APM Security and Data Handling Policy - Accurate Performance Machining

1. Purpose and Scope

This policy describes how Accurate Performance Machining, Inc. protects the confidentiality, integrity, and availability of information entrusted to us — including customer technical data, drawings, purchase orders, business records, and personal information of employees and business contacts. It applies to all employees, contractors, and visitors who access our facility, systems, or data.

As a precision machining supplier to the aerospace industry, we recognize that our customers rely on us to safeguard sensitive technical and business information, and in many cases to comply with U.S. export control regulations. This policy reflects our commitment to those responsibilities.

2. Information We Handle

In the course of business, Accurate Performance Machining, Inc. may receive, create, or store:

Technical data packages, drawings, and specifications provided by customers
Purchase orders, quotes, and contractual documents
Quality records, inspection reports, and certificates of conformance
Employee records and payroll information
Vendor and subcontractor information
Website and inquiry form submissions from visitors

3. Export Control Compliance (ITAR / EAR)

Some parts, drawings, and technical data we handle may be subject to the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR). Accurate Performance Machining, Inc. maintains practices designed to:

Identify and mark controlled technical data appropriately
Restrict access to controlled data to authorized U.S. persons as required
Store controlled technical data separately from non-controlled business systems where applicable
Train relevant personnel on export control responsibilities
Verify the citizenship/status of personnel with access to controlled data, consistent with regulatory requirements

Customers with specific ITAR/EAR marking, handling, or flow-down requirements should communicate them to their Accurate Performance Machining, Inc. point of contact, so they can be incorporated into the relevant work order.

4. Physical Security

Facility access is restricted to authorized employees; while conducting controlled parts manufacturing visitors must sign in and are escorted in production and data-handling areas.
Customer drawings, tooling, and technical documentation are stored in designated, access-controlled areas.
Printed technical data is disposed of via secure shredding, not general waste.
Security cameras and/or alarm systems monitor facility access points.

5. Information Systems and Cybersecurity

Accurate Performance Machining, Inc. maintains administrative, technical, and physical safeguards appropriate to the size and nature of our operations, including:

Access controls and unique user credentials for company systems
Firewalls and endpoint protection on networked devices
Regular software and security patching
Encrypted storage and transmission of sensitive files, where applicable
Restricted, need-to-know access to customer technical data
Routine data backups
Removal of system access promptly upon employee separation

We continue to evolve our cybersecurity practices to align with applicable industry frameworks and customer flow-down requirements (e.g., NIST SP 800-171/CMMC expectations for controlled unclassified information, where applicable to specific programs).

6. Employee Responsibilities

All employees and contractors are required to:

Protect login credentials and never share access to systems or files
Handle customer technical data only for authorized business purposes
Report lost devices, suspected security incidents, or unauthorized access immediately
Complete security and, where applicable, export control awareness training
Follow customer-specific data handling instructions included in purchase orders or contracts

7. Third Parties and Subcontractors

Where subcontractors, suppliers, or service providers require access to customer data to fulfill an order, Accurate Performance Machining, Inc. takes reasonable steps to ensure they are bound by confidentiality and, where applicable, export control obligations consistent with our own commitments.

8. Website and Business Contact Information

Information submitted through our website (such as contact forms or RFQ submissions) is used solely to respond to inquiries and conduct business communications. We do not sell visitor or customer information to third parties. Basic website analytics may be collected to understand site usage.

9. Data Retention and Disposal

Business records, quality documentation, and technical data are retained in accordance with contractual, regulatory, and quality system (e.g., AS9100) requirements. Data no longer required is disposed of securely — physical documents are shredded, and electronic files are permanently deleted from company systems.

10. Incident Response

In the event of a suspected data breach, unauthorized disclosure, or loss of controlled technical data, Accurate Performance Machining, Inc. will:

Investigate and contain the incident promptly
Notify affected customers as required by contract or law
Notify relevant regulatory authorities where legally required (including export control authorities, if applicable)
Take corrective action to prevent recurrence

11. Policy Updates

This policy is reviewed periodically and updated as our business, technology, and regulatory obligations evolve.

12. Contact

Questions about this policy or how Accurate Performance Machining, Inc. handles your information can be directed to:
Andrew Palowitch / CEO
andrew.palowitch@accurateperformancemachining.com
714-434-7811

Disclaimer: This policy is a general statement of practice and does not itself constitute a certification of compliance with any specific regulatory framework (e.g., ITAR, EAR, NIST SP 800-171, CMMC, AS9100). Customers with program-specific security or compliance requirements should contact us directly to discuss applicable flow-down clauses.