

Timeframes for escalation align with the Business Continuity Policy’s recovery objectives:

Level 1 → Level 2: 2 hours
Level 2 → Level 3: 4 hours
Level 3 → Level 4: 12 hours

8.4 Reporting and Follow-Up

All escalations must be logged in the incident tracking system.
A post-incident review will assess the effectiveness of the escalation process.
The Business Continuity Manager is responsible for ensuring the escalation process is regularly tested and improved.

The post-incident review process will be conducted in alignment with the review process outlined in the Testing Results and Continuous Improvement section to ensure consistent evaluation and improvement of recovery procedures.

9. Crisis Management Plan

9.1 Purpose

The Crisis Management Plan defines the structured response to high-impact incidents or critical business disruptions. Its goal is to minimize operational and reputational damage through coordinated, timely decision-making and stakeholder communication.

9.2 Crisis Management Roles and Responsibilities

The following roles are defined for managing crisis situations:

9.3 Response Timelines

Crisis response will follow a structured timeline to ensure issues are contained and resolved promptly:

9.4 Stakeholder Communication Strategy

Stakeholder communication during a crisis will be managed according to the following principles:

Accuracy: Only verified information will be shared.
Speed: Initial communication within 2 hours of crisis activation.
Transparency: Disclose the nature and expected impact of the crisis.
Consistency: Ensure all internal and external messages are aligned.
Audience-Specific: Tailor messages for employees, customers, and regulators.

Communication with stakeholders during a crisis will follow the established protocols outlined in the Communication Plan Section of this policy. This ensures consistency in messaging, timing, and stakeholder management across all business continuity scenarios.

9.5 Post-Crisis Review

A structured post-crisis review will be conducted to identify areas for improvement and update the Crisis Management Plan accordingly. The Business Continuity Manager will ensure that lessons learned are incorporated into future response plans.

10. Business Continuity Tool Development Methodology

10.1 Purpose

This section outlines the methodology for developing, testing, and maintaining tools used to support business continuity processes. Effective tools improve response efficiency and ensure alignment with business continuity objectives.

10.2 Development Approach

Business continuity tools will be developed according to the following principles:

Scalability: Tools must support both small-scale and large-scale incidents.
Resilience: Tools must function under high-stress or degraded conditions.
Security: Tools must meet Aspose’s security and data protection standards.
Usability:Tools must be intuitive and easy to deploy during an incident.

10.3 Testing and Validation

Business continuity tools will be tested alongside regular business continuity tests:

Functional testing will validate tool performance under simulated conditions.
Integration testing will ensure compatibility with existing infrastructure.
User acceptance testing (UAT) will confirm usability and operational readiness.

10.4 Maintenance and Improvement

Business continuity tools will be reviewed as part of the regular business continuity review process.
Any identified deficiencies or failures will be logged and addressed through corrective action.
Tools will be updated to align with changes in business operations, infrastructure, or regulatory requirements.

10.5 Ownership and Accountability

The Business Continuity Manager is responsible for overseeing the development and maintenance of continuity tools. Performance and improvement actions will be tracked and reported to senior management.

11. Communication Plan

Aspose’s communication plan ensures timely, clear updates to stakeholders during incidents, helping restore normal operations and maintain trust. As Aspose’s self-hosted products don’t depend on Aspose’s infrastructure, we will make best endeavors to keep customers aware of any issues we may be experiencing, but these will mainly be for informational purposes.

11.1 Purpose

The plan aims to:

Reduce confusion during incidents.
Maintain customer and partner trust.
Support fast recovery.

11.2 Key Stakeholders

Internal: Employees, management, incident response teams.
External: Customers, partners, vendors, regulators.

11.3 Communication Channels

Internal: Email, messaging platforms, internal blog posts. virtual meetings.
External: Email alerts (where appropriate), company website, company blog, social media.

11.4 Communication Protocols

Initial Notification: Within 30 minutes internally; customers informed within 4 hours if affected.
Ongoing Updates: Regular intervals based on incident severity.
Resolution Notification: Final update upon issue resolution.

11.5 Review and Improvements

After incidents, Aspose reviews communication efforts, gathers feedback, and updates the plan to improve future responses.

12. Roles and Responsibilities

12.1 Executive Management

Provides leadership and resources for business continuity.
Approves and reviews the Business Continuity Policy, ensuring it aligns with company goals.

12.2 Business Continuity Manager

Oversees the Business Continuity Plan (BCP) and Business Impact Assessment (BIA).
Conducts risk assessments, coordinates training, and ensures BCP compliance.
Leads post-incident reviews.

12.3 Incident Response Team (IRT)

Activates the BCP during disruptions.
Assesses incidents, coordinates response, and communicates status.
Documents outcomes for future analysis.

12.4 Crisis Management Team (CMT)

Manages severe incidents, ensuring strategic alignment.
Oversees external communications and post-crisis evaluations.

12.5 IT Disaster Recovery Team

Maintains IT recovery plans and tests disaster recovery processes.
Protects critical assets and supports recovery within RTO and RPO targets.

12.6 Customer Support Team

Updates customers on service disruptions and resolutions.
Manages inquiries and aligns communication with internal updates.

12.7 All Employees

Understand and follow the Business Continuity Policy.
Participate in training and report incidents.
Report incidents promptly.

12.8 Training and Awareness

Regular training and drills for all employees, at induction and check-in on regular employee reviews.
Role-specific training for key teams, with updates based on feedback.

13. Organizational Structure

Aspose maintains a clear organizational structure to ensure operational continuity and effective decision-making during disruptions. The structure defines key roles and reporting lines to enable rapid response and coordinated recovery efforts.

Aspose CEO
Executive Management
Risk and Compliance
Risk Management Team
Legal and Compliance Team
Internal Audit Team
Board of Directors
Finance and Administration
Financial Operations
Regulatory Compliance
IT and Infrastructure
IT Infrastructure and Security Team
DevSecOps
Product and Engineering
Product Development and Engineering
Product Management Team
Quality Assurance (QA) Team
Technical Support
Free Support Team
Paid Support Team
Sales
Sales Team
Human Resources (HR)
Recruitment and Training
Security Training and Compliance

This structure ensures that decision-making authority and operational responsibilities are clearly defined, enabling Aspose to respond swiftly and effectively to business disruptions.

14. Insurance Management Policy

14.1 Purpose

This Insurance Management Policy defines Aspose’s approach to managing insurance coverage to protect the company’s operations, assets, and personnel from potential risks. The objective is to ensure that Aspose maintains appropriate levels of insurance to support business continuity, financial stability, and risk mitigation.

14.2 Scope

Aspose seeks to secure appropriate insurance coverage to protect against potential risks that could impact business operations. This may include, but is not limited to:

Business interruption or operational downtime.
Cybersecurity and data breach incidents.
Professional indemnity or liability claims.
Physical asset loss or damage.
Third-party claims related to business activities.

Aspose maintains appropriate insurance coverage to support business continuity and risk management. Insurance needs are reviewed periodically and adjusted as necessary to reflect business requirements and evolving risks.

14.3 Responsibilities

Executive management is responsible for setting the overall insurance strategy and ensuring that adequate coverage is maintained.
The Finance Department manages insurance contracts, premium payments, and policy renewals.
The Risk Management Team monitors potential coverage gaps and recommends adjustments based on emerging threats or business changes.
The Legal and Compliance Team ensures that insurance policies align with Aspose’s contractual and regulatory obligations.

14.4 Claims and Reporting Process

All incidents that could result in an insurance claim must be reported promptly to the Finance Department. The Finance Department will assess the situation, gather supporting documentation, and liaise with the insurer to process the claim.

Updates on the status of claims will be tracked, and any necessary follow-up actions will be taken to ensure timely resolution.

14.5 Review and Continuous Improvement

Aspose will review its insurance coverage periodically to ensure alignment with current business operations and risk exposure. Lessons learned from previous claims or business disruptions will inform future adjustments to the insurance strategy.

The Risk Management Team will provide recommendations based on changes in the business environment and emerging threats.

15. Testing and Maintenance

Regular testing and maintenance ensure Aspose is prepared for emergencies, keeping personnel familiar with their crisis roles and the Business Continuity Plan (BCP) effective and relevant.

15.1 Purpose of Testing

Validate the BCP’s effectiveness.
Identify areas for improvement.
Enhance employee preparedness through practical exercises.

15.2 Testing Procedures

Tabletop Exercises: Discuss response scenarios to identify gaps (Twice yearly)
Simulation Exercises: Test team responses in realistic scenarios (Annually)
Full-Scale Drills: Deploy resources in real-time conditions (Every two years)
Technology Tests: Regularly test IT disaster recovery processes. (Quarterly)

15.3 Evaluation and Feedback

Debrief after each test to assess responses.
Gather feedback from participants.
Document findings for review and improvements.

15.4 Plan Maintenance

Review and update the BCP annually or after major changes.
The Business Continuity Manager ensures updates are communicated.
Maintain a version-controlled BCP for easy access.

15.5 Training and Awareness

Integrate BCP training into onboarding.
Continuously educate staff on their roles and any plan updates.

15.6 Testing Results and Continuous Improvement

Test outcomes will be systematically reviewed to identify gaps and drive continuous improvement in business continuity readiness. This process ensures that recovery objectives are consistently met and response capabilities are refined over time.

15.6.1 Review Process

Testing results will be logged and assessed in line with the evaluation and feedback process.
Key performance indicators (KPIs) used to measure test outcomes include:
Recovery Time Objective (RTO): Ability to resume critical operations within the defined timeframe.
Recovery Point Objective (RPO): Ability to recover data up to the last defined recovery point.
Escalation Response Time: Time to escalate issues in line with the escalation framework.

These performance indicators are defined in the Business Impact Analysis and serve as benchmarks for evaluating recovery effectiveness.

15.6.2 Improvement Process

Gap Identification: Any discrepancies between test results and recovery targets will be logged for analysis.
Action Planning: Corrective actions will be documented and assigned to the responsible teams.
Tracking and Follow-Up: The Business Continuity Manager will oversee resolution of identified issues and ensure corrective actions are completed.

15.6.3 Reporting and Accountability

The Business Continuity Manager will ensure that testing outcomes and improvements are documented and reported as part of the annual business continuity review.
Performance trends and corrective actions will be reviewed with senior management to assess progress and identify further improvement opportunities.

16. Compliance and Continuous Improvement

Aspose is committed to following relevant laws, regulations, and industry standards while continuously improving the Business Continuity Plan (BCP) to meet organizational goals.

16.1 Compliance Commitment

Regulatory Adherence: Comply with business continuity laws, data protection, privacy regulations, and align with standards like ISO 22301.
Internal Policies: Align the BCP with Aspose’s policies on risk management, IT security, and incident response.

16.2 Monitoring Compliance

Audits: Conduct regular audits to ensure adherence to schedules, documentation accuracy, and role fulfillment during incidents.
Documentation: Maintain records of all continuity activities, including training, testing, and audits.

16.3 Continuous Improvement

Feedback: Collect feedback via post-incident reviews and surveys to identify improvement areas.
Plan Updates: Revise the BCP based on audit findings, emerging threats, or operational changes.
Best Practices: Incorporate industry trends and strategies to enhance BCP resilience.

16.4 Training and Awareness

Ongoing Education: Provide regular training to ensure employees understand their roles and compliance requirements.
Communication: Update staff promptly on BCP changes through workshops or materials.

16.5 Leadership Engagement

Executive Oversight: Management reviews compliance reports and promotes resilience.
Resource Allocation: Ensure sufficient resources for compliance, improvement, and training.

17. Periodic Review and Policy Updates

Periodic Review: This Business Continuity Policy will be reviewed periodically or as required to adapt to new security standards, emerging threats, and Aspose’s evolving business needs.

Policy Updates: Any updates to the policy will be communicated to all employees and relevant stakeholders to ensure continuous alignment with best practices in business continuity, operational resilience and customer confidence.

18. Policy Management

Aspose is a privately held company. Our policies are reviewed and maintained by the leadership team to keep them aligned with our business goals and industry standards.

This policy is live and effective as of the Last Updated date at the top of this document. Updates reflect changes in our business practices, customer feedback, and compliance requirements.