Code of Conduct

Owner: Security officer / CEO Effective date: 2026-07-19 Applies to: All WealthY employees, contractors, board members, and anyone acting on behalf of WealthY

1. Our commitment

WealthY is committed to providing a safe, respectful, and inclusive environment for everyone who works with us. This Code of Conduct establishes the behavioural standards we expect from ourselves and each other. It applies to interactions with colleagues, customers, vendors, and the broader community.

2. Expected behaviours

Every person acting on behalf of WealthY is expected to:

• Treat others with respect --- including colleagues, customers, prospects, vendors, competitors, and members of the public. Communication should be professional and considerate regardless of context.
• Assume good intent --- approach disagreements with curiosity rather than accusation. Ask questions before drawing conclusions.
• Give and receive feedback constructively --- feedback should focus on work, not on the person. When receiving feedback, listen fully before responding.
• Take responsibility for mistakes and learn from them. Post-mortems are blameless (see our internal incident post-mortem template).
• Speak up when something feels wrong. Silence in the face of a violation is itself a violation.
• Respect confidentiality --- never share customer information, business-sensitive information, or personal information about colleagues without a clear business justification.
• Represent WealthY honestly --- in public statements, marketing, sales, and product descriptions.

3. Prohibited behaviours

The following are strictly prohibited and will result in disciplinary action up to and including immediate termination:

3.1 Harassment + discrimination

• Harassment, bullying, or intimidation of any kind
• Discrimination on the basis of race, ethnicity, national origin, religion, gender, gender identity, sexual orientation, age, disability, marital status, family status, or any other protected characteristic under the Ontario Human Rights Code
• Sexual harassment including unwelcome advances, requests for sexual favours, sexual jokes, or unwanted physical contact
• Displaying or sharing offensive imagery, jokes, or material

3.2 Retaliation

• Retaliation against anyone who reports a violation of this Code in good faith
• Retaliation against anyone who participates in an investigation
• Creating a hostile environment for someone who has raised concerns

3.3 Dishonesty + fraud

• Misrepresenting WealthY's capabilities, security posture, or compliance status to customers, prospects, or regulators
• Falsifying business records, expense reports, timesheets, or SR&ED time logs
• Insider trading based on non-public information about WealthY or its customers
• Bribery or improper payments to influence business decisions

3.4 Conflicts of interest

• Undisclosed financial interests in customers, vendors, or competitors
• Undisclosed side employment that competes with WealthY or affects work performance
• Using WealthY resources, information, or relationships for personal benefit

3.5 Violation of security or privacy

• Accessing customer data without a documented business need
• Sharing credentials with anyone
• Copying customer data to personal devices or accounts
• Bypassing security controls

4. Working with customers + vendors

• Deliver what we promise. If we cannot meet a commitment, communicate proactively.
• Never guarantee outcomes we do not control (e.g. "you will pass your CIRO audit if you use WealthY").
• Be honest about product limitations. Overselling erodes trust.
• Escalate concerns internally before they become customer-facing problems.

5. Public conduct + social media

WealthY employees are also members of the public. When identifying yourself as a WealthY employee on social media, in blog posts, at industry events, or in interviews:

• Make clear whether you are speaking for yourself or for WealthY
• Do not disclose confidential business information
• Do not disparage customers, competitors, or colleagues
• Do not represent WealthY's position on matters outside your authority (product roadmap, financial results, personnel decisions)

Personal accounts and personal opinions are your own. Balanced and respectful engagement in industry discussion is encouraged.

6. Interactions with regulators

If contacted by a regulator (CIRO, OPC, provincial commission) about WealthY:

• Acknowledge the contact promptly
• Do not answer substantive questions without first consulting legal counsel
• Route the inquiry to the security officer or CEO immediately
• Do not destroy or alter any documents or communications relevant to the inquiry

7. Reporting violations

Anyone who witnesses or experiences a violation of this Code should report it:

• Directly to the security officer (currently the CEO)
• Anonymously through the reporting channel documented in the Employee Handbook (once established)
• To external regulators if the violation involves criminal conduct, privacy breaches, or securities-law violations

WealthY commits to: - Take every report seriously - Investigate promptly and confidentially - Communicate the outcome to the reporter when appropriate - Take corrective action if a violation is confirmed - Protect the reporter from retaliation

8. Consequences of violation

Violations are handled proportionally to their severity:

• Minor (single lapse, no harm caused): coaching + documented conversation
• Moderate (repeated minor or significant single instance): formal written warning + additional training + potential role adjustment
• Serious (harassment, fraud, security breach, or repeated moderate violations): termination + potential legal action + report to authorities where required

Immediate termination is warranted for: - Harassment or discrimination - Retaliation against a reporter - Intentional exposure or theft of customer data - Fraud or misrepresentation to regulators or customers - Any violation of applicable Canadian law committed in the course of WealthY work

9. Interaction with other policies

This Code of Conduct complements: - Employee Handbook (internal) - Acceptable Use Policy (internal) - Information Security Policy (internal) - Vulnerability Disclosure Policy

When policies conflict, the more restrictive interpretation applies.

10. Amendments

This Code may be updated at any time. Material changes require 30 days' notice and re-acknowledgement.

Acknowledgement

I have read and understood the WealthY Code of Conduct. I agree to be bound by its terms and to report any violations promptly.

Signed: ___ Date: _ Print name: ___ Role: ___

1001536620 Ontario Corp., carrying on business as WealthY · Ownership and legal information