Information Security Policy

1. Risk identification and review

The owner maintains a written inventory of systems that hold sensitive data, the categories of data in each, and the third parties that process data on our behalf. That inventory is reviewed at least annually and whenever a new integration is added. Adding any integration that reads financial or client data requires a documented decision on what data it needs, the minimum permissions to achieve it, and where its credentials will be stored.

Current sensitive systems: Cloudflare (application hosting, D1 databases, KV storage, secrets), Google Workspace (identity, mail, documents), Plaid (bank connectivity), Stripe (payment processing), Slack (internal messaging), Anthropic API (receipt and report text processing), Meta and Google advertising platforms (client campaign data).

2. Access control

• Single sign-on. Internal applications authenticate through Google Workspace, restricted to the go-mobius-digital.com domain. Accounts outside the domain cannot sign in unless explicitly invited.
• Multi-factor authentication is enforced on Google Workspace accounts and enabled on the Cloudflare, Stripe, and Plaid administrative accounts.
• Named individual accounts. Credentials are not shared between people. Each person signs in as themselves.
• Least privilege. API credentials are issued with the narrowest scope that satisfies the use case, and read-only wherever a write is not required. The Stripe key used by Mobius Ledger is a restricted read-only key; the Plaid integration requests the Transactions product only.
• Secrets handling. API keys and access tokens live in Cloudflare Workers Secrets, encrypted at rest and not readable back through the dashboard or the application. Secrets are never committed to source control; the repository ignores local environment files by rule, and local copies are cleared once a secret is deployed.
• Access review and revocation. Access is reviewed at least annually and revoked the same day a person's engagement ends. Any credential believed to be exposed is rotated immediately.

3. Encryption

• In transit: all traffic to and from our applications and every third-party API is encrypted with TLS 1.2 or better. Plain HTTP is not served.
• At rest: application data, including all data received from the Plaid API, is stored in Cloudflare D1 and Cloudflare KV, which encrypt data at rest. Receipt files are stored in the same encrypted store. Secrets are separately encrypted in Cloudflare Workers Secrets.
• Endpoints: company laptops use full-disk encryption.

4. Vulnerability and patch management

Production runs entirely on managed serverless infrastructure (Cloudflare Workers, D1, KV). We operate no servers, virtual machines, or containers, so operating-system and runtime patching for production is performed by the platform provider on a continuous basis. Our practices for the surface we do control:

• Automatic operating-system and browser updates are enabled on all company laptops.
• Endpoint protection with real-time scanning is enabled on all company laptops.
• Application dependencies are deliberately minimal; the internal tools are dependency-free vanilla JavaScript, which removes the majority of the third-party supply-chain surface. Where a build toolchain exists, dependency advisories are reviewed and patched when a vulnerability is reported.
• Application code is reviewed before deployment, with particular attention to authentication, authorization, and any endpoint reachable without credentials.
• Unauthenticated endpoints are cryptographically verified. The Slack events endpoint, for example, validates an HMAC signature with a replay window and a constant-time comparison, and fails closed if the signing secret is absent.

5. Data retention and deletion

We keep only what we need, for only as long as we need it. This schedule is reviewed annually alongside this policy.

Disconnecting a financial account stops collection immediately and removes the stored access token. Transactions already imported are retained for the period above because they form our own accounting records. Deletion requests relating to data we hold are handled by the owner and actioned within 30 days.

6. Third parties

Before a third party is given access to sensitive data we confirm it is an established provider with a published security posture and a data processing agreement, and we grant it the narrowest scope that meets the need. We do not sell, rent, license, or otherwise share company or client data with third parties for their own purposes.

7. Incident response

1. Contain. On suspicion of a compromise, revoke or rotate the affected credentials and disable the affected integration immediately.
2. Assess. Determine what data was reachable, over what period, and by whom, using platform audit logs.
3. Notify. Inform affected parties, and any provider whose data or credentials were involved — including Plaid, where its data or credentials are implicated — without undue delay and within any period their agreements require. Regulators and clients are notified where the applicable law or contract requires it.
4. Remediate and record. Fix the root cause, write down what happened and what changed, and revisit this policy if the incident exposes a gap.

Suspected incidents are reported to cole@go-mobius-digital.com.

8. Review

This policy is reviewed at least annually by the owner, and whenever a significant new system or integration is introduced. The version and effective date at the top of this page record the current revision.