MoneyIQ Security Policy

1. Introduction

At MoneyIQ, we are committed to protecting your financial data and ensuring a secure user experience. Our platform follows industry best practices and complies with relevant data protection laws to safeguard your information. We continuously enhance our security measures to align with evolving standards.

2. Compliance & Regulatory Standards

MoneyIQ is fully compliant with the following global data protection and security regulations:

• GDPR – EU/UK user rights, data portability, access & deletion requests.
• CCPA/CPRA – California users’ right to opt out and data transparency.
• PDPA – Singapore’s Personal Data Protection Act requirements.
• PCI DSS – We use Stripe’s Hosted Checkout and Elements; MoneyIQ is in SAQ‑A scope and never stores raw card data.
• SOC 2 Type II – Ongoing assurance around security, availability, and confidentiality.

3. User Authentication & Access Control

• MFA – Mandatory multi‑factor authentication for all user logins.
• OAuth 2.0 & OpenID Connect – Secure federated login options.
• Password Policy – Minimum complexity, stored hashed with bcrypt.
• Session Management – Sessions expire after 1 hour of inactivity; a timeout modal warns before auto‑logout.
• Brute‑Force Protection – Temporary account lockout after repeated failed logins.
• JWT Revocation – Tokens are invalidated on logout or password change.

4. Data Encryption & Security Measures

In Transit

• All communications use TLS 1.3 (HTTPS) with HSTS enforced.

At Rest

• AES‑256 encryption for all sensitive stored data.
• bcrypt hashing for passwords.
• Regular key rotation and security audits.

5. Payment Data Security & Stripe Integration

• All card data is collected via Stripe Checkout or Stripe Elements; MoneyIQ never touches raw card numbers.
• We are in PCI‑DSS SAQ A scope: Stripe handles all card‑holder data and compliance.
• Webhook Verification: We validate Stripe signatures (via webhook secret) on every event.
• API Keys & Secrets: Stored in environment variables, never checked into source control, and rotated periodically.

6. API & Web Application Security

• All API endpoints require auth via JWT or session cookies.
• Parameterized queries to prevent SQL Injection.
• Sanitization & Content Security Policy (CSP) to mitigate XSS.
• CSRF tokens on state‑changing requests.
• Strict CORS policy limiting allowed origins.

7. Infrastructure & Hosting Security

• Hosted on AWS with regular patching & maintenance.
• Firewall rules (security groups, NACLs) to restrict traffic.
• SSH key‑only access; no password logins on servers.
• DDoS protection via AWS Shield and CloudFront.

8. Security Monitoring & Incident Response

• Real‑time alerts for suspicious activity (failed logins, unusual locations).
• Comprehensive logging of authentication and admin actions.
• Daily automated vulnerability scans and annual penetration tests.
• Formal incident response plan: contain, notify, remediate within 72 hours.

9. User Privacy & Data Control

• Users can download or delete their data (GDPR right to be forgotten).
• Cookie & tracking preferences are stored per user and can be updated anytime.
• We do not sell or share personal financial data with third‑party advertisers.

10. Contact & Responsible Disclosure

If you suspect a vulnerability or have security concerns, please contact us:
Email: support@money-iq.ai