Information Security Policy

Expense Planner

Version 1.0 — Effective 2026-05-02

Purpose

This Information Security Policy establishes Expense Planner’s approach to protecting the confidentiality, integrity, and availability of customer financial data and the systems that process it. It documents the security controls in place, defines responsibilities, and articulates the operational practices that minimize risk of unauthorized access, modification, or disclosure of information.

The policy is designed to meet contractual and regulatory obligations applicable to a consumer-facing personal finance application that integrates with banking data aggregators, including obligations under the Plaid End User Privacy Policy, Apple App Store Review Guidelines, and applicable U.S. data protection laws.

Scope

This policy applies to:

Background

Expense Planner is a personal finance application available on iOS that helps end users aggregate and review their spending across linked financial institutions. The product is operated by a single developer (“the operator”) and is currently in early-stage release.

This document is the overarching information security policy. Where appropriate, it incorporates the substance of related policy areas inline rather than as separate documents, in keeping with the operational scale of the company. Where Expense Planner grows in scope, individual sub-policies will be split out. The policy areas covered inline include:

Information Security Objectives

It is the policy of Expense Planner that information in all its forms shall be protected from accidental or intentional unauthorized modification, destruction, or disclosure throughout its life-cycle. This protection extends to the equipment and software used to process, store, and transmit that information.

The information security goals of Expense Planner are:

Specific objectives derived from these goals:

Roles and Responsibilities

The Operator of Expense Planner serves as the responsible party for information security and is accountable for:

  1. The design, development, maintenance, and enforcement of the controls described in this policy.
  2. Vendor relationships with Supabase, Plaid, Apple, and any other service providers.
  3. Reviewing access logs, security alerts, and incident reports.
  4. Responding to security incidents and user data inquiries.
  5. Annual review and update of this policy.

The operator’s contact email for security matters is on file with Plaid and may be obtained on request via the application’s support contact.

Policy Review

This policy shall be reviewed and, where necessary, updated at least annually, and additionally upon any of the following triggers:

The reviewed policy will be re-dated and the change history retained in the application’s source control system.

Exceptions

There are currently no exceptions to this policy. Any future exceptions must be documented in writing, justified by business need, time-bounded, and subject to compensating controls. Exceptions will be reviewed annually as part of the policy review.

Policy

Operator Awareness

The operator maintains awareness of relevant security developments through:

If additional contractors or contributors are added in the future, they will acknowledge this policy in writing prior to receiving access to production systems and complete equivalent security awareness review annually.

Workstation Security

The operator’s primary development workstation is configured with:

Backups of the workstation are performed via Time Machine to an encrypted external volume. Source code is additionally backed up via remote git hosting (GitHub).

Acceptable Use

Expense Planner systems and data may be used only for the following purposes:

Prohibited uses include, but are not limited to:

Data Classification

Data handled by Expense Planner is classified into the following tiers:

Tier Description Examples
Restricted Data that, if exposed, would directly harm a user. Plaid access tokens, raw transaction history, account balances, account numbers (last-4 only — full numbers are never collected)
Confidential Data that, if exposed, would expose user identity or activity. User email addresses, user IDs, sign-in metadata, application logs containing user identifiers
Internal Operator-only data with no end-user impact. Aggregate usage counts, infrastructure metrics, application logs without user identifiers
Public Information intended for public release. Marketing copy, App Store listing, this policy document

All Restricted and Confidential data is subject to the encryption, access control, and retention requirements set out elsewhere in this policy.

Data Retention

Encryption

Authentication and Access Management

End users authenticate to the application via:

End users may also enable an in-app Face ID lock screen for an additional access control layer at the device level.

Operator access to production systems:

User-isolation in the database is enforced via Postgres Row-Level Security policies on every user-scoped table; the application’s anon and authenticated keys cannot read other users’ rows even in the presence of an application-layer bug.

Inactive operator credentials, if any (e.g. unused service tokens), are reviewed and revoked promptly upon detection.

Software Development Life Cycle

Vendor Management

Expense Planner relies on the following critical service providers. Each is reviewed for security posture before integration; current providers were selected on the basis of public security documentation and established industry use.

Vendor Purpose Security Documentation
Supabase Managed Postgres, authentication, edge functions, file storage SOC 2 Type II, HIPAA available on enterprise tier
Plaid Financial data aggregation SOC 2 Type II, ISO 27001, end-user privacy policy
Apple iOS distribution, Sign in with Apple, App Store payments Apple Platform Security guide
GitHub Source code hosting SOC 2 Type II, ISO 27001

The list of vendors with access to user data will be reviewed annually. New vendors will be evaluated against equivalent security baselines before integration.

Vulnerability Management

Backup and Disaster Recovery

Incident Response

An information security incident is any event that compromises, or is reasonably suspected to compromise, the confidentiality, integrity, or availability of Expense Planner systems or user data.

In the event of a suspected incident, the operator will:

  1. Contain. Take immediate steps to limit further exposure (revoke credentials, disable affected services, take affected systems offline).
  2. Investigate. Determine scope: which users, which data, what time window, what root cause.
  3. Notify. Notify affected users without undue delay, and in any case within 72 hours of confirming an incident has occurred. Notifications will describe what data was affected, what is being done, and what users should do. Where Plaid access tokens may have been exposed, Plaid will additionally be notified at security@plaid.com so tokens can be invalidated.
  4. Remediate. Address the root cause, document the fix, and adjust controls to prevent recurrence.
  5. Document. Record the incident, response timeline, and lessons learned in a private incident log.

Regulatory notification (e.g. state data breach notification statutes) will be made as required by law.

Responsible Disclosure

Security researchers who identify a vulnerability in Expense Planner are encouraged to report it to the operator via the security contact email associated with the App Store listing. The operator commits to:

Risk Assessment

The operator performs an informal risk assessment at least annually, identifying the most significant threats to user data and evaluating whether existing controls remain adequate. Current top-of-mind risks include:

Acceptable Use of Mobile and Endpoint Devices

The operator’s iOS test devices used to build and validate Expense Planner releases are configured with:

If contractors or contributors join in the future, the same baseline will apply to any device used to access production systems.

Enforcement

The operator is responsible for compliance with this policy. Where additional contributors or contractors join in the future, they will be subject to access revocation and, in cases of serious misconduct, contractual termination for material non-compliance with this policy.

Suspected non-compliance may be reported to the operator via the security contact email.

Document control

Version Date Author Notes
1.0 2026-05-02 Operator Initial policy issued in connection with Plaid Production access application.