Information security policy
Monta ApS
Strandboulevarden 122, 2100 Copenhagen, Denmark
Email: info@monta.com
Company registration number: 41668385
Version: 1.4 Date: 2 July 2026
Overview
Monta processes large amounts of information, including both internal, confidential, critical and personal data. It is Monta's responsibility that this processing complies with applicable legislation and authority requirements for information security.
This Policy is made within the framework of Monta's overall strategy, and taking into account our business values; trust and transparency. This Policy must therefore contribute to complying with applicable laws, policies and similar obligations while at the same time ensuring that information is used to achieve the company’s business goals.
Monta's Information Security Policy has been drafted based on the principles of ISO-27001 and **the SOC 2 Trust Services Criteria, two internationally-recognized frameworks for safeguarding information.
Aligning with both standards supports our goals of: improved value proposition to enterprise customers, protecting stakeholders, maturing our tech stack and obtaining additional brand value.
Purpose
The overall purpose of this Policy is to ensure the confidentiality, availability, and integrity of all information and information assets belonging to Monta and its stakeholders (third parties, clients or customers and the general public), including
- to establish a general approach to information security.
- to build an overall framework (management system) for handling information security in different areas of the organisation.
- to detect and mitigate the compromise of information security such as misuse of data, networks, computer systems, and applications.
- to protect the reputation of the company with respect to its ethical and legal responsibilities.
Scope
This Policy applies to our processing, use and storage of information no matter the media, including on computer equipment, software, operating systems, storage media, network resources and network accounts providing electronic mail, online browsing, and file transfer protocols (collectively, “Monta Systems”) to conduct Monta business or interact with internal networks and business systems, whether owned or leased by Monta, the employee, or a third party.
This Policy applies to all directors, officers and employees of Monta, as well as third-party contractors and agents of Monta that have access to information or Monta Systems owned or leased by Monta (collectively “Authorized Users”).
Policy
Monta requires all Authorized Users to exercise a duty of care in relation to the operation and use of the Monta Systems.
Acceptable use
Use of the Monta’s Systems by Authorized Users will be lawful, honest and decent. Authorized Users are obliged by acceptable use principles and policies as part of their contracts with Monta.
Information must not be copied or transported outside the Monta Systems without consideration of:
- the classification of the specific information as defined in Monta’s Information Classification Policy
- permission from the information owner
- the risks associated with loss or falling into the wrong hands
- how the information will be shared with externals
Monta accept that employees are working from home or in other locations outside the office, however, to retain adequate information security this is regulated by the IT Policy.
Cyber Security
Monta is addressing the threat of cyber-attacks both through our technical protection setup and through behavioral and technical guidelines for all Authorized Users in the IT Policy and as described in our Cyber Security Policy.
Personal Information
Authorized Users of Information Systems are not given rights of privacy in relation to their use of Information Systems. Duly authorized users may access or monitor personal data contained in any Information System (mailboxes, web access logs, file-store etc) but always subject to Monta’s Privacy Policy and GDPR Policy.
Information Security Board
Monta has established an Information Security Board, which is led by the VP Operational Excellence & Governance. The responsibility of the Information Security Board is to implement information security measures and ensure proper compliance with the same, including oversight of AI governance as set out in the AI Policy. The Information Security Board has created a monitoring overview with both ongoing monitoring as well as monthly meetings.
Related standards, policies and processes
This Information Security Policy sets out the overall standards for Monta’s information security, which is regulated in further detail in the relevant policies listed below:
- IT Policy
- AI Policy
- Physical Security Policy
- Information Classification Policy
- Business Continuity Policy
- Privacy Policy
- GDPR Policy
These policies can be shared on a private and confidential basis with third parties having a legitimate interest upon their request.
Publication of the policy
This Information Security Policy is publicly available on www.monta.com, and can always be referred to or shared upon request.
Compliance with the policy
The Information Security Board will monitor compliance with this Policy using various methods, such as business tool reports, internal and external audits, and any feedback provided to Monta management.
Exceptions
Any exception to this Policy must be approved by the Monta Information Security Board in advance.
Non-Compliance
All Authorized Users are required to adhere to this Policy. Failure to comply may result in different disciplinary actions depending on the severity of the breach set out in the Information Security Handbook.
Responsibility for this policy & revision
Monta Management has overall responsibility for the effective operation of this Policy but has delegated day-to-day responsibility for overseeing its implementation and maintenance to the Information Security Board.
All managers have a specific responsibility to operate within the boundaries of this Policy, take effective steps so that all employees understand the standards of behavior expected of them, and to take action when behavior falls below its requirements.
The Policy shall be reviewed on an annual basis by the Information Security Board. Further, it shall be reviewed, and eventual edits shall be approved, by Monta Management once per year.