01About this policy
Phaze 2 LLC, doing business as GoPhaze, owns and operates Unseriety, a GoPhaze software product. The Plaid account and security review are under Phaze 2 LLC / GoPhaze; Unseriety is the product using the proposed integration, not a separate operator. Bank connections remain inactive. Any activation requires a separate consent flow and product readiness review. The operator security program covers GoPhaze, Phaze2, Mail and Unseriety, with product-specific controls and evidence. Version 2026-10-29.2, October 29, 2026. This is a requirements policy, not a certification or blanket claim that all controls cover every service.
02Current operator controls
GoPhaze operator tools use centralized staff authorization, verified Cloudflare Access identity, role restrictions, per-request membership checks and expiring grants. Staff termination or suspension records revoke portal access; transfers replace the previous portal role. Daily technical access checks preserve dated findings separately from human business-need reviews. A dedicated machine certificate authenticates the scheduled security monitor. These controls protect the operator tools; they do not automatically remove access to external provider consoles.
03Responsibility and review
GoPhaze management is responsible for security decisions, access approvals and incident coordination. The security contact is tonideb@gophaze.com. Review risks monthly, privileged access quarterly, and this policy annually or after a material change or incident. Required review records must describe actual work performed; a scheduled review is not evidence of completion.
04Information handling
Collect only information needed for the features users choose. Treat authentication tokens, passwords, financial records and private documents as restricted. Keep provider secrets on the backend. Do not place restricted information in logs, source control, public Notes, support messages or test fixtures. Use synthetic data for verification. Follow the privacy notice for provider transfers, retention and deletion.
05Access and authentication
Require individual administrative accounts, multifactor authentication where supported and least privilege. Approve and record access before granting it, remove it promptly when no longer needed, and review roles quarterly. Verify provider settings directly; this policy does not assert that all account settings have already been verified. User requests must be authenticated and restricted to the resolved account.
06Changes and vulnerabilities
Review security impact before changes to authentication, storage, permissions, providers or publication. Run relevant tests and dependency checks before deployment, retain results, and investigate findings. Triage critical findings within one business day; mitigate confirmed exploitable critical issues promptly, including disabling affected features if necessary. Track exceptions, owner, compensating controls and review dates. These are response requirements, not a guarantee of resolution times.
07Monitoring and incidents
Review service failures, backup status and security reports on business days. Record suspected incidents privately with discovery time, scope, evidence and actions. Contain compromised access, preserve minimal necessary evidence, rotate affected credentials, assess exposed information, recover safely and review causes. Assess applicable notification duties with qualified advice; do not claim an incident is resolved without verification. Never put secrets or affected user content in public reports.
08Recovery and deletion
Check backup completion and investigate failures. Exercise recovery using isolated synthetic data quarterly and after material recovery changes. Verify restored ownership, revisions and deletion exclusions before reconnecting a restored service. Never overwrite production to test a restore. Account deletion must continue to prevent restoration of deleted accounts. Local Passwords vaults are not covered by cloud recovery.
09Suppliers and people
Review provider data flows, permissions and retention before use and at least annually. People receiving access must read these rules and record acknowledgement. Report suspected phishing, lost devices and exposed credentials promptly. Require device screen locks, supported updates and protected storage for administration.
10Current assurance and reporting
This is a documented security policy with procedures being established. It is not a certification, independent audit, completed penetration test or proof of a fully operational program. Administrative MFA evidence, monitoring ownership and live recovery exercises remain verification work. Report concerns to tonideb@gophaze.com without passwords, tokens or unredacted financial documents. See Security + data for the current architecture.
11Passkeys, recovery and provider consoles
Consumer web passkeys require device verification. Recovery phrases are product-specific and stored as one-way digests; password-and-phrase recovery resets authenticator factors and sessions. Cloudflare Access supports passkeys for protected operator access. Separate provider-console access must be reviewed independently; the program does not claim universal phishing-resistant MFA.
12Endpoints and software lifecycle
Maintain an inventory of administrative devices, production services and supported software. Review applicable vulnerability advisories, scan supported assets using appropriate tools and replace unsupported software. Assign findings an owner, severity and remediation target; track overdue items and exceptions. Antivirus and application tests alone do not demonstrate full vulnerability-scanning coverage. Requirements in this policy do not establish that every endpoint has been scanned.
13Financial data activation and deletion
Before enabling Plaid, verify the consumer authorization flow, access controls, actual TLS configuration, encryption for all intended storage copies, retention and deletion paths, and incident responsibilities. Obtain any required provider approval. Accept deletion requests at any time, verify the requester, process active-data removal and preserve restoration exclusions. Never represent a planned hosting migration as deployed protection.