Information Security Policy

Purpose

In The BLK LLC maintains an information security program designed to protect the confidentiality, integrity, and availability of information used to provide the InTheBlk application and related services. This policy establishes the minimum controls and procedures used to identify, assess, mitigate, monitor, and respond to information security risks relevant to the business.

Scope

This policy applies to In The BLK LLC systems, applications, cloud services, source code repositories, administrative consoles, production infrastructure, financial-data integrations, authorized personnel and contractors, and information processed in connection with InTheBlk.

Covered information includes consumer account information, authentication data, user-provided financial information, permissioned financial account data received through Plaid, application records, operational logs, and security records.

Security Governance and Risk Management

• Security responsibilities are assigned to authorized company personnel according to role and business need.
• Security risks are evaluated when material new systems, providers, integrations, data types, or architecture changes are introduced.
• Material security findings are tracked until remediated, accepted, or otherwise resolved.
• Security policies and procedures are reviewed at least annually and after material changes to systems, data practices, legal obligations, contractual obligations, or security risk.

Identity, Authentication, and Access Control

• Consumer identity is authenticated using Firebase Authentication.
• Multi-factor authentication is required where defined by application security controls, including before Plaid account-linking functionality is made available.
• Privileged administrative access uses multi-factor authentication where supported.
• Production systems and sensitive data are protected by least-privilege access controls.
• Backend authorization is based on verified identity tokens rather than client-supplied user identifiers.
• Shared administrative credentials are prohibited where individual accounts are available.
• Access is removed or modified when it is no longer required.

Financial Data and Plaid

InTheBlk uses Plaid to allow users to connect financial institutions with their authorization.

• InTheBlk does not collect or store online-banking usernames or passwords.
• Short-lived Plaid Link tokens are used for account-linking sessions.
• Plaid public tokens are exchanged for access tokens only by the backend.
• Plaid access tokens are not exposed to the mobile or web client.
• Stored provider access tokens are encrypted using AES-256-GCM.
• Plaid-derived data is used only for user-requested product functionality, service operation, support, and security purposes.
• In The BLK LLC does not sell raw Plaid-derived consumer financial data.

Encryption and Secret Management

• Sensitive data is protected in transit using HTTPS/TLS.
• Production secrets and encryption material are maintained outside distributed application code using approved secret-management services.
• Encryption keys are separated from encrypted application data and are made available only to authorized backend services.
• Secrets must not be hard-coded into distributed applications, committed to source control, or written to application logs.

Application and Database Security

• Protected financial-data requests require authenticated user identity.
• Financial records are scoped to the authenticated user.
• Backend-controlled financial collections are not directly writable by clients.
• Sensitive synchronization and deletion operations are performed by authorized backend services.
• Unauthorized requests receive safe error responses that do not expose secrets or sensitive system details.

Secure Development and Change Management

Application changes are managed through controlled source repositories and release processes. Security-sensitive changes receive appropriate validation before deployment.

• Automated tests and authorization checks are used where applicable.
• Firestore security rules and backend security controls are validated as part of release work.
• Release smoke testing is performed as appropriate to the change.
• Secrets and consumer financial data are excluded from source-control evidence and test artifacts.

Vulnerability and Patch Management

In The BLK LLC monitors material dependencies, platforms, and managed providers for security issues and applies security updates based on risk and operational impact. Known critical security issues, exposed credentials, and material access-control defects are prioritized for remediation.

Logging, Monitoring, and Alerting

Security-relevant backend and application events are recorded using structured, redacted logging. Monitoring and alerting are configured for defined abnormal conditions so authorized personnel can investigate.

Logs are designed not to contain Plaid access tokens, authorization headers, bank credentials, full account or routing numbers, or unnecessary consumer financial payloads.

• Unauthorized and repeated authentication or authorization failures.
• Rate-limit events and unusual request volume.
• Plaid connection, token-exchange, or synchronization failures.
• Financial-data deletion failures.
• Unexpected backend errors and material Cloud Run service-health degradation.

Rate Limiting and Abuse Protection

Sensitive and high-cost backend operations are protected by distributed rate limiting so limits are consistently enforced across backend instances. Rate-limit events are logged and monitored.

Data Retention and Deletion

Consumer and financial data is retained only as long as reasonably necessary for user-requested functionality, service operation, security, legal obligations, dispute resolution, or other legitimate business purposes.

Detailed retention and deletion requirements are governed by the In The BLK LLC Data Retention and Deletion Policy.

• Users may disconnect linked financial institutions.
• Users may delete imported financial information.
• Users may delete their InTheBlk account.
• Users may submit privacy requests through published data-rights mechanisms.

Incident Response

• Identify and assess suspected or confirmed security events.
• Contain affected systems, credentials, or provider access.
• Eradicate the cause and remediate affected controls.
• Recover and validate affected services.
• Preserve relevant evidence.
• Notify affected parties, providers, or authorities when required.
• Perform post-incident review for material incidents.

Third-Party Services

Third-party services that process sensitive information are used only when needed for approved business functionality. Access and data sharing are limited to the minimum reasonably necessary for the service. Material providers may include financial-data, authentication, cloud-hosting, source-control, support, and application-distribution services.

Business Continuity and Recovery

Source control, managed cloud infrastructure, deployment configuration, and provider recovery capabilities are used to support service recovery. Material service disruptions are investigated and recovery is validated before normal operation resumes.

Enforcement, Exceptions, and Review

Exceptions to this policy must be documented and approved by In The BLK LLC. Exceptions should be time-limited where practical and use compensating controls when appropriate.

This policy is reviewed at least annually and after material changes to technology, data practices, contractual obligations, or security risk.

This policy is adopted by In The BLK LLC.