Legal

Privacy Policy

Last updated: October 28, 2026

Introduction and Scope

MPC Holding, Inc. (“MPCH”), MPCH.IO Labs, Inc., and Ti22, together with the subsidiaries and affiliates that are identified in this Policy as responsible for a particular service (collectively, “we,” “us,” or “our”), respect the privacy of individuals who visit our websites, use our applications or services, communicate with us, or otherwise interact with us. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information and describes choices and rights that may be available to you under applicable law.

This Policy applies to personal information collected through our domains (https://mpch.com/; https://mpch.com/ti22-defense), our applications and services that link to this Policy, and related business interactions such as inquiries, event registrations, and communications with us (collectively, the “Services”). A separate notice or agreement may apply where we provide a service under a separate contract or where applicable law requires a different notice.

Information that customers process using our products, such as Stronghold, Vault Services, ATLAS, and OTIG, may be governed by a separate agreement or notice that applies to those products.

This Policy does not apply to third-party websites, applications, or services that we do not operate, even if our Services link to them. Their privacy practices are governed by their own notices. Please review those notices before providing information to those third parties.

Personal Information We Collect

The information we collect depends on how you interact with us, the Services you use, and applicable law. Categories may include:

Information you provide

• Contact and business information, such as your name, business email address, telephone number, employer, job title, business address, and information you submit through forms, inquiries, event registrations, or other communications.
• Account and authentication information, such as account identifiers, credentials, and information needed to administer access to a service. We do not intend for you to send passwords or other authentication secrets through public contact forms.
• Identity or verification information, such as identifying details or documents, where a particular service, transaction, legal obligation, or security process requires verification.
• Communications and submitted content, including the contents of messages, attachments, feedback, support requests, and information you choose to provide.

Please do not send payment details, cryptographic keys, or recovery phrases through our public contact forms.

Information collected automatically

When you access the Services, we or our service providers may automatically collect technical and usage information, such as IP address, browser and device type, operating system, language settings, referring and exit pages, pages viewed, dates and times of access, approximate location inferred from IP address, and interactions with the Services. We may use cookies, pixels, web beacons, server logs, and similar technologies for the purposes described below.

Information from other sources

We may receive information from publicly available sources, business contacts, event organizers, social media platforms, service providers, and other third parties, where permitted by law. We may combine such information with information we already hold, subject to applicable legal requirements.

Please do not submit sensitive personal information or information subject to special handling requirements unless the relevant Service expressly requests it and you are authorized to provide it.

How We Use Personal Information

Subject to applicable law, we may use personal information to:

• Operate, provide, maintain, support, secure, and improve the Services;
• Respond to inquiries, provide requested information, manage business relationships, and communicate about products, services, events, or opportunities;
• Create and administer accounts, authenticate users, verify identity where required, and manage access permissions;
• Understand usage patterns, measure website and campaign performance, conduct analytics, and develop or improve products, features, and services;
• Send marketing or promotional communications where permitted by law, and honor opt-out requests;
• Detect, investigate, and prevent fraud, misuse, security incidents, and other potentially prohibited or unlawful activity;
• Comply with legal obligations, including export control and sanctions requirements such as those addressed in our Export Compliance notice, enforce applicable terms and agreements, protect our rights and the rights and safety of others, and establish or defend legal claims; and
• Carry out internal business operations, including auditing, reporting, and corporate transactions.

Where required by law, we will identify the applicable legal basis for processing, such as performance of a contract, compliance with a legal obligation, legitimate interests, or consent. Where processing relies on consent, you may withdraw consent as described in this Policy; withdrawal does not affect processing that occurred before withdrawal.

Cookies and Similar Technologies

We and our service providers may use cookies and similar technologies to make the Services function, remember preferences, understand traffic and usage, improve performance, and—where enabled and permitted—measure or deliver advertising.

Depending on the Services and settings, these technologies may include:

• Strictly necessary technologies required to provide a requested feature, maintain security, or operate the Services;
• Functional technologies that remember settings and preferences;
• Analytics technologies that help measure and understand use of the Services; and
• Advertising or targeting technologies, if used, that help measure campaigns or deliver relevant advertising across services.

Where applicable law requires consent before non-essential cookies or similar technologies are used, we will seek that consent and provide a way to manage preferences. You may also be able to control cookies through your browser or device settings. Blocking certain technologies may affect the availability or functionality of some features.

Embedded features from our providers, including the Pipedrive inquiry form and the YouTube video player, may set their own cookies or collect usage information.

How We Disclose Personal Information

We may disclose personal information, as permitted by law, to the following categories of recipients:

• Service providers and processors that support website hosting, cloud services, analytics, communications, customer support, security, event administration, or other business operations;
• Our subsidiaries and affiliates, including MPCH and Ti22, where necessary for the purposes described in this Policy and subject to applicable safeguards;
• Professional advisers, auditors, insurers, and similar recipients where reasonably necessary for their services;
• Government authorities, regulators, courts, law enforcement, or other parties when required by law or where we reasonably believe disclosure is necessary to comply with legal process, protect rights or safety, investigate fraud or security issues, or establish or defend legal claims; and
• A potential or actual purchaser, investor, successor, or other relevant party in connection with a merger, acquisition, financing, restructuring, sale of assets, or similar corporate transaction, subject to applicable law.

We may disclose information in aggregated or de-identified form that is not reasonably capable of identifying an individual, subject to applicable law.

Service Providers

We rely on service providers to operate our websites and manage inquiries, including:

• Website hosting: Our websites are built and hosted on Webflow.
• Customer relationship management: The inquiry form on our Contact page is provided by Pipedrive, and submissions are stored in our Pipedrive CRM and used as described in How We Use Personal Information.
• Embedded video: The video on our home page is played from YouTube when you choose to open it.

Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Policy, including providing the Services, maintaining business records, meeting legal, accounting, reporting, and contractual requirements, resolving disputes, enforcing agreements, and protecting our rights. Retention periods vary depending on the type of information, the context in which it was collected, and applicable legal requirements.

When personal information is no longer required, we will take reasonable steps to delete it, anonymize it, or securely isolate it until deletion is practicable, subject to legal obligations and legitimate record-retention requirements.

Security

We use administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You should use appropriate care when sending information over the internet.

International Data Transfers

We may process and store personal information in the United States and other countries where we, our affiliates, or our service providers operate. Privacy and data-protection laws in those countries may differ from the laws where you live. Where required by applicable law, we will use an appropriate transfer mechanism or safeguard for international transfers.

In some regions (like the European Economic Area), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; and (iv) if applicable, to data portability. In certain circumstances, you may also have the right to object to the processing of your personal information. To make such a request, please contact us at dpo@mpch.com. We will consider and act upon any request in accordance with applicable data protection laws.

If you are a resident of the UK, and you believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority.

If you are resident in the European Economic Area and you believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority. You can find their contact details here: http://ec.europa.eu/justice/dataprotection/.

Your Privacy Rights and Choices

Depending on your location and applicable law, you may have rights to request access to, correction of, or deletion of personal information; obtain a copy of certain information; object to or restrict certain processing; withdraw consent; or receive information in a portable format. You may also have the right to appeal a decision on a privacy request or lodge a complaint with a data-protection authority.

To submit a privacy request, contact us at dpo@mpch.com. We may need to verify your identity and the jurisdiction in which you reside before processing a request. We will respond within the time required by applicable law. Some rights are subject to exceptions, and we may retain information where the law permits or requires us to do so.

Marketing communications: You may opt out of promotional emails by using the unsubscribe link in the message or contacting us. Even if you opt out of marketing, we may still send non-promotional messages relating to a service, transaction, security issue, or legal obligation.

Cookies and advertising choices: Where applicable, you may use the cookie-preference tool or other mechanism provided on the Services to change your choices. Browser settings and legally recognized opt-out preference signals may also be available, depending on the applicable law and our technology.

Additional Information for Certain U.S. Residents

Certain U.S. state privacy laws provide residents with specific rights and require businesses to disclose additional information about their collection, use, disclosure, sale, or sharing of personal information. Where such laws apply, this Policy is intended to be read together with any state-specific notice or supplemental disclosures we provide.

California residents may have rights under California privacy laws, including rights to know/access, correct, delete, and opt out of certain sales or sharing of personal information, subject to statutory definitions and exceptions. The rights that apply depend on the facts and legal requirements. Use the contact details in Your Privacy Rights and Choices to submit a request.

Children and Minors

The Services are not directed to children under 18, and we do not knowingly collect personal information online from children under 18 through the Services. If we learn that we have collected such information in a manner that requires deletion under applicable law, we will take appropriate steps. If you believe a child has provided personal information to us, contact us at dpo@mpch.com.

Third-Party Websites and Services

The Services may link to third-party websites, platforms, or services or include third-party features. We do not control and are not responsible for the privacy practices of those third parties. Their collection and use of information are governed by their own policies and terms.

Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, Services, or legal requirements. We will post the revised Policy and update the “Last updated” date. Where required by law, we will provide additional notice or obtain consent for material changes. Please review this Policy periodically.

Contact Us

For questions, concerns, or requests relating to this Policy or our handling of personal information, contact:

MPCH and Ti22 — Privacy Contact
Email: dpo@mpch.com

General business and sales inquiries can be submitted through the form on our Contact page.

Terms of Use

Version 0.9

These Terms of Use ("Terms") govern your access to and use of mpch.com and its related pages (the "Website"), which is operated by MPC Holding, Inc. ("MPCH," "we," "us," or "our"), a company headquartered in New York, USA. The Website describes the products and services of MPCH and its defense-technology subsidiary, Ti22, LLC ("Ti22"). Where the context requires, references to "we," "us," and "our" include Ti22.

By accessing or using the Website, you agree to be bound by these Terms. If you use the Website on behalf of an organization, you represent that you are authorized to accept these Terms on its behalf, and "you" includes that organization. If you do not agree to these Terms, you may not use the Website.

Permitted Use of the Website

Subject to these Terms, we grant you a limited, revocable, non-exclusive, and non-transferable permission to access and view the Website for informational and internal business purposes, such as learning about our products and services or contacting our team. You may print a reasonable number of pages for these purposes, provided all proprietary notices remain intact. We may modify, suspend, or discontinue any part of the Website at any time and without notice.

Intellectual Property

The Website and its content, including text, graphics, animations, video, and software, are owned by or licensed to MPCH or Ti22 and are protected by copyright, trademark, and other intellectual property laws. Except for the limited permission granted in these Terms, nothing on the Website grants you any license or right in that content, whether by implication, estoppel, or otherwise.

The MPCH and Ti22 names and logos, and the names of our products and services, such as Stronghold, ATLAS, and OTIG, may not be used without our prior written permission. Other names and logos appearing on the Website belong to their respective owners.

Prohibited Conduct

When using the Website, you agree not to:

• attempt to gain unauthorized access to, or probe, scan, or test the vulnerability of, the Website or any related system without our express written authorization;
• use robots, scrapers, or other automated means to copy or collect content from the Website, including to train artificial intelligence models, except for indexing by public search engines;
• interfere with or disrupt the Website, including by introducing malicious code or imposing an unreasonable load on the systems that host it;
• submit false or misleading information through any form on the Website, or impersonate any person or organization; or
• use the Website for any unlawful, fraudulent, or harmful purpose.

We may investigate suspected violations, restrict or terminate access to the Website, and cooperate with law enforcement authorities where appropriate. If you believe you have identified a security vulnerability in the Website, please let us know through the Contact page rather than testing further.

Export Controls and Sanctions

Certain products, technology, and technical information of MPCH and Ti22, including OTIG items, are subject to U.S. export control laws, including the Export Administration Regulations, and to U.S. economic sanctions. You may not access, download, export, or reexport any materials from the Website in violation of those laws.

By using the Website, you represent that you are not located in, or ordinarily resident in, a country or region subject to comprehensive U.S. sanctions, and that you are not identified on any U.S. government restricted party list. Further detail appears in the Export Compliance section of this page.

Product Information

Information on the Website about our products, services, and capabilities is provided for general informational purposes only. It does not constitute an offer, a binding commitment, a warranty, or legal, security, or compliance advice, and it may change without notice. Use of Stronghold, Vault Services, ATLAS, OTIG, and our other offerings is subject to separate written agreements with MPCH or Ti22, which govern in the event of any conflict with these Terms.

References on the Website to independent reviews, patent filings, or customer statements, including those in the Security Validation section of this page, reflect circumstances at the time they were made. They are not a guarantee of security or of any particular result.

Third-Party Links and Content

The Website may contain links to third-party websites and includes content and functionality provided by third parties, such as video hosted on YouTube and the inquiry form on our Contact page, which is provided by Pipedrive. These services are governed by their own terms and privacy practices and may set their own cookies. We do not control, and are not responsible for, third-party websites or services, and a link does not imply our endorsement.

For information about how we handle information you submit through the Website, please see our Privacy Policy.

Disclaimers

To the fullest extent permitted by law, the Website and its content are provided "as is" and "as available," without warranties of any kind, whether express, implied, or statutory, including warranties of merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the Website will be uninterrupted, secure, or error-free, or that its content is complete, accurate, or current. Your reliance on Website content is at your own risk.

Limitation of Liability

To the fullest extent permitted by law, MPCH, Ti22, and their respective affiliates, officers, directors, employees, and agents will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of data, profits, or business opportunity, arising out of or relating to your use of, or inability to use, the Website, even if advised of the possibility of such damages.

These limitations apply to the Website only; liability relating to our products and services is addressed in the applicable agreements. Some jurisdictions do not allow certain exclusions or limitations of liability, so some of the above may not apply to you.

Governing Law

These Terms, and any dispute arising out of or relating to them or the Website, are governed by the laws of the State of New York, without regard to its conflict-of-laws principles. You consent to the exclusive jurisdiction of the state and federal courts located in the State of New York for any such dispute.

If any provision of these Terms is held unenforceable, the remaining provisions will remain in full effect. Our failure to enforce any provision is not a waiver of our right to do so later.

Changes to These Terms

We may revise these Terms from time to time to reflect changes to the Website, our offerings, or applicable law. The version identifier at the top of these Terms indicates the current version. Revised Terms take effect when posted, and your continued use of the Website after that constitutes acceptance of them, so we encourage you to review this page periodically.

Contact Us

Questions about these Terms may be submitted through our Contact page. Questions concerning export controls, sanctions, or other compliance matters may be directed to compliance@mpch.com.

Export Compliance

Version 1.0

MPC Holding, Inc. and its subsidiary Ti22, LLC (“Ti22”) are committed to full compliance with U.S. export control and economic sanctions laws, including the Export Administration Regulations (“EAR”) administered by the U.S. Department of Commerce, Bureau of Industry and Security (“BIS”), and the sanctions programs administered by the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”).

Product Classifications

BIS CCATS Reference: G199601, issued March 16, 2026.

Restricted Destinations

Ti22 does not export, reexport, transfer, or provide services (including SaaS access) to any person or entity located in, or ordinarily resident in, the following jurisdictions:

• Cuba, Iran, North Korea, and Syria
• The Crimea, so-called Donetsk People’s Republic, and so-called Luhansk People’s Republic regions of Ukraine
• The Russian Federation and Belarus, subject to narrow exceptions
• The government or governmental instrumentalities of Venezuela

Restricted Parties

Ti22 will not engage in transactions with any party identified on:

• The BIS Denied Persons List, Entity List, or Unverified List
• The OFAC Specially Designated Nationals and Blocked Persons List, including any entity owned 50% or more by one or more SDNs
• The BIS Military End User List, or any foreign entity owned 50% or more by listed persons under the BIS Affiliates Rule
• Any party on OFAC’s Consolidated Non-SDN List, absent advance counsel approval

Customers and partners may self-screen using the U.S. Government’s Consolidated Screening List at https://www.trade.gov/data-visualization/csl-search.

Prohibited End Uses and End Users

Regardless of destination, OTIG items may not be used, and Ti22 will not knowingly support their use, for:

• Any “military-intelligence end use” or by a “military-intelligence end user” in Belarus, Burma, Cambodia, China (including Hong Kong and Macau), Russia, Venezuela, Cuba, Iran, North Korea, or Syria
• Any “military end use” or by a “military end user” in Russia, Belarus, or Iraq
• Any activity supporting the proliferation of nuclear, chemical, or biological weapons, or missile or unmanned aerial vehicle systems
• Any transaction the exporter knows or has reason to know will result in a violation of U.S. law

Government End-User Limitations

OTIG proprietary source code (ECCN 5D002) and encryption technology (ECCN 5E002) may not be exported to any “government end user” located or headquartered outside the License Exception ENC Favorable Treatment Countries identified in Supplement No. 3 to Part 740 of the EAR. 5E002 encryption technology also may not be exported to end users in Country Group D:1, E:1, or E:2.

Destination Control Statement

Physical shipments of OTIG hardware or software media are accompanied by the following Destination Control Statement required by 15 C.F.R. § 758.6(a)(1):

“These items are controlled by the U.S. Government and authorized for export only to the country of ultimate destination for use by the ultimate consignee or end-user(s) herein identified. They may not be resold, transferred, or otherwise disposed of, to any other country or to any person other than the authorized ultimate consignee or end-user(s), either in their original form or after being incorporated into other items, without first obtaining approval from the U.S. government or as otherwise authorized by U.S. law and regulations.”

Geographic Access Controls

Ti22 implements IP-address-based access controls to prevent client devices located in embargoed jurisdictions from accessing the Ti22 platform, download sites, and related online resources.

Reporting Suspected Violations

If you become aware of a suspected violation of these policies or of U.S. export control or sanctions laws in connection with OTIG items, please contact compliance@mpch.com promptly so we can investigate and, if appropriate, disclose to BIS or OFAC.

Changes to This Notice

The EAR and U.S. sanctions programs are dynamic. Ti22 reviews this notice at least annually and when material product changes occur, and we encourage customers to revisit this page regularly.

Security Validation

Version 0.9

MPC Holding, Inc. ("MPCH," "we," "us") and its subsidiary Ti22, LLC ("Ti22") develop technology that protects cryptographic keys, digital assets, and sensitive data, including Stronghold enterprise key management, Vault Services, ATLAS AI authentication and governance, and Ti22's OTIG Transit Node. Because customers rely on these products to safeguard sensitive keys and assets, we believe security claims should be supported by evidence that others can examine.

This Security Validation statement summarizes how MPCH validates the security of its technology. It is provided for general information only, does not constitute a warranty or representation regarding any specific deployment, and does not amend any agreement between MPCH or Ti22 and its customers.

Validation Overview

MPCH does not rely on any single measure to demonstrate the security of its technology. Our approach combines several complementary forms of evidence, each described in more detail below:

• Independent review of our technology by an established third-party security firm
• Internal validation practices applied during design and development
• Patent filings covering the core methods behind our products
• Public statements from organizations that use or work with MPCH technology

Independent Security Review

MPCH's enterprise key storage and management solution has been the subject of an independent cyber security review by NCC Group. NCC Group has published a case study describing the engagement, and its published statement describes the review as providing credible, independent assurances that the technology secures sensitive keys and data against current and emerging threats.

Any independent review reflects the scope agreed for that engagement and the state of the technology at the time it was performed. Detailed findings from third-party reviews are generally treated as confidential. Customers and prospective customers with a legitimate business need may request further information, which MPCH may share at its discretion and subject to appropriate confidentiality terms.

Ongoing Validation Approach

Independent review is one part of a broader approach. Depending on the product and the nature of a change, MPCH's validation activities may include:

• Architecture and design reviews focused on key handling, access control, and trust boundaries
• Security testing before major releases
• Review of third-party and open-source components incorporated into our products
• Tracking and remediation of issues identified through testing, review, or external reports

These activities are not performed on a fixed schedule. Their scope and frequency vary by product and may be adjusted as threats, technologies, and customer requirements evolve.

Intellectual Property

MPCH's technology is supported by patent filings in the United States, at the European Patent Office, and under the Patent Cooperation Treaty. Together, these filings cover seven areas:

• Cryptographic Key Management
• Multi-Party Computation
• Zero Trust Authentication
• Traffic Security and Threat Management
• Duress and Asset Security
• Cryptographic Access Control
• AI Governance

Patent filings do not guarantee that patents will be granted in any jurisdiction, and a patent filing is not a certification of security.

Customer Validation

Customers and other organizations have publicly commented on MPCH's technology. In an announcement distributed through PR Newswire concerning hardware wallet backup and recovery for Consensys, the Chief Risk Officer of Consensys stated that Stronghold improved the company's already strong self-custody posture. Bitwave's Chief Revenue Officer has publicly named MPCH a trusted provider for Canton financial infrastructure.

These statements reflect the views and circumstances of the organizations that made them and do not guarantee similar results in any other environment.

Insurance Support

MPCH's architecture is designed to support client-procured insurance for cryptographic storage. MPCH may, at its discretion, provide technical information about its architecture to assist a customer in discussions with its insurers or brokers. Insurance is arranged directly between each customer and its insurer. MPCH does not itself provide insurance and does not guarantee that coverage will be available on any particular terms.

Export Classification

Ti22's OTIG items are classified under the Export Administration Regulations ("EAR") administered by the U.S. Department of Commerce, Bureau of Industry and Security ("BIS"). The applicable classification is recorded under BIS CCATS reference G199601. A classification does not by itself authorize any export, reexport, or transfer. Further details are set out in the Export Compliance section of this page.

Reporting a Security Concern

If you believe you have identified a security vulnerability or other security concern affecting an MPCH or Ti22 product, service, or website, please contact compliance@mpch.com. Include enough detail for us to understand the issue, such as the affected product or page and any steps that demonstrate it. Please do not send credentials, private keys, or data belonging to others.

Please act in good faith, avoid accessing or modifying data that does not belong to you, and allow us a reasonable opportunity to investigate before disclosing the issue publicly. This statement does not authorize any testing of MPCH or Ti22 systems, networks, or customer environments, and submitting a report does not create any entitlement to compensation.

Updates to This Statement

We may update this statement if additional reviews are completed, our products change, or further validation becomes available. The version shown with this statement identifies the current text.