← Back to Hatch Labs

Document Version: 1.0
Effective Date: March 6, 2026 | Next Review: March 6, 2027

1. Access Control and Identity Management

1.1 User Access Management

• Principle of Least Privilege: Users are granted minimum access necessary to perform their job functions
• Role-Based Access Control (RBAC): Access permissions are assigned based on predefined roles and responsibilities
• Regular Access Reviews: User access is reviewed quarterly and adjusted based on role changes or termination

1.2 Account Management

• Unique user accounts for each individual
• Strong password requirements (minimum 12 characters, complexity requirements)
• Account lockout policies after failed login attempts
• Immediate account deactivation upon termination or role change
• Shared accounts are prohibited

2. Data Classification and Handling

2.1 Data Classification Levels

• PUBLIC: Information intended for public disclosure (marketing materials, public website content)
• INTERNAL: Information for internal business use (internal policies, business plans)
• CONFIDENTIAL: Sensitive business information requiring protection (user data, financial information)
• RESTRICTED: Highly sensitive information requiring the highest level of protection (authentication credentials, encryption keys, sensitive personal data, financial account data)

3. Encryption Standards

3.1 Data Encryption at Rest

• Primary Database: AES-256 encryption via Supabase hosted PostgreSQL
• Minimum Standard: AES-256 encryption for all databases containing personal or financial data
• Key Management: Encryption keys managed by Supabase with industry-standard key rotation
• Scope: All user data, financial data from Plaid, identity verification data, and business-critical information

3.2 Data Encryption in Transit

• Minimum Standard: TLS 1.2 or higher for all data in transit
• Implementation: TLS 1.3 where supported, with perfect forward secrecy
• API Communications: All API calls to third-party services (Plaid, Supabase) use TLS 1.2+
• Web Application: HTTPS enforced with HSTS headers
• Certificate Management: Automated certificate renewal via Cloudflare

4. Incident Response Procedures

4.1 Incident Response Team

• Incident Commander: CEO (Amanda Bradford)
• Technical Lead: Development team lead (currently CEO)
• External Resources: Cybersecurity consultant (as needed)
• Legal Counsel: External legal counsel (as needed)

4.2 Response Procedures

1. Detection and Analysis (0-1 hour): Identify and verify the incident, assess scope and potential impact
2. Containment (1-4 hours): Immediate containment of the incident, prevent further damage
3. Eradication and Recovery (4-24 hours): Remove threat and vulnerabilities, restore systems
4. Post-Incident Activities (24-72 hours): Lessons learned review, update policies, prepare incident report

5. Vulnerability Management

5.1 Vulnerability Assessment

• Automated dependency scanning via GitHub Dependabot
• Regular security assessments of critical systems
• Third-party security testing annually or after major changes
• Continuous monitoring for new vulnerabilities

5.2 Patch Management

• Critical security patches applied within 72 hours
• High-priority patches applied within 7 days
• Regular patches applied within 30 days
• Emergency patching procedures for zero-day vulnerabilities

6. Third-Party Vendor Management

6.1 Vendor Requirements

• SOC 2 Type II compliance preferred for critical vendors
• Contractual security requirements and liability provisions
• Regular security assessments and compliance verification
• Incident notification requirements
• Data processing agreements (DPA) where applicable

7. Business Continuity and Disaster Recovery

7.1 Backup and Recovery

• Database Backups: Automated daily backups via Supabase with point-in-time recovery
• Application Code: Version control and automated deployment pipelines
• Configuration Data: Infrastructure as code with version control
• Recovery Testing: Quarterly backup restoration testing

7.2 Business Impact Analysis

• Critical business functions identified and prioritized
• Recovery time objectives (RTO) and recovery point objectives (RPO) defined
• Dependencies on third-party services documented
• Alternative processing capabilities identified

8. Compliance and Legal Requirements

8.1 Regulatory Compliance

• SOC 2 Type II: Alignment with SOC 2 principles for service organizations
• California Consumer Privacy Act (CCPA): Privacy rights for California residents
• State Privacy Laws: Compliance with applicable state privacy regulations
• Financial Data Protection: Compliance with financial data protection requirements

8.2 Audit and Assessment

• Annual security assessment by qualified third party
• Internal security reviews quarterly
• Compliance audits as required by regulations
• Documentation retention for audit purposes

9. Employee Security Requirements

9.1 Security Awareness Training

• Annual security awareness training for all personnel
• Specialized training for developers and administrators
• Phishing awareness and testing program
• Security policy acknowledgment required

9.2 Acceptable Use

• Approved use of company systems and data
• Prohibition of unauthorized software installation
• Personal use limitations and guidelines
• Social media and public communication guidelines

10. Policy Governance

10.1 Policy Review and Updates

• Annual Review: Complete policy review and update cycle
• Triggered Reviews: Updates based on incidents, technology changes, or regulatory changes
• Approval Process: CEO approval required for all policy changes
• Communication: Policy changes communicated to all affected personnel