Greenlane Holdings, Inc.

Cybersecurity Risk Management and Strategy

Greenlane is committed to ensuring the highest standards of cybersecurity to protect our systems, networks, and data from cyber threats. We recognize the critical importance of safeguarding sensitive information and maintaining the trust of our customers, partners, and stakeholders.

Our cybersecurity strategy is built on a foundation of proactive risk management, continuous monitoring, and adherence to industry best practices. We employ a multi-layered approach which leverages cutting-edge technologies to defend against evolving cyber threats.

We have made significant investments in modernizing, streamlining, and simplifying our technology footprint to both enhance customer experience and strengthen our internal security controls.

From time-to-time, we may engage third-party consultants, legal advisors, and audit firms to evaluate and test the Company’s risk management systems and assess and remediate certain potential cybersecurity incidents, as appropriate. We prioritize the integrity of our data access controls to prevent unauthorized access, data breaches, and malicious activities. We regularly assess and enhance our cybersecurity posture through comprehensive risk assessments, security audits, and vulnerability assessments.

Governance

Cybersecurity is a shared responsibility requiring collaboration and cooperation across all levels of our organization.

Greenlane recognizes that cybersecurity is not solely a technology issue but also a people and process issue. We invest in ongoing employee training and awareness programs to empower our staff to recognize and respond to potential security threats effectively.

Cybersecurity threats are monitored and acted upon by the Company’s information technology security group within the Information Technology team. The Vice President of Information Technology has over 25 years of IT experience including Fortune 100 public companies. The Vice President of Information Technology meets regularly with senior management to inform and advise them of the status on all cybersecurity initiatives as well as all cybersecurity incidents, if any.

In the event of a cybersecurity incident, we have established incident response plans and protocols to minimize the impact and facilitate swift recovery. The Company’s Audit Committee oversees cybersecurity risk. The Audit Committee is promptly notified by Information Technology leadership of any potentially serious incidents including details and recommendations on the detection, mitigation, and remediation of the same. During the calendar year 2024, there have been no known reported cybersecurity incidents that have materially affected our operations or financial results.

We believe in transparency and open communication, promptly informing affected parties and relevant authorities as required by law. Together, we remain vigilant, adaptive, and resilient in the face of evolving cyber threats, safeguarding the trust and confidence of those we serve.