Integrity,
on every deal.

apphero prohibits corruption in every form, active or passive, in the public and private sectors alike:

• offering, promising, giving, soliciting or accepting any undue advantage to influence a decision;
• bribes, kickbacks, hidden commissions and facilitation payments, regardless of the amount;
• the use of an agent, consultant, reseller or any other intermediary to do indirectly what is prohibited directly;
• political contributions on behalf of apphero without prior written approval from management;
• any false, incomplete or off-the-books accounting entry.

apphero complies with the U.S. Foreign Corrupt Practices Act (FCPA), the U.K. Bribery Act 2010, the Canadian Corruption of Foreign Public Officials Act (CFPOA) and every anti-corruption law applicable in the jurisdictions where it does business, together with applicable economic sanctions and export control regulations of the United States, Canada and the European Union.

apphero serves municipalities, local governments and public colleges and universities. Every interaction with Government Personnel — public servants, elected officials, and employees of government-owned entities such as public universities — calls for heightened vigilance:

• business is obtained only through the buyer's own procurement process;
• any gift, meal or hospitality offered to Government Personnel requires prior approval from management, whatever its value;
• no gift or hospitality is offered while a tender is open or an award decision is pending;
• every significant interaction with Government Personnel is documented.

Gifts and hospitality offered or received are reasonable, proportionate, transparent and compliant with local law and with the recipient's own rules. No advantage is offered in expectation of a return. Any gift above USD 100 requires prior written approval from management and is recorded.

Third parties — agents, consultants, subcontractors, resellers, distributors and contract-vehicle holders — are a recognized corruption risk, especially when they deal with government customers. apphero engages them only after a due diligence proportionate to that risk.

Risk rating. Each third party is rated before engagement. The rating rises when the third party interacts with Government Personnel, is paid on success or commission, operates in a higher-risk jurisdiction, or is recommended by a public official.

Due diligence before engagement:

• verification of identity, ownership and beneficial owners;
• review of reputation, track record and adverse media;
• identification of any tie to Government Personnel or to a government entity;
• screening against the U.S. (OFAC), Canadian and European sanctions lists;
• a documented business rationale and a compensation in line with market rates for the service rendered.

Contractual controls. Every agreement carries anti-corruption representations, the obligation to comply with this program, audit rights, and the right to terminate without penalty in the event of a breach. Engagement requires written approval from management and, where a partner agreement requires it, the partner's approval.

Ongoing monitoring:

• payments made only against invoices that match the contract and the work delivered, by bank transfer to an account in the third party's name;
• dual approval for any payment above USD 5,000;
• periodic review of expenses and commissions by management;
• annual recertification of compliance by each third party;
• anti-corruption training for third parties acting on apphero's behalf with government customers;
• a fresh review whenever a red flag appears — an unusual payment request, an undisclosed tie to a public official, a refusal to certify — with suspension of payments until it is resolved.

Every member of the team avoids any situation in which a personal interest competes with apphero's interest or with its duty to a customer or partner. Any actual, potential or apparent conflict — a family or personal relationship with a customer, supplier or partner, a financial interest, an outside activity — is disclosed in writing to management as soon as it arises. Management records the disclosure, defines the measures that apply, and, where the conflict concerns a business partner, informs that partner.

apphero keeps accurate books and records that fairly reflect every transaction. Each expense is documented and authorized; supporting documents are retained; no unrecorded fund or account is permitted.

Every person who works on apphero business — officers, employees and third parties acting on its behalf — completes anti-corruption and ethics training:

• at onboarding, before working on any partner or public-sector engagement;
• at least every two years thereafter;
• after any significant change in the law or in apphero's activities.

Training combines the Ethics and Integrity for Salesforce Partners Trailhead module with an internal session on this program. Participation is mandatory and recorded in a training log kept by management. The 2026 cycle was completed by all personnel in October 2026.

Anyone — team member, customer, partner, supplier or member of the public — can report a suspected violation:

• by email to ethic@apphero.tech, a confidential mailbox read by management only;
• directly to the Founder and CEO;
• anonymously, if preferred.

Each report is acknowledged within five business days, assessed, investigated impartially, and documented. When a violation concerns Salesforce-related business, apphero informs Salesforce at legalcompliance@salesforce.com.

No one who reports a concern in good faith suffers any retaliation — dismissal, demotion, threat, harassment or any other adverse measure. Retaliation is itself a violation of this program.

The program is owned by the Founder and CEO, who is responsible for third-party corruption risk management, keeps the training log and the register of reports, and reviews the policies at least once a year. Any violation may lead to disciplinary measures up to termination of employment or of the contract, and to civil or criminal proceedings.