Information Security Policy

The purpose of this ISP is to establish security requirements for Servstead systems, personnel, and third-party services that store or process customer, business, or financial data.

This document supports regulatory diligence, vendor security reviews (including Plaid), and consistent security practices across the organization.

This policy applies to:

• The Servstead web application and APIs hosted on production infrastructure.

• All databases, object storage, and integration credentials used to operate the Service.

• Personnel and contractors with access to production systems, source code, or customer data.

• Third-party subprocessors engaged to deliver the Service.

This policy does not govern end-customer devices or networks outside Servstead's control.

Information Security Lead: accountable for this policy, security questionnaires, incident response coordination, and annual review.

Engineering: implements secure development practices, access controls, dependency updates, and remediation of identified vulnerabilities.

All personnel: safeguard credentials, use MFA on administrative accounts, report suspected incidents promptly, and follow least-privilege access.

Public: marketing content and published legal documents.

Internal: operational metrics, non-customer configuration, and internal documentation.

Confidential: account credentials, business records, customer personal data, payment metadata, and integration tokens.

Restricted: Plaid access tokens, financial transaction data synced from connected bank accounts, and production database contents.

Restricted and Confidential data must never be stored in client-side code, public repositories, or unencrypted local files.

Unique accounts: every person with production access must use an individual account. Shared credentials are prohibited.

Least privilege: production access is granted only to personnel who require it for their role and is revoked upon role change or offboarding.

Tenant isolation: each Servstead business customer's data is isolated using PostgreSQL row-level security policies enforced at the database layer.

Application roles: in-product permissions separate owner, manager, and field crew capabilities.

Administrative consoles: access to hosting (Vercel), database (Supabase), payments (Stripe), email, and Plaid dashboards requires multi-factor authentication.

Integration secrets: Plaid access tokens and other third-party credentials are stored server-side only and are never returned to browsers or mobile clients.

End users must authenticate before accessing Servstead or optional bank connectivity features.

Supported authentication methods include email and password, and email one-time passcode verification.

Plaid Link is presented only when all of the following are true: (a) the user has an active authenticated session; (b) the account is a paid subscriber (not in free trial); (c) the user has provided explicit in-product consent to connect their bank.

Session management is handled by our authentication provider with industry-standard token handling.

Data in transit: all client connections to Servstead use TLS 1.2 or higher.

Data at rest: production databases and object storage use encryption at rest provided by our cloud infrastructure vendors.

Financial data: transaction data received from the Plaid API and associated access tokens are stored only in encrypted production databases within access-controlled environments.

Servstead production workloads run on managed cloud infrastructure (Vercel for application hosting; Supabase for database, authentication, and storage).

Production environments are separated from local development. Production secrets are stored in environment variables on the hosting platform and are not committed to source control.

Database access from application servers uses authenticated connections over TLS. Direct public database access is disabled.

Source code is maintained in private version control with branch-based review for material changes.

Application dependencies are updated regularly; critical security advisories are prioritized for remediation.

Secrets and API keys are injected via environment configuration, not hard-coded.

Changes affecting authentication, billing, or financial integrations undergo additional review before production deployment.

We monitor application dependencies and framework releases for known vulnerabilities.

Underlying infrastructure patching is performed by our cloud providers (Vercel, Supabase).

Security reports from customers or researchers should be sent to servstead@gmail.com. We investigate good-faith reports and work to remediate confirmed issues.

Formal automated endpoint vulnerability scanning for employee devices will be implemented as team size warrants; until then, personnel are required to keep operating systems and browsers current.

We engage subprocessors only as needed to operate the Service. Current major subprocessors: Supabase (Database, authentication, file storage, and row-level security; United States); Vercel (Application hosting, TLS termination, and edge delivery; United States); Stripe (Subscription billing and customer payment processing; United States); Plaid (Optional read-only bank transaction sync when a business owner connects their account; United States); Resend (Transactional email delivery; United States); OpenAI (Optional AI-assisted estimates when you use AI features; United States).

Financial account connectivity uses Plaid in read-only Transactions mode for optional business expense sync initiated by the account owner.

Vendors that process personal or financial data are evaluated for security practices before production use.

Our Privacy Policy is published at https://servstead.com/policies/privacy.

Users accept Terms of Service and Privacy Policy during account registration.

Plaid bank connection requires a separate explicit consent step before Plaid Link is displayed. Consent timestamp is recorded with the connection.

Servstead's use of information received from Plaid APIs adheres to the Plaid End User Privacy Policy.

Servstead retains account and business data while your subscription is active. After cancellation, Customer Content is deleted or anonymized within ninety (90) days, except where law requires longer retention. Encrypted backups may retain residual copies for up to thirty (30) additional days before purge. Bank connection tokens and synced transaction data are deleted when you disconnect Plaid or close your account. This policy is reviewed at least annually.

Upon disconnection of Plaid or account closure, access tokens and synced transaction data are deleted according to the retention schedule above.

Suspected security incidents must be reported immediately to servstead@gmail.com.

The Information Security Lead will: (1) confirm and classify the incident; (2) contain impact (e.g., revoke credentials, disable affected integrations); (3) investigate root cause; (4) remediate; (5) notify affected customers without undue delay where required by law.

Incident records are maintained for post-incident review and policy improvement.

Production data is backed up by our database provider for disaster recovery.

Critical service dependencies (hosting, database, payments) are operated by vendors with published availability commitments.

Customers may export business records through in-product tools to maintain independent backups.

Personnel who violate this policy may lose system access and face contractual consequences.

Customers who misuse the Service are subject to suspension under our Acceptable Use Policy.

This ISP is reviewed at least annually, and after any material change to architecture, subprocessors, or data handling practices.

Material updates are published at https://servstead.com/policies/security with an updated effective date and version number.

Privacy Policy: https://servstead.com/policies/privacy

Data Processing & Security: https://servstead.com/policies/data-processing

Terms of Service: https://servstead.com/terms

Acceptable Use Policy: https://servstead.com/policies/acceptable-use

All policies: https://servstead.com/policies

Information security and diligence requests: servstead@gmail.com

Privacy and legal: servstead@gmail.com