Legal

Information Security Policy

Effective Date: July 6, 2026  ·  Last Updated: October 2, 2026

1. Scope

This policy applies to all data processed by MarineOps including subscriber business data, customer records, financial data retrieved via Plaid, payment processor integrations, and all internal systems used to operate the MarineOps platform.

2. Data Classification

Highly Sensitive

• Bank account access tokens (Plaid credentials)
• Bank transaction descriptions and merchant names
• User passwords and authentication secrets
• Multi-factor authentication codes

Sensitive

• Customer personally identifiable information (names, addresses, phone, email)
• Vehicle identification numbers (VIN)
• Invoice and payment records
• Bank account metadata (institution name, last four digits)
• Account balances

Internal

• Business operational data (repair orders, schedules, inventory)
• Staff records and role assignments
• System logs and audit trails

3. Encryption

Data in Transit

All data transmitted between users and MarineOps systems is encrypted using TLS 1.2 or higher. Plain HTTP connections are not accepted. Mobile app communications use the same TLS-encrypted API endpoints.

Data at Rest

• Plaid access tokens — encrypted at rest using AES-256 before storage. Tokens are never logged or returned in API responses.
• Bank transaction descriptions — encrypted at rest using AES-256-GCM with a unique initialization vector per record. Decrypted only at query time for authorized users.
• Passwords — hashed using bcrypt with a minimum cost factor of 10. Plaintext passwords are never stored or logged.
• Trusted device tokens — stored as SHA-256 hashes. Plaintext tokens are only held in the subscriber's browser cookie, never in the database.

Encryption keys are stored in server-side configuration files, not in the database, and are never exposed in application code repositories.

4. Authentication and Access Control

For full details see our Access Control Policy. Key controls include:

• Multi-factor authentication (MFA) via email OTP is required for all subscriber accounts with access to financial features including bank reconciliation, invoices, and financial reports
• Trusted device tokens allow MFA bypass for 30 days on recognized devices, reducing friction without compromising security
• Role-based access control restricts what each staff member can see and do within the platform
• Technician-only accounts with no financial access are exempt from MFA requirements
• Authentication tokens expire after 90 days and are invalidated on logout

5. Third-Party Integrations

Plaid

MarineOps uses Plaid to connect subscriber bank accounts. Plaid is a certified Financial Data Exchange (FDX) API provider and maintains its own comprehensive security program. Bank credentials are entered directly into Plaid's secure interface and are never transmitted to or stored by MarineOps. Plaid webhook events are verified using ES256 cryptographic signature validation before processing.

Stripe and Square

Payment processing is handled by PCI-DSS compliant processors. Card numbers and payment credentials are never transmitted to or stored by MarineOps systems.

Hosting

MarineOps is hosted on Namecheap shared hosting infrastructure in the United States. Server access is restricted to authorized personnel via SSH key authentication. FTP access is encrypted (FTPS, FTP over TLS with certificate verification) and is used only for deployments.

6. Vulnerability Management

• PHP and MySQL versions in use are reviewed quarterly against known CVE databases and end-of-life schedules
• Application code is reviewed for common vulnerabilities including SQL injection, XSS, CSRF, and insecure direct object references before deployment
• All database queries use parameterized statements (PDO prepared statements) to prevent SQL injection
• User-supplied content is escaped before output to prevent cross-site scripting
• CSRF protection is implemented on all state-changing operations
• Automated vulnerability scans (OWASP ZAP) are run against the production application at least quarterly and after major releases; scan reports are retained for at least two years
• Identified vulnerabilities are remediated within these timeframes from discovery: Critical — 7 days; High — 30 days; Medium — 90 days; Low — next scheduled release. Exceptions require documented compensating controls
• Security updates for the operating system, PHP and MySQL are applied within the same timeframes based on vendor severity

7. Incident Response

In the event of a confirmed or suspected data breach, Daily Defense Solutions LLC will:

• Contain the incident within 24 hours of discovery
• Assess the scope and nature of any data exposure
• Notify affected subscribers by email within 72 hours of confirming a breach that affects their data
• Notify Plaid within 24 hours if any breach involves Plaid-sourced financial data
• Cooperate with law enforcement and regulators as required
• Conduct a post-incident review and implement corrective measures

To report a suspected security vulnerability, contact [email protected] with the subject line "Security Report."

8. Access Reviews

Internal access to production systems and subscriber data is limited to Daily Defense Solutions LLC personnel who require it for their role. Access rights are reviewed quarterly. Staff members who leave the organization have all access revoked immediately upon departure.

9. Logging and Monitoring

MarineOps maintains server-level access logs, application error logs, and authentication event logs. Logs are retained for a minimum of 90 days. Authentication failures, permission denials, and API errors are logged for security monitoring purposes.

10. Policy Review

This policy is reviewed and updated at least annually, or whenever significant changes are made to the platform's security posture, integrations, or data handling practices. The effective date at the top of this page reflects the most recent review.

11. Contact

Security questions or concerns may be directed to:

• Email: [email protected]
• Company: Daily Defense Solutions LLC