Information Security Policy

Purpose and scope

Alta Vista (“the Company”) — the operator of the Alta Vista client-reporting product at myaltavista.com and The Alta Vista Way personal budgeting service at thealtavistaway.com.

This policy establishes how the Company protects the confidentiality, integrity, and availability of the information entrusted to it, above all the financial data of the businesses and households that use its products. It applies to all Company personnel, all systems used to build or operate the products, and all data those systems handle.

The Company is a small, founder-operated business. The Security Owner is the founder, who is also the sole engineer with production access. Where a policy refers to a governing body, that body is the Company’s ownership, which reviews the security program on the cadence stated in the Information Security Policy. Policies are written so that they apply unchanged as staff are added: every clause that says “personnel” binds any future employee or contractor from their first day.

Security ownership and governance

• The Security Owner is accountable for this program: maintaining these policies, approving access, reviewing risk, and leading incident response. Contact: hello@myaltavista.com.
• The security program is reviewed by Company ownership at least quarterly: open risks, incidents since the last review, vendor changes, and the status of planned improvements are recorded in the risk register.
• Every policy is reviewed at least annually and whenever the products gain a new integration, a new category of data, or a new class of user. Reviews are dated in the policy version history.
• Exceptions to any policy must be written down with a reason, a compensating control, and an expiry date, and approved by the Security Owner.

Information classification

All information handled by the Company falls into one of four classes, which drive the handling rules in the other policies:

• Restricted: consumer and client financial data (bank accounts and transactions, accounting data, metrics, statements, commentary), authentication secrets, API keys, encryption keys, and vendor access tokens. Encrypted in transit and at rest; access strictly by role; never on personal devices except transiently while operating the product; never in logs, tickets, chat, or source control.
• Confidential: user contact details, sign-in records, audit logs, internal documents, and the risk register. Access limited to personnel who need it.
• Internal: source code, configuration, and operational runbooks. Stored in private repositories.
• Public: marketing material, published policies, and the fictional demo data used on the public demo.

Production architecture and provider responsibilities

The Company operates no servers, data centers, or corporate network of its own. Production runs entirely on managed cloud platforms:

• Application hosting: Vercel (serverless functions and static assets; SOC 2 Type II).
• Database, authentication, and file storage: Supabase managed PostgreSQL on AWS (SOC 2 Type II), one isolated project per install.
• Transactional email: Resend. AI answers (business product only): Anthropic API. Bank connectivity (personal product only): Plaid. Accounting connectivity (business product only): Intuit QuickBooks Online.
• Source control and continuous integration: GitHub.

Physical and network security of the production infrastructure is provided and attested by those providers under their own compliance programs; the Company’s controls operate at the application, data, and account layers described in these policies.

Core security standards

• Tenant isolation is enforced in the database. Every table holding customer data carries row-level security, and access checks resolve membership by a live database lookup rather than a client-supplied identifier or a cached claim. An automated tenant-isolation test suite exercises these rules and must pass before any change is merged (see the Change Management Policy).
• Least privilege by default. Public API roles hold read-only grants; every write passes through server code after an application-level authorization check, with two narrowly scoped, database-enforced exceptions for client-authored answers and notes. Tables holding vendor tokens grant no access to any API role at all.
• Encryption everywhere. All traffic uses TLS. Providers encrypt storage at rest. Vendor access tokens (Plaid, QuickBooks) are additionally encrypted at the application layer with AES-256-GCM under keys that live only in the hosting platform’s encrypted environment configuration. Tokens are never written to logs.
• No passwords to steal. Users sign in with one-time codes or links sent to an authorized email address. Removing an address from a tenant ends that address’s access immediately.
• Files never transit the application server: uploads and downloads use short-lived, per-request signed URLs issued only after a membership re-check. There are no standing public read policies on file storage.
• Secrets live only in the hosting platform’s encrypted environment configuration and local, git-ignored files. Continuous integration rejects commits that contain real customer identifiers.
• Every production account (hosting, database, source control, email, vendor dashboards) is protected by multi-factor authentication, and account access is reviewed quarterly (see the Access Control Policy).

Personnel security

• Background checks: any person granted access to Restricted data or production systems, whether employee or contractor, completes a background check before access is granted, to the extent permitted by law. The founder is currently the only person with such access.
• Security awareness: every person with system access completes security awareness material on joining and at least annually thereafter, covering phishing, credential hygiene, safe handling of Restricted data, and how to report an incident. The Security Owner’s annual refresher is recorded in the risk register.
• Acceptable use: Company systems and data are used only for Company work. Restricted data is never copied to personal accounts, unmanaged devices, or unapproved tools.
• Offboarding: all access is revoked the same day a person’s role ends, and shared secrets they could have known are rotated.

Workstation and endpoint standards

Every device used to operate production or handle Restricted data must have: full-disk encryption; the operating system’s built-in malware protection enabled and current (Microsoft Defender on Windows, XProtect and Gatekeeper on macOS); automatic operating-system and browser updates; a screen lock of at most 10 minutes; and no local copies of customer financial data beyond what a task transiently requires. Devices are listed in the asset inventory and wiped before disposal or transfer.

Compliance and enforcement

Violations of this policy by personnel are grounds for loss of access and, where applicable, termination of employment or contract. Suspected violations and security weaknesses are reported to the Security Owner at hello@myaltavista.com and handled under the Incident Response Policy.

Review

Reviewed at least annually and on any material change.