Information Security Policy

Information Security Program · Version 1.0 · Effective 4 September 2026 · themassis.com

This is the comprehensive written information security program of themassis, approved by senior management. It is designed to meet or exceed the control objectives of the AICPA Trust Services Criteria for Security, NIST SP 800-53 / NIST CSF, and ISO/IEC 27002, and to satisfy the FTC Safeguards Rule (16 CFR Part 314), the Plaid Master Services Agreement, and the Plaid Developer Policy. The signed PDF is the diligence copy: information-security-policy.pdf.

1. Purpose and policy statement

themassis splits Shopify payouts, drafts balanced QuickBooks Online journal entries through a clearing account, and holds exceptions for human review. A merchant may optionally connect a bank account through Plaid so deposits can be matched. Nothing risky posts without an authorized accountant's approval.

This program protects the confidentiality, integrity, and availability of information we own or process — including Plaid End User Data, Shopify payouts, QuickBooks tokens, credentials, and workpapers — against unauthorized access, use, disclosure, alteration, destruction, or loss.

Senior management commits: we will not collect bank login credentials; we will not sell customer data; we will not use customer books to train unrelated models or to advertise; we will notify Plaid of a Security Breach within 12 hours; we will dispose of data under the Data Retention and Disposal Policy. There is no unwritten exception to these rules.

2. Scope

Applies to all systems, personnel, contractors, and subprocessors that handle company or customer information, including:

• The themassis application, API, databases, backups, logs, and infrastructure.
• Shopify, QuickBooks Online, Plaid, Stripe, and email/hosting integrations.
• Endpoints, source code, secrets, and CI/CD.
• End User Data as defined by Plaid, GLBA nonpublic personal information, and personal information under privacy law.
• Exports (CSV, XLSX, PDF) that leave production.

3. Roles

Senior management approves the program. A Qualified Individual oversees and enforces it (FTC Safeguards Rule § 314.4(a)). themassis retains responsibility even if a provider assists.

Merchants view their own store and cannot post. Accountants review and post for assigned clients. There is no standing product-admin role with blanket access to all ledgers. Support access is ticket-scoped, logged, and revoked when the ticket closes.

4. Risk assessment

A written risk assessment covers reasonably foreseeable risks to customer information (token theft, unauthorized posting, insider access, vendor failure, ransomware, insecure disposal). It is reviewed at least annually, after a Security Breach, and after a material change (including production Plaid access). Controls that cannot be operated as written are incidents, not silent exceptions.

5. Data classification

6. Plaid, bank feeds, and End User Data

6.1 Never collected

• Bank, credit-union, or card login credentials, PINs, KBA, OTP/MFA codes, or institution session cookies.
• Full payment-card PAN or CVV (Stripe processes subscription cards).
• Modified, scraped, or proxied Plaid Link.
• End User Data beyond what is required to match Shopify payouts to the selected deposit account.

6.2 What we may store

After Plaid Link, we exchange a public_token server-side for an access_token and item_id. Those values, plus the selected account id, are stored encrypted at rest (Fernet: AES with HMAC, key from the production secret). The Plaid client_id and secret live in the secrets store, not in source control, the browser, or logs. Transaction data is requested only for the deposit account(s) you selected, and only in the window needed to match payouts. We do not pull unrelated accounts.

6.3 Use limitation

• Used solely to provide the requested reconciliation, prevent fraud on that connection, comply with law, and support a ticket you opened.
• No sale, rental, or barter of End User Data or GLBA NPI.
• No cross-context behavioral advertising.
• No disclosure to other merchants, data brokers, or AI training corpora.
• No secondary “anonymized” reuse unless already disclosed in the Privacy Policy. Default: we do not.
• Employee access is need-to-know and logged.

6.4 Disconnect

On disconnect, account closure, or irreparable item error, within 24 hours we: (a) call Plaid item/remove (or successor); (b) delete encrypted tokens and cached bank payloads from the primary store; (c) cease new pulls. Backups expire on the retention schedule and are not restored into production except for disaster recovery under legal hold.

6.5 Plaid Account Information

Dashboard credentials, client_id, and secret are not published or shared except with Authorized Users who have a need. Production Plaid is used only for Shopify payout reconciliation to QuickBooks. Security events are reported to security@plaid.com within 12 hours of becoming aware of a Security Breach, as defined in the Plaid MSA.

7. Shopify and QuickBooks

Connected via OAuth 2.0. Tokens encrypted at rest, never returned to the browser. Scopes limited to payout/settlement read and journal write. Journals post only after an authorized accountant approves. Disconnect revokes and deletes tokens within 24 hours.

8. Access control

• Least privilege, tenant isolation by user_id.
• Server-side sessions; opaque HttpOnly cookie.
• Passwords hashed with scrypt (per-user salt, constant-time compare).
• Phishing-resistant passkeys (WebAuthn, user-verified: Windows Hello / Face ID / hardware key) or authenticator TOTP (RFC 6238) step-up on the themassis session before Plaid Link is opened, before an access_token is stored, and before a Plaid item is removed. Bank usernames, passwords, PINs, and institution MFA stay inside Plaid Link and are never collected. Privileged cloud/database access remains unique identities + MFA + logged.
• Login rate limits; CSRF on state-changing requests; finite session lifetime.
• Joiner-mover-leaver: same-day revocation on termination. No shared logins.
• Privileged cloud/database access: unique identities, MFA, logged.
• Default deny on administrative APIs. No undocumented back doors.

9. Encryption and keys

In transit: TLS 1.2+ with a public CA; no plaintext HTTP for tokens or End User Data. At rest: Fernet for tokens; cloud AES-256 (or equivalent) for volumes, objects, and backups. Application keys are unique per environment, not in git, rotated at least annually and on suspected compromise or personnel change. Mock/dev keys never hold production End User Data.

10. Application and network

• Financial posting cannot happen without an authorized human.
• Parameterized queries; secrets filtered from logs; no tokens in user-visible errors.
• Management ports not on the public internet.
• Workstations that can reach production: disk encryption, auto-lock, current patches, current anti-malware / EDR (Plaid MSA antivirus requirement).
• Critical dependency fixes within 72 hours of a usable patch; high within 14 days.

11. Logging and audit

We log authentication, connect/disconnect, token-refresh failures, payout processing, approve/reject/post, and privileged access. Logs include time, actor, tenant, and action — not secrets. Posting audit logs are kept 7 years. Time is UTC.

12. Vulnerabilities and testing

Reports: security@themassis.com. Before production Plaid access and at least annually thereafter, themassis will obtain an independent penetration test or equivalent assessment, remediate critical and high findings, and retain the executive summary for partner diligence. This page does not claim SOC 2 or ISO 27001 unless a current report is linked here.

13. Secure development

Production secrets are not committed. Mock mode is the default locally and uses synthetic data. Money uses exact decimals; journals must balance before they are ready to post. Changes to auth, encryption, Plaid, or posting require review. Tests covering merchant-cannot-post and token encryption are required for those areas.

14. Vendors

Vendors that receive End User Data or tokens are contracted, reviewed before onboarding and at least annually, and held to security and disposal terms no weaker than this program. themassis remains responsible for subprocessors.

15. Personnel, physical, acceptable use

Access to Confidential or Restricted data requires confidentiality, training, and same-day removal on exit. Customer data is not copied to personal email, unsanctioned drives, or unapproved AI tools. Production physical security is provided by the cloud operator. Paper with Confidential data is shredded. Accessing another merchant's data or capturing bank credentials is a Security Incident.

16. Incident response

A Security Incident is any attempted or successful unauthorized access, use, disclosure, modification, or destruction of themassis information or systems, or any event that reasonably could lead there. A Security Breach is an incident that results in, or is reasonably likely to have resulted in, unauthorized access to or acquisition of End User Data, tokens, or other Confidential or Restricted customer information.

• Report immediately to security@themassis.com. Do not conceal it.
• Triage as soon as practicable, not to exceed 12 hours from becoming aware.
• Contain first: rotate secrets, revoke sessions and tokens, isolate systems. Preserve logs.
• Plaid: notify security@plaid.com within 12 hours of becoming aware of a Security Breach involving Plaid Account Information or End User Data, with known facts, End User types affected, and containment. Incomplete facts do not delay the first notice.
• Affected customers are notified without unreasonable delay and as required by law. Notice is not conditioned on a waiver.

17. Continuity and backups

Backups are encrypted, access-restricted, and restore-tested at least annually. Deleted customer data expires from backups within 90 days unless a legal hold applies. Restore must not reintroduce unbalanced journals or live tokens that should have been revoked.

18. Retention and disposal

Incorporated: Data Retention and Disposal Policy. Informal retention is a policy violation.

19. Customer responsibilities

Keep credentials secret, use unique users, connect only accounts you control, review drafts before posting, disconnect unused integrations, and report compromise to security@themassis.com.

20. Exceptions, enforcement, review

Exceptions require written approval, duration, compensating controls, and a record. There is no standing exception for storing bank credentials, selling data, skipping breach notice, or indefinite retention. Reviewed at least annually. Prior versions retained 7 years.

21. Contact

Incidents and vulnerabilities: security@themassis.com
Privacy: privacy@themassis.com
Support: support@themassis.com
Plaid notice address: security@plaid.com
themassis · themassis.com