Aphoenity International Holdings Inc.

Evaluation of Disclosure Controls and Procedures

As required by Rule 13a-15 under the Securities Exchange Act of 1934 (the “1934 Act”), as of March 31, 2025, we carried out an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures. Disclosure controls and procedures are controls and other procedures that are designed to ensure that information required to be disclosed in our reports filed or submitted under the Securities Exchange Act is recorded, processed, summarized and reported within the time periods specified in the Securities and Exchange Commission’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed in our reports filed under the Exchange Act is accumulated and communicated to our management, including our principal executive officer and our principal financial officer, as appropriate, to allow timely decisions regarding required disclosure. This evaluation was carried out under the supervision and with the participation of our Chief Executive Officer (our principal executive officer) and our Chief Financial Officer (our principal financial officer), who concluded, that (i) there continues to be material weaknesses in the Company’s internal controls over financial reporting, that the weaknesses constitute a “deficiency” and that this deficiency could result in misstatements of the foregoing accounts and disclosures that could result in a material misstatement to the financial statements for the period covered by this report that would not be detected, and (ii) accordingly, our disclosure controls and procedures were not effective as of March 31, 2025.

However, it should be noted that the design of any system of controls is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions, regardless of how remote.

Changes in Internal Control over Financial Reporting

There have been no changes in our internal control over financial reporting identified in connection with the evaluation required by paragraph (d) of Exchange Act Rules 13a-15 or 15d-15 that occurred during our fiscal quarter ended March 31, 2025, that have materially affected, or are reasonable likely to materially affect, our internal control over financial reporting.

Cybersecurity Risk Management and Strategy

While The Company has not yet formally adopted a comprehensive cybersecurity policy and process for assessing, identifying, and managing material risks from cybersecurity threats, the Company acknowledges the increasing threats posed by cyber-attacks, data breaches, ransomware, and other forms of malicious cyber activity. As a result, cybersecurity remains an area of focus, and the Company is taking steps to mitigate risks to its systems, data, and operations. The Company has not experienced any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

Cybersecurity Governance

Currently, the Company addresses cybersecurity through the following general practices:

Risk Awareness and Monitoring:

The Company is actively monitoring potential cybersecurity risks, including external cyber threats and internal vulnerabilities, using available resources and tools. We are committed to keeping abreast of emerging cybersecurity trends to better identify and assess risks to our systems.

Internal Practices:

The Company enforces basic security measures within the organization, such as password protocols, access controls, and employee awareness regarding secure data handling. Employees are encouraged to be vigilant about cybersecurity threats, including phishing and unauthorized access attempts.

Incident Response Preparedness:

Although a formalized response plan has not yet been adopted, the Company is aware of the importance of being prepared for potential cybersecurity incidents. The Company is taking steps to develop an incident response framework to ensure a timely and effective reaction in the event of a cyber breach.

Third-Party Risk Management:

The Company acknowledges the need to assess the cybersecurity practices of third-party vendors and service providers that have access to the Company’s systems or data. We are in the process of establishing better practices for evaluating the cybersecurity standards of these third parties.

Cybersecurity Incidents

As of the date of this filing, the Company has not experienced any material cybersecurity incidents, such as data breaches, cyber-attacks, or other disruptions to operations. However, the Company recognizes that cyber threats are ever-present and evolving, and we continue to monitor the situation carefully.

Cybersecurity Policy Development

The Company intends to adopt a formal Cybersecurity Policy in the near future. This policy will be designed to address the increasing cybersecurity risks and provide a structured approach for safeguarding Company data, protecting systems, and ensuring compliance with relevant regulations. the Company plans to implement best practices, invest in security technologies, and develop an internal framework for preventing and responding to potential cyber threats.