This policy establishes safeguards for the DeductionDog application, API, databases, object storage, backups, email, financial integrations, monitoring, source control, administrative devices, service providers, and authorized personnel. DeductionDog is operated by Don Schomer III, sole proprietor doing business as DeductionDog, in collaboration with Vision Tax Co.
Responsibilities
The Security Administrator approves access, maintains provider controls, patches systems, reviews monitoring and backups, coordinates incidents, reviews this policy, and documents material changes. Authorized people must protect credentials, report incidents, use approved systems, and access information only for authorized purposes.
Access control
- Production access is limited to authorized individuals with a business need.
- Remote root and password SSH login are disabled.
- VPS access requires an encrypted, passphrase-protected SSH private key.
- Critical provider accounts use strong MFA.
- PostgreSQL and Node run on a private Docker network without direct public ports.
- Receipt and backup credentials are separate, least-privileged, bucket-specific, and IP-restricted where supported.
- Secrets remain outside Git in restricted deployment files.
- Access is removed promptly when no longer needed and reviewed at least annually.
Authentication and application security
- Passwords use scrypt hashing and unique salts.
- Access tokens are short-lived; refresh tokens rotate; sessions are revocable.
- Authentication and sensitive actions use database-backed rate limits.
- Email verification and time-limited password resets protect recovery.
- Plaid and Resend webhook signatures are verified before processing.
- Mileage tracker credentials are scoped and session-revocable.
- Consumer MFA is a documented pre-launch improvement.
Encryption and data protection
- Public traffic uses HTTPS with TLS 1.2 or later, certificate renewal, HSTS, and security headers.
- Financial and mailbox integration credentials use authenticated application encryption.
- Receipt objects and backups use private object storage.
- Database backups use client-side AES-256/PBKDF2 encryption.
- A protected recovery key copy is kept off the VPS.
- Sensitive values are excluded from logs and source control.
Network and host security
- Only rate-limited SSH, HTTP, and HTTPS ingress is permitted.
- UFW, Fail2ban, and unattended security updates are enabled.
- A non-root deployment administrator is used.
- Containers use health checks, restart policies, private networking, least-capability controls where compatible, and bounded log rotation.
- Better Stack monitors HTTPS availability and backup schedules.
Secure development
- Source is stored in a private GitHub repository.
- Secrets, keys, QA captures, databases, and build artifacts are excluded.
- GitHub Actions runs Flutter formatting, analysis, tests, an Android release build, Node tests, and production dependency auditing on every push and pull request to
main. - Dependabot checks npm, pub, Gradle, and GitHub Actions weekly; workflow actions are pinned to full commit SHAs.
- Production npm audits must report no known vulnerabilities before deployment.
- Deployment, schema, proxy, backup, and timer configurations are version-controlled.
- Financial integrations are tested in Sandbox before Production use.
Vulnerability management
| Severity | Target remediation |
|---|---|
| Critical, actively exploited, or credential exposure | Immediate containment; target remediation within 7 days. |
| High | Within 30 days. |
| Medium | Within 90 days. |
| Low | Risk-based scheduling. |
Unsupported or end-of-life operating systems, runtimes, databases, proxies, SDKs, and critical libraries are upgraded or isolated before public production. Exceptions require documented risk, compensating controls, and a review date.
Backup and recovery
Encrypted daily, weekly, and monthly backups use independent object-storage credentials. Heartbeats detect missed jobs and failure alerts are sent through Resend. Uploads are verified with object metadata. A clean restore drill is required at least quarterly and after material backup changes.
Incident response
- Validate and classify the event.
- Contain affected credentials, accounts, services, or network paths.
- Preserve relevant evidence.
- Eradicate the cause and remediate vulnerabilities.
- Restore from verified clean systems or backups.
- Assess affected information, users, providers, and obligations.
- Notify affected parties, providers, regulators, or law enforcement when required.
- Document lessons learned and update safeguards.
Credentials believed exposed are rotated promptly.
Vendor management and data minimization
Providers are selected based on need, security, access scope, reliability, and privacy terms. Credentials are least-privileged where supported. Continued access and need are reviewed at least annually. Collection is limited to user-requested functionality, security, consented analytics, and legal obligations. Retention follows the Data Retention and Deletion Policy.
Review and contact
This policy is reviewed at least annually and after material incidents, architecture changes, new financial-data uses, or significant provider changes. Security reports may be sent to support@deductiondog.com.