Information Security Policy

The Bailey Family Plan LLC
dba Signarama Temecula and Fully Promoted Temecula Valley
41785 Enterprise Cir, Ste B, Temecula, CA 92590

Effective date: October 12, 2026
Policy owner and security contact: Mark Bailey, Owner (mark.bailey@signarama.com)

1. Purpose and Scope

This policy explains how we protect company information and systems. It covers all employees and contractors, our internal web app Signmetry, and the services it relies on: Render (hosting), GitHub (source code), the Signmetry Postgres database, and Plaid. Plaid is used only to connect the company's own business bank accounts (currently Chase and Capital One) for bookkeeping and reconciliation. Signmetry has no outside consumer users.

2. Responsibility

Mark Bailey, Owner, is responsible for this policy, for approving access to systems and data, and for responding to security incidents. Every employee who uses company systems must follow this policy and report any suspected security problem to the Owner right away.

3. Access Control

• Access is granted only to authorized employees who need it for their job (least privilege).
• Signmetry uses role-based access, so users see and do only what their role allows.
• Only a few authorized employees may use Plaid Link to connect company bank accounts.
• We will remove a departing employee's access to all company systems within 1 business day of their departure.
• We will review user access to Signmetry, Render, GitHub, and the Plaid dashboard quarterly and remove access that is no longer needed.

4. Authentication

• Shared credentials are stored in 1Password, not in documents, spreadsheets, email, or chat.
• Multi-factor authentication (MFA) is required on Render (authenticator app), GitHub, and the Plaid dashboard (SMS).
• We will add MFA to the Signmetry login.

5. Encryption

• All traffic to Signmetry is encrypted in transit using HTTPS with TLS 1.2 or higher.
• The Signmetry Postgres database is encrypted at rest.

6. Secrets Handling

• Integrations use API keys and OAuth.
• API keys, Plaid access tokens, and other secrets are stored in Render environment variables or in the encrypted database, and are never committed to source code.
• Secrets are never shared in chat, email, or spreadsheets.
• If a secret may have been exposed, it will be rotated promptly.

7. Vendors and Hosting

We rely on established service providers: Render for hosting and the managed Postgres database, GitHub for source code, Plaid for bank connections, and 1Password for credential storage. We use their security features (MFA, access controls, encryption) and limit vendor access to what is needed to provide the service.

8. Patching and Vulnerability Management

• Render manages patching of the underlying hosting platform and database.
• GitHub dependency alerts are enabled for the Signmetry code. We will review alerts and update affected dependencies, prioritizing critical and high-severity issues.

9. Incident Response

If we suspect a security incident (for example, unauthorized access, a lost device, or an exposed secret), we will:

1. Report it to the Owner immediately.
2. Contain it: revoke or rotate affected credentials and tokens and disable affected accounts.
3. Investigate what happened and what data was involved.
4. Notify Plaid and any affected parties promptly, and as required by law.
5. Fix the cause and record what was learned.

10. Policy Review

We will review and update this policy at least once a year, and sooner if our systems or risks change significantly.

Approved by: Mark Bailey, Owner — October 12, 2026