INFORMATION SECURITY POLICY

1. Purpose and Scope

This Information Security Policy establishes the principles, requirements, and responsibilities that Drew Ernst, sole proprietor, doing business as DTE Solutions. ("DTE" or "the Organization") follows to protect the confidentiality, integrity, and availability of all information assets — including consumer financial data accessed via the Plaid API and processed within the Pulse AI platform.

This policy applies to:

• All internal systems, applications, and infrastructure operated by Drew Ernst, sole proprietor, doing business as DTE Solutions.
• All data collected from or on behalf of consumers, including financial data retrieved via the Plaid API
• All third-party integrations, service providers, and API partners handling DTE data

2. Governing Principles

Drew Ernst, sole proprietor, doing business as DTE Solutions. operates under the following foundational security principles:

3. Information Security Program

3.1 Governance and Risk Management

• Drew Thomas Ernst serves as the sole information security owner and is responsible for all security policy decisions, risk assessments, and incident response.
• Information security risks are identified through continuous monitoring, third-party service provider alerts (Supabase, Vercel, GitHub), and periodic self-assessments.
• Risk mitigation actions are tracked and operationalized within the system architecture.

3.2 Access Control

• Non-Human Authentication: All service-to-service and API integrations use OAuth 2.0 tokens or TLS certificates. No static passwords are used for machine-to-machine communication.
• Zero Trust Model: The Pulse AI platform is deployed on Vercel's serverless infrastructure with network-level isolation. All API routes are authenticated via JWT tokens validated server-side before any data access.
• Consumer Authentication: Consumers authenticate via Supabase Auth using Multi-Factor Authentication (MFA) capabilities alongside session-based JWT tokens, ensuring an extra layer of protection against unauthorized access and safeguarding sensitive financial data. Access to financial data is scoped strictly to the authenticated user's identity.
• Secrets Management: All API keys, database credentials, and third-party integration secrets are stored as encrypted environment variables in Vercel and are never committed to version control.
• Access Reviews and Audits: We conduct periodic reviews and audits of all access rights across our systems to identify and remediate excessive or outdated permissions, ensuring all access remains appropriate, compliant, and strictly governed by our least-privilege principles.

3.3 Encryption

• Data in Transit: All communications between clients and servers use TLS 1.2 or higher. HTTPS is enforced across all endpoints via Vercel's edge infrastructure.
• Data at Rest: Consumer financial data retrieved from the Plaid API is stored in a Supabase-managed PostgreSQL database. Supabase enforces AES-256 encryption at rest for all database storage.

3.4 Development Security

• Secure SDLC: Code is version-controlled via GitHub with branch protections. All production deployments are triggered through automated CI/CD pipelines (GitHub Actions → Vercel).
• Secrets Exclusion: .gitignore files are maintained across all repositories to prevent .env files and credentials from being committed.
• Dependency Management: npm audit is run on dependency updates. End-of-life (EOL) packages are identified and upgraded on a defined schedule.
• Vulnerability Management: Vulnerability scanning is performed against production assets through Vercel's infrastructure monitoring and Supabase's platform security controls. Identified vulnerabilities are patched within a defined SLA:
  • • Critical/High: ≤ 7 days
  • • Medium: ≤ 30 days
  • • Low: ≤ 90 days

3.5 Infrastructure and Network Security

• Cloud-Native Architecture: The Pulse AI platform runs on Vercel's globally distributed serverless infrastructure. No self-managed servers are in scope. Vercel maintains SOC 2 Type II compliance on the infrastructure layer.
• Database Security: The production PostgreSQL database is hosted on Supabase with Row-Level Security (RLS) policies enforced at the database layer. All database connections require SSL.
• API Gateway: All API requests pass through Vercel's edge network and are authenticated before reaching application logic.

3.6 Third-Party and Vendor Management

Drew Ernst, sole proprietor, doing business as DTE Solutions. utilizes best-in-class, SOC 2 compliant platforms to deliver secure services:

• Plaid: Financial data link provider. Plaid API tokens are handled server-side only and are never exposed to the client.
• Supabase: Database and authentication provider. Supabase is SOC 2 Type II compliant.
• Vercel: Hosting and serverless infrastructure. Vercel is SOC 2 Type II compliant.
• Anthropic: AI inference provider for the Nova Behavioral AI Consultant. Communications are server-side only via HTTPS.

3.7 Incident Response

In the event of a security incident involving consumer data:

1. The incident is immediately triaged by Drew Thomas Ernst.
2. Affected services are isolated to prevent further data exposure.
3. The incident is documented including root cause, impact scope, and remediation actions.
4. Affected consumers are notified within the timeframe required by applicable law.
5. Plaid's security team is notified if a Plaid integration is implicated, per Plaid's incident reporting requirements.

4. Privacy and Data Handling

• Drew Ernst, sole proprietor, doing business as DTE Solutions. maintains a published Privacy Policy accessible at dte-solutions.icu/privacy-policy.
• Consumer consent is obtained prior to data collection, processing, and storage via explicit consent flows within the Pulse AI onboarding experience and Plaid Link.
• Consumer financial data received from the Plaid API is used solely for the purpose of providing the Pulse AI behavioral finance features to the authenticated consumer.
• Data is not sold, shared, or used for advertising purposes.

5. Policy Compliance

Compliance with this policy is mandatory. Violations will result in immediate review and remediation. This policy is reviewed at minimum annually and upon any material change to the organization's technology stack, data handling practices, or applicable regulatory requirements.