Information Security Policy

KYLE LifeOS is a single-user personal finance and life-tracking application operated by one individual for their own use. It is not offered to other users; the only person whose data is processed is the operator, who is the account holder of every connected financial institution. This policy documents the operationalized security controls protecting that data, including financial data retrieved via Plaid. The operator is solely responsible for information security and can be reached at support@kyleneumeier.com.

Application access requires authentication via Supabase magic-link or passkey plus a time-based one-time-password (TOTP) second factor, restricted to a single hard-allowlisted email address. Every API route verifies the server-side session before executing. Database access is server-side only; row-level security is enabled on every table with no policies (deny-all at the API boundary). Administrative accounts (GitHub, Vercel, Supabase, Plaid) require two-factor authentication, and access follows least-privilege.

All traffic is served over HTTPS/TLS 1.2+. Plaid access tokens are encrypted at rest with AES-256-GCM using a key held as an environment secret, never in the database; the underlying PostgreSQL database is additionally encrypted at rest by Supabase.

Hosting on Vercel; database, authentication, and storage on Supabase. Plaid webhooks are verified using Plaid's signed Plaid-Verification JWT (ES256 signature, request-body hash match, and a 5-minute freshness window); scheduled jobs are gated by a bearer secret. Secrets live in environment configuration, never in source control.

Dependencies are monitored by GitHub Dependabot security alerts and automated security-update pull requests, with weekly version-update checks. The application is written in TypeScript (strict mode) and linted on every build; all input boundaries are validated with Zod.

Data is retained while the operator uses the application. A connected institution can be disconnected at any time, which removes the Item at Plaid and stops further retrieval. Because the operator controls the database directly, any stored data can be permanently deleted on request. This policy is reviewed at the cadence noted above.

On a suspected compromise the operator rotates affected secrets (encryption key, Plaid/Supabase keys), revokes and re-links affected Plaid Items, and assesses exposure. Plaid is notified of any incident affecting Plaid-provided data as required.

Security questions or reports can be sent to support@kyleneumeier.com.