TestMu AI Code of Business Conduct & Ethics

1. Commitment Statement

At TestMu, we believe that trust, innovation and integrity go hand in hand. Our long-term success as a global, AI-native quality engineering platform depends not only on what we build, but on how we build it, how we conduct ourselves, make decisions, treat one another, engage with our customers, and affect the world around us.

We are committed to an environment where every employee, contractor, supplier, reseller and business partner acts lawfully, ethically and responsibly. This Code of Business Conduct & Ethics is our guide to principled decision-making. It reflects global best practice and is informed by the UN Global Compact principles and the OECD Guidelines for Multinational Enterprises. By upholding these standards together, we shape a future defined by trust, responsibility and sustainable innovation.

2. Overview

2.1 What This Code Is

The Code of Business Conduct & Ethics ("the Code") sets out how we operate with integrity, accountability and transparency in every interaction and in every part of our global business. It establishes the minimum expectations for lawful, ethical and responsible conduct across all TestMu operations, and is supported by our internal policies, procedures and training, which give more detailed instruction for specific situations.

This Code applies to all directors, officers, employees and contingent workers of TestMu and its subsidiaries, wherever located. Suppliers and partners are bound by the Supplier Code of Conduct and by their agreements with us. You are expected to follow this Code whenever you perform work for TestMu, represent TestMu, or take part in company-related activities whether on company premises, remotely, or at external or virtual events.

2.2 Making the Right Decision

The Code cannot cover every situation. When weighing a decision or a course of action, ask yourself:

• Is it legal, in both the spirit and the letter of applicable laws and regulations?
• Is it ethical, and consistent with this Code and TestMu policies?
• Would I be comfortable explaining this action to my manager, my family, or in a public forum?
• Could this harm TestMu, our people, our customers or our reputation, directly or indirectly?

If the answer to any of these is uncertain, stop and seek guidance. The Code is designed to help everyone understand their responsibilities, guide ethical decision-making, prevent and resolve compliance risk, maintain a culture where people are empowered to speak up, and reinforce our commitment to responsible AI, security and privacy by design, and sustainable and ethical impact.

3. Our Core Values

4. In Our Workplace

When people are respected, included and empowered, they are more creative, more innovative and more successful. We are committed to a safe, inclusive and productive environment where everyone can do their best work and feel valued for who they are.

4.1 Respect, Inclusion and Equal Opportunity

• We prohibit unlawful discrimination in hiring, treatment, promotion, compensation and access to training and benefits, on the basis of race, color, ethnicity, national origin, caste, religion or belief, sex, gender, gender identity or expression, sexual orientation, pregnancy or parental status, marital status, age, disability, genetic information, veteran status, political opinion, trade-union membership, or any other characteristic protected under applicable law.
• We embrace differences of background, thought, experience and perspective, and foster belonging by creating an environment where all voices can be heard.
• We build teams drawn from the available talent market, where everyone has the opportunity to thrive. Our Global Diversity, Equity & Inclusion Policy sets this out in full.

4.2 Prevention of Harassment and Hostile Conduct

Everyone has the right to work free from harassment, intimidation, bullying or abuse. Unwelcome remarks, gestures or advances are prohibited in any channel; threats of harm, violent behaviour, discriminatory slurs or jokes, and the creation of a hostile environment are unacceptable, in offices, while remote, during travel and on company platforms. Reports are investigated promptly and fairly, with corrective action and no retaliation against good-faith reporters. Our Global Anti-Harassment & Respectful Workplace Policy sets this out in full. In India, complaints within the Internal Committee's statutory jurisdiction are handled by the Committee under the Prevention of Sexual Harassment (POSH) Statement; all other complaints are handled under the Global Anti-Harassment & Respectful Workplace Policy.

4.3 A Safe, Healthy and Secure Workplace

• We maintain facilities and operations that comply with applicable health, safety, security and welfare laws.
• No one may work under the influence of illegal drugs or misuse medication in a way that impairs performance or safety; alcohol use must comply with event policy and never impair judgment or safety.
• Violence, threats, aggression and the possession of weapons on company premises or during company activities are prohibited unless authorized by law and by the Company.
• We promote mental and physical health and provide resources that support well-being.

4.4 Responsible Use of Company Assets and Information

• Assets include equipment, software, hardware, networks, cloud infrastructure, proprietary information, trademarks, patents and data.
• Assets are used only for legitimate business purposes, never for personal gain or unauthorized use.
• You are responsible for assets under your control and must avoid waste, theft, damage, disclosure or misuse.
• When handling company funds or expenses, spend wisely, follow policy and retain required documentation.

4.5 Confidentiality and Intellectual Property

We handle confidential, sensitive and proprietary information with care. You must not disclose confidential information or use it for personal gain, and the duty to safeguard it continues after your engagement ends. You must not use or disclose confidential data from prior employers unless authorized. Use secure systems, approved channels and encrypted storage, and share only the minimum necessary for the business purpose.

5. In Our Marketplace

5.1 Honest and Transparent Communications

We communicate honestly with customers, prospects, partners, suppliers and the public. We do not misrepresent product capability, performance, pricing or commitments; exaggerate results or benefits; omit information that could mislead; or make false or unsubstantiated comparisons about competitors.

5.2 Competing Fairly and Lawfully

We compete on the value, performance and reliability of our platform. We do not discuss pricing, customer allocation, markets or sales strategy with competitors; engage in price-fixing, bid-rigging or attempts to restrict fair competition; or improperly obtain or use competitors' confidential information. We gather competitive intelligence only through legal, public and ethical means.

5.3 Ethical, Customer-Centric Selling

We listen to customer needs and recommend solutions responsibly; provide accurate and complete information when entering agreements; honor commitments in contracts, support and service levels; and ensure no sale, renewal or negotiation involves pressure or deception. We build long-term partnerships, not short-term wins.

5.4 Working Responsibly with Partners and Suppliers

We expect partners, resellers and suppliers to uphold conduct consistent with this Code and our Supplier Code of Conduct, to comply with applicable laws and customer commitments, to protect confidential and customer information, and to act with integrity. We do not knowingly work with partners or suppliers who use forced labor or engage in human rights violations, environmental abuses, corruption or unethical conduct. Our commitments in this area are set out in the Supplier Code of Conduct, the Anti-Bribery and Anti-Corruption Statement and the Human Rights Statement.

5.5 Responsible Marketing and Public Representation

Marketing, public statements and brand communications must be truthful, accurate and non-misleading, respect privacy, confidentiality and regulatory restrictions, and pass the proper internal review where required. We do not use AI-generated, sourced or shared content in ways that misrepresent facts, violate intellectual property rights or undermine customer trust. When speaking publicly, we avoid sharing confidential information, recognize that personal posts can be read as company statements, and seek approval before responding to journalists, analysts or media.

6. In Our Business

6.1 Fair and Ethical Business Practices

Business decisions are based on ethical conduct, sound judgment, legal compliance and respect for people and commitments. We safeguard intellectual property and confidential information (our own and others'), maintain documentation that accurately reflects the transaction, and comply with applicable laws, regulations and contractual obligations.

6.2 AI, Data Protection and Privacy

We respect the privacy, data rights and digital autonomy of our customers, users, employees, suppliers and partners, and protect personal and business data throughout its lifecycle. As an AI-native platform, data protection is core to our business. Our privacy program is designed to comply with applicable data-protection and privacy laws, including but not limited to GDPR, UK GDPR, CCPA/CPRA and DPDP Act.

See our Privacy Policy, published on testmuai.com/trust/privacy.

6.2.1 Responsible AI and Data Governance

We design, train, deploy and monitor AI systems on principles of transparency, explainability, fairness and non-discrimination, model robustness and safety, human-in-the-loop oversight, and accountability across the AI lifecycle. We assess AI systems for bias, unintended consequences, misuse and impact on individuals and society. TestMu's AI management system is aligned with ISO/IEC 42001, with certification in progress, and references the NIST AI Risk Management Framework, the OECD AI Principles and applicable obligations under the EU Artificial Intelligence Act. AI systems are designed, deployed and monitored under human oversight with transparency, fairness, accountability, privacy and security as conditions of release. TestMu does not use customer data to train models except as permitted by the applicable agreement. Our Responsible AI commitments are published on the testmuai.com/trust/AI.

6.2.2 Data Processing Responsibilities

When we process data on behalf of customers, we act only on the customer's documented instructions; access data only when necessary and only through authorized personnel; apply encryption, access controls, monitoring, logging and secure infrastructure; and honor the data-residency and transfer commitments in our agreements. For internal processing we use data only for legitimate purposes, apply strict access controls, retain data only as long as necessary, and delete or anonymize it in accordance with our records-retention standards.

6.3 Working with Government and Regulated Customers

When working with government agencies or regulated industries like banking and financial services, healthcare, the public sector, additional legal and contractual requirements may apply. Understand the specific compliance requirements, follow procurement, reporting and documentation rules strictly, and seek guidance from Legal or Governance, Risk & Compliance when uncertain.

6.4 Accurate Books, Records and Disclosures

Our financial and operational records must be complete, accurate, transparent and properly documented. We do not falsify or alter records, maintain off-the-books transactions, misclassify revenue, expenses or reporting periods, prematurely accelerate or delay revenue, or provide misleading updates or forecasts. Each internal or external report to leadership, customers, auditors, regulators or the public must be truthful and reflect actual conditions.

6.5 Conflicts of Interest

A conflict of interest arises when a personal, financial, family or outside interest could influence, or appear to influence, the judgment you exercise on TestMu's behalf. You must:

• disclose any actual or potential conflict in writing to your manager and to Legal as soon as you become aware of it, and recuse yourself from the related decision;
• obtain written approval before taking outside employment, accepting a board or advisory seat, or dealing on TestMu's behalf with a related party, including a business in which you or a family member has a material interest; and
• not take for yourself, or direct to another person, a business opportunity discovered through your role or through the use of TestMu property or information, unless TestMu has first declined it in writing.

6.6 Gifts, Hospitality and Entertainment

Gifts, hospitality and entertainment given or received in connection with TestMu business must be modest, infrequent and transparent, and must never be offered or accepted to influence a decision or in exchange for improper advantage. Cash and cash equivalents, such as gift cards or vouchers, are never given or accepted. Nothing of value may be offered to a government official without prior written approval. Approval thresholds, recording requirements and the undertaking expected of third parties are set out in the Anti-Bribery and Anti-Corruption Statement.

6.7 Political Activity and Contributions

Personal political activity is a personal choice, conducted on personal time and at personal expense. No Company funds, facilities, equipment, name or endorsement may be used for political activity, and you must make clear that any political view you express is your own. TestMu does not make political contributions without the prior written approval of Executive Leadership.

7. Compliance with the Law

TestMu is committed to conducting business in compliance with applicable laws, regulations, industry standards and ethical expectations in every region where we operate. This Code sets consistent expectations worldwide; where local law is more restrictive, follow the local law, and where this Code sets a higher standard than local law, follow this Code.

7.1 Areas of Legal and Regulatory Compliance

• Anti-bribery and anti-corruption (the U.S. Foreign Corrupt Practices Act of 1977 (FCPA), the UK Bribery Act 2010 and the Prevention of Corruption Act, 1988 (India)), including dealings with government and private parties, as set out in the Anti-Bribery and Anti-Corruption Statement
• Competition and antitrust law: fair dealing, no price-fixing, bid-rigging or market allocation
• Export controls, customs and trade sanctions
• Data protection, privacy, cybersecurity and intellectual property, including the General Data Protection Regulation (EU) 2016/679 and UK GDPR with the Data Protection Act 2018, the California Consumer Privacy Act as amended by the CPRA and the Digital Personal Data Protection Act, 2023 (India), and privacy- and security-by-design requirements
• Responsible AI and algorithmic accountability
• Labor standards, equal opportunity, human rights, and workplace health and safety, as set out in the Human Rights Statement
• Finance and corporate governance
• Environmental and sustainability commitments, informed by the UN Sustainable Development Goals
• Applicable securities laws, including restrictions on trading on material non-public information

7.2 When the Law Is Unclear

If you are uncertain whether an action is lawful or ethical: pause and do not move forward; review the relevant policies, standards and contractual terms; and ask for help from your manager or department leader, Legal, Governance, Risk & Compliance, the Information Security Officer, the Data Protection Officer or Human Resources. If you are not comfortable raising a concern through your reporting line, use an alternative channel under section 8.

8. Speaking Up

We maintain a culture where everyone is empowered to speak up. TestMu prohibits retaliation of any kind against any person who, in good faith, raises a concern, reports a suspected breach or assists an investigation, whether or not the concern is substantiated. Retaliation is itself a breach of this Code and is subject to disciplinary action following investigation. Knowingly making a false report is also a breach. Reporting, protection from retaliation and investigation are governed by the Whistleblower Policy. Oversight of this Code sits with the Information Security & Compliance Steering Committee (ISCSC).

Concerns about this Code may be raised with a line manager or through any of the following channels:

Reports to the ethics and whistleblower channel are received by Human Resources, which may engage Legal, Governance, Risk & Compliance or external advisers. Reports are acknowledged normally within five business days where contact details are provided, assessed for severity and conflict of interest, investigated independently of the business area concerned, and closed with a recorded outcome and tracked corrective action. Serious matters and matters involving senior leadership are investigated independently of management and overseen by the ISCSC. Nothing in this document prevents any person from reporting a concern to a government, regulatory or law-enforcement authority, and no confidentiality obligation owed to the Company restricts such a report.

Compliance is everyone's responsibility. When in doubt: stop, ask, verify, and choose the ethical path.

9. Consequences of Violation

A breach of this Code by an employee is subject to disciplinary action following investigation, up to and including termination of employment. A breach by a contractor, supplier, reseller or other third party may lead to suspension or termination of the contract or relationship. Conduct that may constitute a criminal offense is referred to the competent authorities where the law requires.

10. Waivers

Any waiver of this Code for a director or officer requires the approval of the ISCSC and is recorded. Any waiver for another person requires the approval of Legal and Human Resources. Waivers are granted only in exceptional circumstances and are reviewed by the ISCSC.

11. Review

This Code is reviewed at least annually and whenever there is a material change in law, corporate structure, business model or risk profile. It is reviewed by the ISCSC and approved by the Chief Executive Officer on behalf of Executive Leadership.