Information Security Policy

Bifold handles consumer financial data, so it is written down how that data is protected. Bifold is a single-developer operation on managed infrastructure; this policy describes controls that are actually in force, not an aspiration.

1. Scope and ownership

This policy covers the Bifold iOS application, its Supabase project (Postgres database, authentication, edge functions), the static site serving the OAuth universal link and these policies, and the source repository.

Eeshan Kulkarni is the sole owner of information security for Bifold and the single point of contact: eesh.kulkar@gmail.com. There are no employees or contractors. Any future person with access to production is subject to this policy before access is granted.

This policy is reviewed at least annually and whenever the architecture materially changes.

2. Access control

• Least privilege in the database. Row-level security is enabled on every user table. A signed-in session can read and write only its own rows; there is no application-level query that can widen this.
• Bank credentials are never held. Bank usernames, passwords and multi-factor codes are entered into Plaid's own interface and never reach Bifold's client or servers.
• Plaid access tokens are unreachable from any user session. They live in a dedicated table with row-level security enabled and no policies defined, with grants revoked from the anonymous and authenticated roles. Only the service role, available solely inside server-side edge functions, can read them.
• API credentials are never in the client. Plaid keys exist only as managed secrets on the server side. They are not in the app binary, not in the repository, and not in any committed file.
• Multi-factor authentication is required on every console that can reach production: the hosting provider, the source repository, the Plaid dashboard and the Apple developer account.
• No shared accounts and no standing third-party access. Access is reviewed at each annual policy review and revoked immediately when no longer needed.

3. Consumer authentication

Sign-in is Sign in with Apple, so account access is protected by the two-factor authentication Apple requires on every Apple ID. Bifold never handles a consumer password for its own account system.

A step-up check runs immediately before Plaid Link is surfaced. Face ID, Touch ID or the device passcode is required on every path into Link - first run, adding another bank, and repairing an existing one - because a persistent session on its own proves nothing about who is holding the phone. All three factors are device-bound and cannot be phished. A device with none of them configured is refused rather than let through.

4. Encryption

• In transit: TLS 1.2 or better on every connection - app to backend, backend to Plaid, and the public site. No plaintext transport anywhere.
• At rest: AES-256 volume-level encryption on all database files, indexes, write-ahead logs and backups, managed by the hosting provider on AWS.
• Object- and column-level encryption is not currently applied on top of volume encryption. Sensitive material is instead isolated by the role boundary described in section 2.

5. Secure development

• Every change is made on a branch and merged through a pull request; nothing is committed directly to the main branch.
• Automated tests - unit tests, server-side function tests and type checks - run before a change merges, and a code review pass covers correctness and security before release.
• Schema changes ship as forward-only migrations, applied to a local database first and reviewed before reaching production.
• Secrets are excluded from version control by configuration, with committed example files carrying placeholder values only. Credentials are never pasted into issues, pull requests or logs.

6. Vulnerability and patch management

• Automated dependency vulnerability alerts and automated security fixes are enabled on the source repository, and alerts are reviewed as they arrive.
• Remediation targets: critical within 7 days, high within 30 days, medium within 90 days, low at the next convenient release. A vulnerability that cannot be remediated in its window is documented with a compensating control.
• End-of-life software is tracked at each annual review. The database engine and server runtime are maintained by the hosting provider on supported versions; application dependencies are upgraded off unsupported releases.
• The development machine runs full-disk encryption, automatic operating system and security updates, and a screen lock.

7. Logging and monitoring

• Every synchronisation attempt writes an audit row recording the item, what triggered it, when it started and finished, how many records changed, and any error class, code and upstream request id.
• Server-side function logs and database logs are retained by the hosting provider and reviewed when investigating an issue.
• Errors are classified server-side into transient, needs-user and terminal, so a genuine failure is distinguishable from routine upstream noise rather than lost in it.

8. Incident response

On discovering a suspected security incident:

• Contain - rotate the affected credentials, and revoke bank connections if consumer data may be exposed.
• Assess - determine what data was involved and which consumers are affected, using the logs in section 7.
• Notify - inform Plaid without undue delay and within 72 hours of confirming an incident affecting data received through Plaid, notify affected consumers, and notify regulators where the law requires it.
• Remediate and record - fix the root cause and write up the incident and the change made so it cannot recur.

9. Data retention and deletion

• Consumer data is retained while the account is active, and only for operating the app.
• Disconnecting a bank removes the connection at Plaid and deletes the stored access token immediately; already-synced transactions are retained so historical views stay intact.
• Deleting an account disconnects every bank at Plaid and erases all of that consumer's data. Point-in-time recovery is disabled and no backup snapshots are retained, so a deletion leaves no restorable copy behind.
• Periods per data type, the disposal sequence and the verification step are in the data retention and disposal policy.
• Consumers can delete their account themselves from within the app at any time.

10. Third parties

Bifold relies on Plaid for bank connectivity, Supabase on AWS for hosting (SOC 2 Type 2 and ISO 27001 certified), and Apple for authentication and distribution. Logo services receive a merchant domain or ticker and nothing else. Provider security posture is reviewed at each annual review.