Information Security Policy

How BuddyWorkflow protects the confidentiality, integrity, and availability of customer and company information — including financial data accessed through Plaid.

1. Purpose & Scope

This Information Security Policy defines the controls BuddyWorkflow uses to protect customer and company data. BuddyWorkflow is a cloud bookkeeping application that helps small businesses track income, expenses, and cash flow, and — with the customer's consent — connects their financial accounts through Plaid to import transactions.

This policy applies to all personnel, contractors, systems, and third-party services that store, process, or transmit BuddyWorkflow customer or company data, across development and production environments. Adherence is a condition of access to company systems.

2. Roles & Responsibilities

The Founder & Security Lead owns this policy and is accountable for security decisions, subprocessor reviews, access approvals, and incident response. All personnel and contractors are responsible for following this policy, protecting credentials, and reporting suspected security incidents promptly to bryn@buddyworkflow.com.

3. Access Control & Authentication

Access is granted on a least-privilege, need-to-know basis, using unique individual accounts — shared logins are prohibited.

• Application authentication: end users authenticate with email and password through Supabase Auth. Passwords are stored only as salted hashes by the identity provider; BuddyWorkflow never sees plaintext passwords. Users can add an optional authenticator-app second factor (see our MFA policy), which is then required at every sign-in.
• Data isolation: every read and write to customer books is enforced by Postgres row-level security (RLS). Users can only access workspaces they are a member of, at their assigned role — owner (billing + member management), editor (read/write), or viewer (read-only).
• Administrative access: access to production systems (Supabase, hosting/CDN, Stripe, Plaid, GitHub, Google Workspace) is limited to authorized administrators and protected by multi-factor authentication (MFA). The Supabase service-role key is used only in trusted server-side routes and is never exposed to the client.
• Review & revocation: administrative access is reviewed periodically and revoked promptly on role change or departure. Workspace membership is revocable by the workspace owner at any time.

4. Data Protection & Encryption

• In transit: all traffic is served over HTTPS using TLS 1.2 or higher; HTTP is redirected to HTTPS and there are no plaintext transport paths.
• At rest: customer data is stored in Supabase (managed PostgreSQL) and encrypted at rest with AES-256 by the provider.
• Secrets: API keys, database credentials, and Plaid/Stripe secrets are held in encrypted environment configuration / secret stores and are never committed to source control.
• Data minimization: BuddyWorkflow collects only the data required to operate the service.

5. Financial Data & Plaid

BuddyWorkflow uses Plaid to connect customer financial accounts. Bank login credentials are never received, seen, or stored by BuddyWorkflow — credential exchange occurs entirely within Plaid Link. BuddyWorkflow stores only the resulting Plaid access tokens, held server-side in encrypted configuration and used exclusively by trusted server routes to retrieve transaction data on the customer's behalf. Imported financial data is stored under the same RLS and encryption controls as all other customer data. Customers may disconnect a linked account at any time.

6. Vendor & Subprocessor Management

Core infrastructure relies on reputable, independently audited (e.g., SOC 2) subprocessors. Each vendor's security posture is reviewed before onboarding and periodically thereafter.

7. Secure Development & Change Management

• All code is version-controlled in GitHub; changes are reviewed before deployment to production.
• Development and production environments are logically separated, with independent credentials and configuration.
• Server-side inputs — including membership role and status — are validated server-side before writes; the client never holds privileged keys.

8. Vulnerability & Patch Management

• Application dependencies are continuously monitored for known vulnerabilities (GitHub Dependabot) and updated promptly.
• Production runs on managed platforms (Supabase, hosting/CDN) that are continuously patched by the provider.
• Developer devices use full-disk encryption, endpoint protection, and automatic OS and software updates.

9. Logging & Monitoring

Authentication events, database activity, and billing webhooks are logged through the underlying managed platforms (Supabase and Stripe). Logs are reviewed when investigating suspected incidents and to support recovery.

10. Incident Response

BuddyWorkflow maintains a process to detect, contain, investigate, and remediate security incidents. The Security Lead owns incident handling. Affected customers and any required parties are notified in line with applicable legal and contractual timelines, including notification to Plaid where an incident involves data accessed through Plaid. A post-incident review captures root cause and corrective actions.

11. Business Continuity & Backups

Customer data is backed up automatically by the managed database provider, with tested restore procedures. The service runs on redundant cloud infrastructure to support availability and recovery in the event of disruption.

12. Privacy & Consent

Customers accept the Terms of Service and Privacy Policy at sign-up and explicitly authorize account connection through Plaid Link's consent flow before any financial data is retrieved. The Privacy Policy discloses what data is collected, how Plaid is used, how data is stored and protected, and how customers can request deletion. Customers may disconnect accounts and request deletion of their data at any time.

13. Personnel Security & Awareness

Everyone with data access is bound by confidentiality obligations and follows core security hygiene — phishing awareness, strong unique passwords stored in a password manager, and MFA on all administrative accounts. Security responsibilities are understood before access is granted.

14. Data Retention & Deletion

Customer financial data is retained only for as long as the account is active and the data is needed to provide the service. Customers may disconnect linked accounts at any time, which stops further data retrieval through Plaid. On account closure or a verified deletion request, the customer's financial data — including balances, transactions, and Plaid access tokens — is deleted from production systems within 30 days, and purged from encrypted backups on the normal backup expiry cycle. Plaid access tokens are revoked at Plaid upon disconnection or deletion. Full details are in our Data Retention & Disposal Policy.

15. Policy Review & Approval

This policy is reviewed at least annually and after any material change to systems, subprocessors, or data-handling practices. Exceptions require documented approval from the Security Lead.