Galooli Business Continuity Management

This overview outlines how Galooli owns and governs Business Continuity Management (BCM) across the organization - spanning product/technology, corporate IT, operations, workforce, facilities, logistics and procurement, ethics, financial/business resilience, and enterprise risk. It brings together Galooli's continuity, disaster recovery, risk management, and governance framework into a single reference for our partners and customers. 

Business continuity at Galooli is governed top-down and owned horizontally: accountability sits with the Board and Executive Management, while day-to-day coordination across every business function is centralized under the Partnerships department and the Chief Partnerships Officer (CPO). 

• Board of Directors - receives risk and continuity reporting at least annually. 

• Executive Management / CEO - overall accountability for risk and continuity posture. 

• Chief Partnerships Officer (CPO) & Partnerships Department - own and coordinate Business Continuity Management horizontally across the organization; review and endorse incident response and recovery plans spanning every function below, regardless of which department is affected. 

-  Quality & Environmental Manager / Head of Corporate Development - reports into the CPO (Partnerships); owns ISO 9001 and ISO 14001 implementation. 

-  ISO 27001 (Information Security) ownership is shared across the CPO, COO, CTO, IT Manager and CISO. 

• Risk Committee - reviews operational and continuity-related risks; meets quarterly. 

• SHEQ Committee (Safety, Health, Environment & Quality) - oversees safety and environmental risk domains. 

• Plan Owner - Chief Technology Officer (CTO) - owns the Product Disaster Recovery Plan, declares and manages incidents, approves plan revisions. 

• Recovery Engineering Team & 24/7 On-Call Rotation - execute backup, restore and recovery operations. 

Rather than treating continuity as a single technical plan, Galooli manages it as a structured, cross-functional programme with consistent governance mechanics applied to every incident type, regardless of the business function involved. 

• Ownership by topic: every continuity and incident-response procedure is assigned a named topic owner and is version-controlled, with periodic review by the CPO. 

• RACI-based governance: each scenario defines clear Responsible, Accountable, Consulted and Informed parties across Management, a dedicated Disaster Management Team, Employees, Suppliers, Investors and Customers. 

• Defined recovery objectives: applicable scenarios carry an explicit Recovery Point Objective (RPO) and Recovery Time Objective (RTO), reviewed as part of the same governance cycle described in Section 1. 

• Structured communication plans: each incident type has a pre-defined communication plan by stakeholder group (Management, Disaster Management Team, Employees, Suppliers, Investors, Customers), so notification is consistent rather than improvised. 

• Formal closure: every incident is tracked through to a documented closure step, including a Root Cause Analysis (RCA) for major incidents, with testing and exercise records retained for audit purposes. 

Galooli's continuity framework spans nine functional areas. Each is governed under the same accountability model described above, with function-specific procedures, recovery objectives and (where applicable) certifications. 

Galooli's product/cloud infrastructure is protected under a formal Disaster Recovery Plan. By default, the production environment is hosted in AWS us-east-1 using a Multi-Availability Zone (Multi-AZ) architecture for resilience and automatic failover. Where required by customer, regulatory, or data-residency requirements, Galooli may support deployments in other AWS regions, including European regions, as well as dedicated or on-premises environments, subject to the applicable solution architecture. The infrastructure is supported by immutable backups, continuous automated detection, and a tiered recovery model. 

• Recovery tiering: Tier 1 (critical, system-of-record) - RPO ≤15 min, RTO ≤4 hours; Tier 2 - RPO hours-1 day, RTO ≤24 hours; Tier 3 - best-effort/redeploy. 

• Protection mechanisms including: AWS Backup (immutable, GOVERNANCE-mode locks), S3 Object Lock (WORM), OpenSearch Snapshot Management, Multi-AZ automatic failover. 

• Testing cadence: weekly automated backup verification, quarterly restore evidence, annual full validation exercise in an isolated environment. 

For details, see: Galooli's Product Disaster Recovery Plan  |  Privacy, Security, Backup and Recovery 

Corporate IT systems - email and collaboration platforms, financial/ERP systems, CRM, and corporate web infrastructure - are covered by dedicated incident response procedures, maintained separately from the customer-facing product/cloud DR programme in Section 3.1. This separation helps isolate internal corporate-system disruptions from customer-facing platform availability and supports independent recovery processes. 

• Defined response procedures cover categories including cyber-attack or data-compromise attempts, corporate infrastructure outages, and ransomware, each with an assigned recovery objective and owner. 

• Information security incident management is governed under ISO 27001-aligned procedures, including secure development, patch management, and cloud-based computing controls. 

Customer-facing continuity is delivered through a tiered support model with defined SLAs and a 24/7 monitoring function, ensuring service levels hold even under disruption. 

• Customer support operates under severity-based response and resolution targets, supported by a tiered L1-L3 model and 24/7 Global NOC coverage for critical system-wide incidents. Applicable service levels are defined in the relevant SLA. 

For further information, see: Galooli's SLA Policy 

Continuity of service does not rely on any single individual, and personnel safety is managed through the same structured governance model as technical continuity. 

• Multi-person Recovery Engineering Team and 24/7 on-call rotation, rather than a single point of contact. 

• Global office footprint spanning Israel, the US, Nigeria, Uganda and Kenya, supporting cross-regional operational redundancy. 

• Dedicated personal safety and workplace incident procedures, managed through HR under the same RACI and closure model described in Section 2. 

• Secure hybrid and remote-working capabilities support continued operations when access to a Galooli office is disrupted or unavailable, enabling employees and critical business functions to operate remotely where required. 

Physical office continuity is addressed through defined emergency response procedures, supported by Galooli's ISO 9001-certified quality management system and ISO 14001-certified environmental management system. 

• Defined response procedures address office/facility closure scenarios, including fire, severe weather, force majeure, or natural disaster, at any Galooli location. 

• A designated Emergency Response Team is responsible for executing these procedures, supported by regular employee training and awareness on emergency response protocols. 

• Galooli's multi-country office footprint (Israel, US, Nigeria, Uganda, Kenya) provides natural geographic redundancy, so no single facility is a single point of failure for the business. 

Supply chain resilience covers both supplier quality/continuity and physical logistics disruption that could affect hardware delivery. 

• Target: 85% of key suppliers ISO 14001-certified by 2026, rising to 100% by 2030, as part of Galooli's Net Zero and supplier-quality roadmap. 

• Suppliers Code of Conduct governs ethical, quality and environmental expectations for all key suppliers. See: Suppliers Code of Conduct 

• Defined response procedures address logistics disruptions - such as port, shipping, or cross-border transport interruptions - that could affect hardware delivery timelines, in addition to supplier-quality continuity requirements. 

• Ongoing supplier monitoring is integrated into ordinary procurement governance, rather than a standalone annual audit exercise. 

• Ongoing stock and inventory monitoring, including buffer/safety stock for critical components, to reduce exposure to single points of failure in the supply chain. 

Galooli maintains defined procedures for addressing ethical and conduct-related incidents involving any party in its value chain, backed by an anonymous reporting channel and Board-level oversight. 

• Defined response procedures address corruption or improper conduct involving an employee, supplier, partner or distributor, with an assigned recovery/resolution timeline and closure process. 

• Anti-Bribery, Fraud and Corruption Policy and a Code of Conduct apply across the organization and its partners. 

• Whistleblower Policy provides an anonymous reporting channel (ethics@galooli.com), independent of the standard management chain. 

Financial resilience is incorporated into Galooli's broader business continuity and enterprise risk framework, supporting the company's ability to maintain critical operations and service commitments during periods of disruption. 

• Financial and operational risks are assessed as part of Galooli's ongoing risk management and management-review processes.

• Business planning and budgetary controls consider operational requirements and resources needed to maintain continuity of critical activities.

• Material financial or business risks that could affect operational continuity are escalated through the established management and enterprise-risk governance framework. 

Beyond function-specific continuity, Galooli maintains a structured, board-reported risk process covering the wider business. 

• Annual EMS Risk Assessment Procedure evaluates likelihood, impact, mitigation effectiveness and residual risk across operational, technological and environmental domains; reported to Executive Management and the Board at least annually. 

Climate Transition Plan and Net Zero roadmap (interim milestones through 2027 and 2035, targeting Net Zero by 2040) are tracked alongside operational risk.  

Galooli operates under a structured framework of documented policies, procedures and management controls, consolidated and referenced through the Galooli Handbook. This framework supports consistent governance, risk management, information security, quality, environmental management and operational resilience across the organization. The Disaster Recovery and Business Continuity framework operates within, and is supported by, these established organizational policies and management systems. 

• ISO 9001:2015 (Quality Management), ISO 27001 (Information Security), ISO 14001 (Environmental Management). 

• GDPR-aligned data protection, supported by a Data Processing Addendum (DPA) and Security & Privacy Policies. 

• Code of Conduct and Whistleblower Policy (anonymous reporting channel: ethics@galooli.com). 

• ISO 9001: Quality Manual Policy; Risk Planning and Management; Software Development. 

• ISO 27001: Information Security; Information Security Incident Report; Secure Development; Cloud Based Computing; Risk Assessment and Treatment; Patch Management. 

• ISO 14001: Emergency Response Plan; Environmental Manual; Risk Assessment Procedure. 

See: Quality Standards, Certifications and Patents 

Galooli's approach to business continuity is distributed by design and centrally governed in practice: accountability sits with the Board and Executive Management, day-to-day coordination is owned by the CPO and the Partnerships department, and each of the nine functional areas above - product/technology, corporate IT, operations, workforce, facilities, logistics/procurement, ethics, financial/business resilience, and enterprise risk - operates under the same RACI-based governance model, with defined recovery objectives, communication plans, and closure procedures. This is not a single continuity document, but a consistently governed programme spanning the entire organization. 

• Anti-Bribery, Fraud and Corruption Policy  |  Whistleblower Policy 

• Code of Conduct  |  Suppliers Code of Conduct 

• Galooli CDP Corporate Disclosure - Sec. C15.1 (EMS Risk Assessment Procedure) 

• Galooli ESG Report, December 2025 (FY2024 disclosures) 

• Galooli Handbook - Sections A (General), B (Ethics & Business Conduct), C (Information Security & Privacy), D (Human Rights, Fair Employment & Safe Workplace), E (Sustainability & Environmental Policies), F (Responsible Supply Chain) 

• Galooli Product Disaster Recovery Plan 

• Galooli Product Disaster Recovery Plan - Internal Detailed Edition (v1.0, Confidential) 

• Galooli SLA Policy 

• Quality Standards, Certifications and Patents 

• Galooli Climate Transition Plan and Net Zero roadmap 

• Information Security Incident Response Procedure (Internal)  

• Privacy, Security, Backup and Recovery 

For specific inquiries or further information, please contact: Partnerships@galooli.com