We Are Momentus Limited - Security Trust Center

Security and Trust at The Brand Memory Co.

The Brand Memory Co. maintains an information-security and privacy programme covering governance, workforce security, access control, supplier oversight, incident response, business continuity and technical risk management.

We Are Momentus Limited has completed an independent SOC 2 Type 2 examination by Securance Pro Assurance PLLC. The report, signed on 9 October 2026, covers the period 1 June to 31 August 2026 and the trust services criteria for Security, Confidentiality and Availability. The auditor's opinion states that, in all material respects, the system description was fairly presented and the controls were suitably designed and operated effectively throughout that period, subject to the complementary controls described in the report.

The report is issued to We Are Momentus Limited and applies to the system and period described in it. It is a SOC 2 attestation report, not an ISO certification. The restricted-use report is available to authorised recipients through our access-controlled Trust Center. Ongoing control monitoring and remediation continue separately from this historical examination.

Our ISO 27001 programme remains in progress; no completed ISO 27001 or ISO 42001 certification is claimed.

Security concerns, privacy enquiries and requests to access, correct or delete personal information can be sent to momentum@wearemomentus.com. Requests received through that address are retained in the company mailbox and transferred to the restricted data-subject-request register for ownership, identity verification, due-date tracking and closure.

Do not include passwords, authentication tokens or other secrets in an initial report. We will arrange an appropriate secure exchange where required.

28

Policies

Internal policies that govern how we operate and protect customer data.

Acceptable Use & Workstation Security

Access Control & Least Privilege

Authentication & Password

Background Screening & On/Off-boarding

Backup, Business Continuity & Disaster Recovery

Change & Release Management

Code of Business Conduct

Compliance & Regulatory Monitoring

44

Controls

Safeguards continuously monitored across our infrastructure and processes.

Acceptable Use

Access Rights

Asset Inventory

Business Continuity & ICT Readiness

Change management

Configuration & Patch Management

Credential Management

Data Masking

11

Subprocessors

Third parties that process data on our behalf under strict contractual safeguards.

Amazon Web Services

A comprehensive and widely adopted cloud platform offering over 200 fully featured services globally.

Anthropic

AI model and API provider used across Momentus repositories. Processes prompts, files/context and generated outputs where enabled. Source-backed subprocessor classification applies where Anthropic processes customer personal data for a Momentus service; account data controls, retention and transfer terms remain under verification.

Cursor

AI-powered code editor and pair programming assistant.

Figma

A web-based design tool for interface design, prototyping, and collaboration.

GitHub

A platform for version control and collaborative software development using Git.

Resources

Policies, whitepapers, and contacts for deeper information.

We Are Momentus Limited Trust Center

3

28

11

0

Security and Trust at The Brand Memory Co.

Policies

Controls

Subprocessors

Resources