Information Security Policy

Budgetfold · Version 1.0 · Effective September 22, 2026 · Reviewed at least annually

This policy describes how Budgetfold (operated by Dean Gergoric, doing business as Pomalo) protects the information users entrust to it, including financial data obtained through Plaid. It applies to everyone who develops or operates the service. Today that is a single person, who acts as the security owner.

1. Ownership and governance

• Security owner: Dean Gergoric, Founder and Developer, dgergoric2@gmail.com. This mailbox is monitored daily.
• The security owner reviews this policy, access rights, and dependencies at least once a year and after any significant change to the service.
• Risks are tracked in the project repository as issues with an owner and a target date.

2. Data classification

• Restricted: Plaid access tokens, API secrets, signing keys. Stored only in Google Secret Manager or server-side Firestore collections that clients cannot read.
• Confidential: user email, name, budget entries, imported transaction data (date, amount, merchant, category, account name and last four digits). Never shared with third parties other than our infrastructure provider.
• Not collected: bank credentials, full account or routing numbers, balances, government identifiers, precise location.

3. Access control

Detailed in the Access Control Policy.

• Production access (Firebase, Google Cloud, Plaid, App Store Connect) is limited to the security owner, protected by unique credentials and two-factor authentication.
• End users authenticate through Firebase Authentication (Sign in with Apple, Google, or email and password). Firestore security rules enforce that a user can read and write only budgets they are a member of; Plaid tokens and entitlements are not readable by any client.
• Access is reviewed annually and revoked immediately when no longer needed.

4. Secrets management

• API keys and Plaid secrets live in Google Secret Manager and are injected into Cloud Functions at runtime. They are never committed to source control, embedded in the mobile app, or sent to clients.
• Secrets are rotated on suspicion of exposure and at least annually.

5. Encryption

• In transit: TLS 1.2 or higher for all connections between the app, our backend, Firebase, and Plaid.
• At rest: Google Cloud encrypts Firestore and Secret Manager data by default with AES-256.

6. Secure development

• All code is version-controlled in a private Git repository. Changes are reviewed and tested before release; App Store releases pass Apple's review.
• Dependencies (Firebase SDKs, Plaid SDKs, Node packages) are kept current and checked for known vulnerabilities before each release.
• Server-side validation is applied to every Plaid-related request: authentication, budget membership, and subscription entitlement are checked before any token is issued.

6a. Vulnerability management

• Dependencies are scanned continuously with GitHub Dependabot (npm for the backend, Swift packages for the app), and npm audit runs before every backend deploy.
• Patch SLA from identification: critical within 7 days, high within 14 days, medium within 30 days, low in the next scheduled release.
• Production runs only on fully managed Google Cloud services, which Google patches; there are no self-managed servers. The development machine runs macOS with automatic security updates and full-disk encryption.
• End-of-life software: runtimes and SDKs are reviewed at least quarterly against vendor support dates and upgraded before end of life.

7. Logging and monitoring

• Cloud Functions logs and Firebase monitoring are retained by Google Cloud (30 days by default) and reviewed when errors or alerts occur. Logs never contain access tokens or secrets.
• Billing and usage alerts are configured on the Google Cloud project.

8. Data retention and deletion

Detailed in the Data Retention and Disposal Policy.

• Users may unlink a bank at any time; we call Plaid's item removal endpoint and delete the access token immediately.
• Users may delete their account in the app; all their data, including imported transactions, is deleted at that time.
• Plaid-derived data for unlinked accounts is deleted within 30 days.

9. Incident response

• Suspected incidents are reported to dgergoric2@gmail.com and triaged within 24 hours.
• Response steps: contain (rotate secrets, revoke access), assess scope, remediate, and document.
• Affected users and Plaid are notified within 72 hours of confirming an incident involving their data, and sooner where the law requires.

10. Business continuity

• Firestore data is stored redundantly by Google Cloud with point-in-time recovery enabled; source code is backed up in a hosted Git repository.
• Infrastructure is fully managed (Firebase, Cloud Functions), so there are no servers to patch or physical facilities to secure.

11. Third parties

• Sub-processors: Google LLC (Firebase, Google Cloud) and Plaid Inc. Both maintain SOC 2 Type II and ISO 27001 certifications. No other party receives user data.