FWD Dynamics LLC — Information Security Policy
1. Purpose
This policy describes the information security practices FWD Dynamics LLC (“the Company”) applies to protect customer data, financial information, and system integrity for FWD Atrium, the Company’s SaaS product.
2. Scope
This policy applies to all systems, code, and data associated with FWD Atrium, including the production application, marketing site, and any connected third-party services (Supabase, Stripe, Plaid, Groq, Resend, Vercel).
3. Access Control
Access to production infrastructure (Vercel deployment) and financial systems (Stripe) is restricted to the Founder. As the Company grows, access will be extended on a least-privilege basis. Database access is enforced via Row Level Security (RLS), enforced at the database layer on every table. Users can only access data they own; no table permits unrestricted (allow-all) access. Administrative database operations use a dedicated service-role credential, scoped separately from standard user authentication, and are never exposed to client-side code.
4. Credential and Secrets Management
No API keys, credentials, or secrets are committed to source control. Environment variables are used exclusively for all sensitive configuration, and .env files are excluded via .gitignore. Live payment credentials (Stripe) and third-party API keys are stored in the deployment platform’s (Vercel) encrypted environment variable store, not in code. Repositories are regularly audited for accidentally committed secrets, hardcoded credentials, and injected or malicious instructions embedded in dependencies or configuration files.
5. Vulnerability Management
Automated dependency scanning (GitHub Dependabot) runs on a weekly basis to identify known vulnerabilities in third-party packages. A continuous integration security workflow runs npm audit on every push to the main branch and on every pull request, blocking merges that introduce high or critical severity vulnerabilities. Identified vulnerabilities are triaged and patched promptly, prioritizing high and critical severity issues.
5a. Vulnerability Patching SLA
Identified vulnerabilities are remediated according to the following timeframes, measured from time of detection: Critical severity, patched within 48 hours. High severity, patched within 7 days. Moderate severity, patched within 30 days. Low severity, addressed at the next regular dependency review.
6. Data Handling
Financial data obtained through third-party connections (e.g. Plaid) is used solely to provide the Company’s core service: burn rate, runway, and cash flow reporting for the account holder. The Company does not initiate transfers, payments, or any movement of funds. Customer data is not sold or shared with third parties outside of the service providers necessary to operate the product. Upon account closure, customer data is deleted within 30 days, except where retention is required by law.
7. Monitoring and Incident Response
Production deployments are monitored via Vercel’s built-in observability tools (error rates, function invocations, deployment status). In the event of a suspected security incident (unauthorized access, data breach, credential compromise), the Founder will: revoke or rotate affected credentials immediately, assess scope of impact, notify affected users if personal or financial data is implicated, and document the incident and remediation steps taken.
8. Third-Party Risk
Third-party service providers (Stripe, Plaid, Supabase, Vercel, Resend, Groq) are selected based on their own security and compliance posture, and data shared with each is limited to what is necessary for their specific function.
9. Data Retention and Disposal Policy
Retention: Active account data (financial records, burn entries, investor updates, connected account data via Plaid) is retained for as long as the account remains active. Data obtained via third-party financial connections (Plaid) is retained only as necessary to provide the Service’s core functionality (burn rate, runway, and cash flow reporting) and is not retained beyond the active relationship with the account holder.
Disposal: Upon account closure or termination, all personal and financial data associated with the account is deleted within 30 days. Exceptions to immediate deletion apply where retention is required by applicable law (e.g. financial or tax recordkeeping obligations) or where data must be retained to resolve an active dispute, investigation, or legal obligation. In such cases, data is retained only as long as legally required and is deleted immediately upon expiration of that requirement. Deletion is performed at the database level (Supabase/PostgreSQL) and removes the data from active production systems. Backups are subject to the hosting provider’s standard backup rotation and are not separately retained beyond that cycle.
Review: This Data Retention and Disposal Policy is reviewed no less than annually, and immediately upon any material change to applicable data privacy law or the scope of data collected.
10. Policy Review
This policy will be reviewed and updated as the Company grows, adds personnel, or introduces new systems or data types, and no less than annually.