Information Security Policy

This policy describes how we identify, mitigate, and monitor information security risks for our application, Finance Crystal Ball, a personal budgeting and cash-flow forecasting tool that connects to consumer financial data through Plaid on a read-only basis. It is operationalized through the specific controls below. This document supersedes and consolidates our prior separate Information Security and Multi-Factor Authentication policies.

1. Scope and roles

This policy covers the application, its hosted service, and the infrastructure that accesses or stores consumer financial data obtained via the Plaid API. Matthew Montney is the single administrator and is responsible for information security, privacy, and incident response, and reviews this policy at least annually and after any material change.

2. Data minimization and read-only access

The application is strictly read-only with respect to financial accounts. When a user chooses to connect a bank, we request only the minimum data needed to provide the service: account balances (to show current cash on hand) and transactions (to summarize recent spending). We cannot move money, initiate payments, or make any change to a user's accounts. We never receive or store bank login credentials; those are entered by the user directly with their institution through Plaid Link.

3. Access control (least privilege)

• Production servers are administered over SSH with key-based authentication only; password authentication and root password login are disabled.
• A host firewall permits only the ports required for the service (SSH, HTTP, HTTPS); all other ports are closed to the public.
• Administrative access is limited to the single owner on a need-to-use basis. Credentials and API secrets are never shared and are never committed to source control.
• Each end user can access only their own data. Accounts are isolated server-side: a signed-in user is only ever served their own budget, business data, and linked-bank information, enforced on every request.

4. Authentication and multi-factor authentication (MFA)

• User accounts authenticate with an email and password (passwords are hashed with PBKDF2-HMAC-SHA256 using a per-user salt; plaintext passwords are never stored) or with Google Sign-In (OAuth 2.0).
• Optional two-factor authentication (TOTP) is available to every user and, once enabled, is required at every sign-in in addition to the password. It is compatible with standard authenticator apps (Google Authenticator, Microsoft Authenticator, Authy).
• Users who sign in with Google are additionally protected by any multi-factor authentication enabled on their Google account.
• Administrative access to servers uses SSH key-based authentication; third-party service accounts (hosting, DNS, source control) use MFA where the provider offers it.

5. Encryption

• In transit: all connections to the Plaid API and to our web service use TLS 1.2 or better (HTTPS), with certificates automatically provisioned and renewed.
• At rest (local application): Plaid access tokens and API secrets are encrypted using operating-system protected storage (Windows DPAPI), bound to the host account.
• At rest (hosted service): the database and configuration files are stored on an access-controlled host with file permissions restricted to the service account (owner-only, mode 0600); the host is not publicly reachable except through the TLS web endpoint. Secrets are never returned by our APIs in plain text.

6. Secure development and secrets management

• API keys, client secrets, and tokens are stored in server environment files readable only by the service account, or in OS-protected storage locally; they are never committed to source control.
• Session tokens are HMAC-signed and expiring; they cannot be forged or replayed after expiry.
• The application validates and scopes every request to the authenticated user before returning any data.

7. Vulnerability and patch management

• Servers run a supported, current OS (Ubuntu 24.04 LTS) with automatic unattended security updates enabled.
• Administrator endpoint machines run OS-level endpoint protection (antivirus) with automatic updates.
• Dependencies are kept current and reviewed when security advisories are issued.

8. Monitoring and logging

Web and system access is logged. Authentication failures and administrative actions are observable through server logs, which are reviewed when investigating any suspected issue.

9. Consumer consent and privacy

Consumers grant consent for data access through Plaid Link at the time they connect an account. We do not sell, rent, or share financial data, and do not use it for advertising. Our data-handling and disposal practices are detailed in our Data Retention and Disposal Policy.

10. Incident response

Suspected security incidents are investigated promptly. Affected credentials are rotated and impacted connections revoked. Material incidents affecting consumer data are handled in accordance with applicable law and Plaid's requirements, including timely notification where required.

11. Review

This policy and its controls are reviewed at least annually and updated as practices change. Questions: mattmontneyjr@gmail.com.