Information Security Policy

1. Purpose and scope

North + Legacy LLC will protect information against unauthorized access, disclosure, alteration, loss, and misuse while keeping it available for legitimate business operations. This policy applies to every person with access to North + Legacy systems and to every device, service, integration, and record used for company business.

2. Responsibilities

The Owner is the Information Security Contact and is responsible for approving access, selecting service providers, coordinating incident response, reviewing this policy, and documenting material security decisions. Every authorized user must protect their account, use data only for approved work, report suspected incidents immediately, and follow the access limits shown in the application.

3. Required safeguards

Zero-trust access: North + Legacy does not trust a prior login, network location, device, or client-supplied role. Every protected request is re-authorized on the server against the current application release, live Supabase identity, MFA assurance level, active workspace membership, current role, workspace ownership, resource scope, and any specifically delegated permission. Cross-site mutations are denied, inactive accounts fail closed, and Owner-only functions remain unavailable unless the live server-side authorization check succeeds.

4. Data handling and classification

Confidential data includes personal information, customer and lead records, contracts, estimates, project files, account balances, transactions, tax records, bank connection data, access tokens, credentials, and internal financial reports. It may be accessed only for an authorized business purpose and shared only through approved systems.

Internal data includes routine operating information that is not intended for the public. Public data is information North + Legacy has intentionally approved for public release. When classification is uncertain, the information must be treated as Confidential.

5. Plaid and connected financial accounts

• Only the Owner may connect, synchronize, reclassify, or disconnect company bank accounts.
• North + Legacy uses Plaid-authorized data only to display account information, balances, and transactions for budgeting, bookkeeping, tax reserves, job costing, and financial reporting.
• North + Legacy does not sell Plaid-sourced data and does not use it for advertising.
• The application does not initiate payments or transfers through Plaid.
• Access must be disconnected when it is no longer needed or when an account or authorization changes.

6. Access reviews and de-provisioning

The Owner performs and documents an access review at least quarterly. Each review covers every active and inactive account, assigned role, individualized feature access, and delegated administrative permission. The Owner must certify appropriate access, modify access that no longer matches the user's duties, or deactivate the account. Completed reviews, decisions, reviewer identity, timestamps, and the next due date are retained in the application audit history.

When an employee, contractor, customer, or other authorized user is terminated, transferred, or no longer requires access, an Owner-authorized deactivation immediately disables the workspace membership, removes delegated administrative permissions, blocks future Supabase sign-ins and session refreshes, and records the action in the audit log. Existing access tokens cannot authorize protected application requests after the membership is disabled. Permanent deletion additionally removes the inactive Supabase identity and remaining account-level permissions while preserving business records that remain subject to an approved retention requirement.

7. Retention, backups, and disposal

Business records are retained only as long as needed for operations, contracts, taxes, accounting, legal obligations, or dispute resolution. Backups must exclude passwords, service credentials, and unnecessary live personal or financial data whenever technically practical. When retention is no longer required, records and access must be securely deleted or disabled using the approved service's controls.

8. Service providers

Before a provider receives Confidential data, North + Legacy will consider the provider's security practices, access model, purpose, and necessity. Provider access must be limited to the service being delivered. Material security or privacy changes must be reviewed before continued use.

9. Incident response

Any suspected loss, unauthorized access, credential exposure, malware, data disclosure, or unusual financial connection must be reported immediately to the Information Security Contact. North + Legacy will contain the issue, preserve relevant evidence, remove or rotate affected access, assess impacted information and people, notify providers or affected parties when required, document the response, and implement corrective actions.

10. Business continuity and recovery

North + Legacy will maintain recoverable application source and use approved hosted-service recovery capabilities for business records. Recovery procedures and critical connections should be checked periodically and after material system changes.

11. Vulnerability management

North + Legacy maintains a documented vulnerability-management standard for application dependencies, hosted services, and administrative devices. Critical findings must be contained and patched or mitigated within 24 hours; high findings within 7 calendar days; medium findings within 30 days; and low findings within 90 days. Unsupported or end-of-life software must be replaced, upgraded, or covered by a documented, time-limited owner exception within 30 days. Administrative devices must be enrolled in approved endpoint protection before the company represents that all employee or contractor machines are actively scanned.

12. Review and enforcement

This policy will be reviewed at least annually and after a material security incident, major application change, or significant change in legal or provider requirements. Violations may result in immediate access removal and other corrective action appropriate to the relationship and risk.