This Policy, aligned with BAOBAB’s purpose and strategic context, provides the framework for establishing and reviewing quality and information security objectives, and is based on the following commitments:

• Customer focus and technical excellence.
  Understanding our clients’ current and future needs and delivering reliable, explainable, and high-value AI solutions that meet contractual requirements and agreed expectations.
• Compliance with applicable requirements.
  Ensuring compliance with all applicable legal, regulatory, contractual, and voluntarily adopted requirements, including those related to intellectual property, personal data protection (GDPR and applicable local regulations), ethical AI use, and information security.
• Confidentiality, integrity, and availability.
  Protecting both our own information assets and those entrusted to us by clients and third parties, preserving their confidentiality, integrity, and availability through systematic risk management and the implementation of appropriate controls.
• Risk- and opportunity-based approach.
  Identifying, assessing, and addressing risks and opportunities affecting service quality and information security, including those related to climate change, in accordance with the organization’s context.
• Competent people and a security-driven culture.
  Promoting training, awareness, and engagement across the entire organization, ensuring that every individual understands their responsibility regarding work quality and information protection.
• Rigorous management of suppliers and subcontractors.
  Selecting, evaluating, and monitoring critical suppliers and subcontractors —including cloud providers, software tools, technology services, external support providers, and specialized collaborators— under consistent quality and information security criteria, while ensuring the applicable IMS requirements are properly communicated to them.
• Business continuity and operational resilience.
  Ensuring continuity of AI and consulting services in the event of incidents through contingency planning, security incident management, and documented response procedures.
• Continual improvement of the IMS.
  Periodically reviewing the performance of the Integrated Management System through indicators, internal audits, and management reviews, driving measurable and demonstrable improvement actions.