Control Total ("the Company", "we", "us") is a personal finance management application that helps users track income and expenses, visualize their financial health, and optimize their money management. This Information Security Policy establishes the framework for protecting all information assets, including user financial data obtained through Plaid and other integrations.
2. Scope
This policy applies to all employees, contractors, vendors, and third-party service providers who have access to the Company's systems, applications, databases, or user information. It covers all data processed, stored, or transmitted by the Company, including financial data accessed via Plaid's API.
3. Data Classification
The Company classifies data into three categories:
Confidential: User financial data, bank credentials tokens, Plaid access tokens, personally identifiable information (PII), and authentication data.
Internal: Business operations data, aggregate analytics, and non-public configuration.
Public: Marketing content, public documentation, and published policies.
4. Plaid Data Handling
The Company adheres to Plaid's security requirements and best practices:
No credential storage: Bank usernames and passwords are never stored. The Company only retains Plaid access tokens, which are encrypted at rest.
Token security: Plaid access tokens are stored encrypted using industry-standard encryption (AES-256) and are never exposed to the client-side application or logged in plaintext.
Least privilege: Plaid API credentials (client ID and secret) are stored as environment secrets and accessible only to backend services that require them.
Data minimization: The Company requests only the Plaid products necessary for the service: Transactions, Liabilities, Balance, and Identity.
User consent: Users explicitly consent to connecting their bank accounts via Plaid Link before any data is accessed. Users can disconnect any bank at any time, which invalidates the associated access token.
5. Access Control
Authentication: All systems require multi-factor authentication (MFA) for administrative access.
Role-based access: Access to user data is granted on a need-to-know basis and reviewed quarterly.
Provisioning: Employee access is provisioned upon hire and revoked immediately upon termination.
Audit logging: All access to production systems and sensitive data is logged and retained for a minimum of 12 months.
6. Encryption
In transit: All data is encrypted using TLS 1.2+ (HTTPS) for all network communications.
At rest: Databases and storage volumes use AES-256 encryption.
Secrets management: API keys, tokens, and secrets are stored in a managed secrets vault and never hard-coded in source code.
7. Infrastructure Security
Cloud hosting: The application is hosted on reputable cloud providers with SOC 2 Type II and ISO 27001 certifications.
Network security: Production environments are isolated in private networks with strict firewall rules.
Patching: Security patches are applied within 30 days of release; critical patches within 72 hours.
Backups: Data is backed up daily with encrypted snapshots and tested restoration procedures.
8. Application Security
Secure development: The Company follows OWASP Top 10 guidelines and conducts code reviews before deployment.
Vulnerability scanning: Automated dependency scanning and static analysis run on every code change.
Input validation: All user input is validated and sanitized to prevent injection attacks.
Session management: Sessions use secure, httpOnly cookies with short expiration and refresh token rotation.
9. Incident Response
The Company maintains an incident response plan that includes:
Detection: Monitoring and alerting on all production systems for anomalous activity.
Containment: Immediate isolation of affected systems upon detection of a security incident.
Notification: Affected users and relevant parties (including Plaid) are notified within 72 hours of confirmed data breaches.
Post-incident review: Root cause analysis and corrective actions documented after every incident.
10. User Data Rights
Data access: Users can view their data within the app at any time.
Data deletion: Users can delete their account and all associated data permanently from the Profile page.
Bank disconnection: Users can disconnect any connected bank at any time, revoking Plaid access.
Transparency: The Privacy Policy clearly explains what data is collected and how it is used.
11. Employee Training
All employees and contractors receive security awareness training upon onboarding and annually thereafter. Training covers phishing, data handling, password security, and incident reporting procedures.
12. Compliance
The Company complies with applicable data protection regulations including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and the Gramm-Leach-Bliley Act (GLBA) where applicable. The Company undergoes annual security assessments to maintain compliance.
13. Policy Review
This Information Security Policy is reviewed and updated at least annually, or upon significant changes to the Company's infrastructure, products, or regulatory requirements.
14. Contact
For security-related questions or to report a vulnerability, contact: security@controltotal.app