Information Security Policy

1. Purpose & Scope

This policy describes how Tedd protects the information you give it, as the product works today. It covers the Tedd application and the outside services it uses, which the Privacy Policy lists. Tedd is an invitation-only pilot run by the Tedd team. It holds no independent security certification, and this policy does not claim compliance with any law or standard.

2. Data Classification

• Restricted: Financial account data, transaction history, Plaid access tokens, user credentials.
• Internal: Application logs, configuration, infrastructure details.
• Public: Marketing content, privacy policy, terms of service.

3. Encryption and Stored Secrets

• In transit: Tedd is served over HTTPS. The website and the API both send a Strict-Transport-Security header (one-year max-age) so browsers keep using HTTPS, along with standard protections against framing and content-type guessing. API responses are marked not to be cached.
• At rest: The database is stored by our hosting provider (Railway). We rely on the provider’s storage protections and have not independently verified its encryption settings. Tedd itself encrypts only the secrets in the next point, not other stored records.
• Plaid access tokens and authenticator secrets are encrypted by Tedd before they are stored, using a key kept outside the database, so a copy of the database alone does not reveal them. They are never included in your data export. Other records are not separately encrypted by Tedd.
• Passwords are hashed with scrypt and a unique random salt, never stored in plaintext.
• Session tokens are random values; only a SHA-256 hash is stored. They are sent in the Authorization header, not in URLs. One-time links (invitations, password resets) carry their token in the link; only a hash of it is stored, and it works once.

4. Access Control & Identity Management

• Authentication: Username or email with a password. Sessions expire after 7 days.
• Multi-factor authentication (MFA): Optional authenticator-app (TOTP) sign-in is available to every user, and we recommend it. Resetting a password does not turn MFA off. If you lose your authenticator, an administrator can turn MFA off for your account after checking that the request comes from you; you can then set it up again.
• Two roles: user (own records only) and admin. Admin screens can list accounts (name, email, role, number of transactions and bank connections), change roles, delete an account or its data, create a one-time password-reset link, turn off two-step sign-in for an account whose owner lost their authenticator (recorded in an audit log), see whether stored secrets are encrypted and readable (counts only, never the secrets or the key), clear secrets that can no longer be decrypted, manage invitations, and read invitation requests and contact messages. They do not show a user’s transactions or balances, and there is no way to view the app as another user. Admin actions check the role on the server.
• Engineers with database access: The people who run Tedd can technically read any stored record, including financial data, through the database. This is not prevented by the application.
• Protected and public endpoints: Endpoints that return or change your records require a valid session token. A short list is public by design: sign-in and its MFA step, invitation lookup and acceptance, password reset using a one-time link, the invitation-request and contact forms, anonymous page counts, a health check, and the Plaid webhook. The Plaid webhook is not covered by session tokens; it is verified separately by Plaid’s signature in production, and signature checking is skipped when the server is set to Plaid’s sandbox. The app does not offer self-service sign-up.
• Brute-force protection: Sign-in is blocked for 15 minutes after 5 failed attempts for the same username from the same network address, or 30 failed attempts from one address. Failed attempts are recorded with the address and time. Unknown usernames and wrong passwords return the same message.
• Session invalidation: Changing or resetting a password ends your other sessions. You can also sign out everywhere else from Settings.
• De-provisioning: Deleting an account removes its sessions and records from our live systems. Backups are covered in the Privacy Policy.

5. Infrastructure

• Tedd is hosted on Railway. Tedd is currently operated by a single founder, so access to the hosting account and the production database is limited to that one person; enterprise-scale controls such as centralized IAM/SSO or workforce de-provisioning are not yet applicable and will be revisited if the team grows.
• API keys and database settings are kept in the hosting provider’s environment settings, not in the source code.
• Multi-factor authentication is required on every account with access to an internal system that stores or processes consumer data: the hosting account, the source-control account, and the email account used for the service.

6. Vulnerability Management

• GitHub Dependabot is enabled to flag out-of-date dependencies, and Semgrep and Bandit static-analysis scans run on the application code on every change and weekly on a schedule.
• Patch SLA: once a vulnerability is identified, we aim to patch critical severity within 7 days, high within 30 days, and medium or low at the next regular dependency-update cycle. This is a target, not a guarantee.
• End-of-life software: we track the major runtime and framework versions in production (backend: Python, FastAPI; frontend: Node.js, Next.js, React) and review them at least once a year, or sooner if a vendor announces an end-of-life date.
• Production changes are tested (automated build and type-checks) and reviewed by the project owner before being merged to production. As a small team, this is solo review rather than a multi-person pull-request process.
• We have no formal bug-bounty or vulnerability-disclosure program yet. To report a suspected security problem, use the Contact page.

7. Third-Party Integrations

• Plaid: Financial data is retrieved through Plaid with your consent in Plaid Link. We never see your bank login. You can disconnect an institution at any time in Settings and choose whether to keep or remove the data it brought in.
• Anthropic (AI provider): Receives chat questions with the relevant records, the file name and first rows of statements in unfamiliar layouts, and monthly net worth summaries, as the Privacy Policy describes. We rely on Anthropic’s commercial API terms, which at the time of writing state that data sent through the API is not used for model training; how long Anthropic keeps it is set by those terms and is not controlled by us.
• RentCast: Receives a property address for a US value estimate, as the Privacy Policy describes.
• Other services (hosting, analytics, email, exchange rates, bank icons) are listed in the Privacy Policy.

8. Data Retention & Deletion

• Your data is kept while your account is active.
• When you disconnect a bank in Settings you choose whether the accounts and transactions it brought in are kept or removed.
• You can delete your account in Settings, or ask us through the Contact page. Your financial records and remaining chat history are removed from our live systems, except what we must keep by law or in backups, as the Privacy Policy describes. We have not verified how long backups are kept, and make no promise about it.
• Server logs are kept as long as needed for security and troubleshooting, then deleted.
• Sign-in attempt records and the log of AI requests are deleted after 90 days. Chat messages are deleted after 90 days.

9. Consent & Privacy

• Bank data is retrieved only after you complete Plaid’s consent screen. Each bank connection is logged with your user, the institution, the time and your network address.
• When you create an account from an invitation, we record that you accepted the Terms and Privacy Policy, which versions you accepted, and the network address. Earlier records keep the version they were made under.
• We do not share your information beyond the services listed in the Privacy Policy.
• In Settings you can download an export of your data (without passwords or connection keys) and delete your account.

10. Incident Response

• There is no 24-hour security hotline or on-call rota yet. Report a suspected incident through the Contact page and we will look into it.
• If we confirm a breach that affects your information, we will tell you and the authorities as the law requires.
• We do not publish fixed notification deadlines here.

11. Access Reviews & Audits

• Admin accounts, recent sign-in logs, and access to internal systems (hosting, source control, database, email) are reviewed at least every 6 months, alongside the Information Security Policy review, and on any suspected incident.
• You can see your bank connections in Settings at any time.

12. Policy Review

We update this policy when the service or its providers change, and change the version and date above when we do. It is also reviewed on a fixed schedule, at least every 6 months, whether or not anything has changed. This policy is approved by the Tedd project owner.