This Information Security Policy establishes the security requirements, controls, and responsibilities for HM Services Consulting Inc. ("the Company"), operating as Cashuary. This policy applies to all systems, personnel, and processes involved in the collection, processing, storage, and transmission of financial data, personally identifiable information (PII), and authentication credentials.
Cashuary is a financial data aggregation and calendar synchronization service that connects users' bank accounts (via Plaid and Stripe Financial Connections) to Google Calendar. The application processes sensitive financial data including bank transaction details, authentication tokens, and payment information.
All employees, contractors, agents, and third-party service providers with access to Cashuary systems must comply with this policy.
Harvey Multani, Chief Executive Officer, serves as the designated security officer and is responsible for the overall information security posture of the organization, including:
Security inquiries, incident reports, and data subject requests should be directed to: support@cashuary.com
Cashuary maintains comprehensive access control and authentication policies covering the principle of least privilege, infrastructure access controls, administrative access, consumer authentication via Google OAuth 2.0, session management, infrastructure MFA, role-based access control across all platforms, access review and de-provisioning procedures, and non-human credential management.
The full Access Control Policy is available at cashuary.com/access-control-policy.html (Document ID: ACP-2026-001).
All sensitive credentials (OAuth tokens, API keys, refresh tokens) are encrypted using AES-256-GCM (authenticated encryption with associated data) before storage in the database. Implementation details:
Cashuary follows the principle of data minimization for financial transaction data:
data_hash) of transaction data is persisted to the
database for deduplication purposes
All environment variables are validated at application startup using schema validation (Zod)
with strict type checking and minimum-length requirements. The application will refuse to
start if required secrets are missing or malformed. Environment files (.env)
are excluded from version control and checked by pre-push hooks to prevent accidental
exposure.
Cashuary is hosted on Railway, a Platform-as-a-Service (PaaS) provider that manages:
The application implements comprehensive security headers via Helmet.js:
Rate limiting is applied to all API, authentication, webhook, and administrative endpoints:
| Endpoint Category | Rate Limit | Window |
|---|---|---|
API endpoints (/api/*) |
200 requests | 15 minutes |
Authentication (/auth/*) |
30 requests | 15 minutes |
Webhooks (/webhooks/*) |
500 requests | 15 minutes |
Administration (/admin/*) |
50 requests | 15 minutes |
All state-modifying API requests are protected against CSRF attacks using the double-submit cookie pattern. CSRF tokens are bound to the user's session identifier and validated on every mutating request. Webhook endpoints are exempt from CSRF protection as they use their own signature-based verification.
Production, staging, and development environments are fully isolated with separate:
main and production branches are blocked by
pre-commit hooks
main branch tip
production branch are blocked by pre-push hooksThe following automated checks run on every push and pull request:
All incoming webhooks (Plaid, Stripe, Sentry) are verified using cryptographic signature
validation before processing. Webhook endpoints receive raw request bodies
(express.raw()) to preserve the original payload for signature verification.
Each webhook provider uses its own HMAC-based verification scheme.
package-lock.jsonnpm audit is incorporated into the development workflowIn the event of a data breach involving user financial data or PII, affected users will be notified within 72 hours of discovery. Notifications will include the nature of the breach, data affected, remediation steps, and contact information for questions. Regulatory authorities will be notified as required by applicable law.
| Severity | Description | Remediation Target |
|---|---|---|
| Critical | Active exploitation or data exposure | 24 hours |
| High | Exploitable vulnerability, no active exploitation | 7 days |
| Medium | Vulnerability requiring specific conditions | 30 days |
| Low | Informational or defense-in-depth improvement | 90 days |
Cashuary maintains a comprehensive data retention policy governing the lifecycle of all user data. Key provisions include:
The full Data Retention and Disposal Policy is available at cashuary.com/data-retention-policy.html.
Cashuary integrates with the following third-party service providers. All providers have been evaluated for security compliance:
| Provider | Purpose | Compliance |
|---|---|---|
| Plaid | Bank account aggregation and transaction data | SOC 2 Type II, ISO 27001 |
| Stripe | Financial Connections (bank linking) | SOC 2 Type II, PCI DSS Level 1 |
| Google Cloud Platform | OAuth authentication, Calendar API | SOC 2 Type II, ISO 27001, FedRAMP |
| Railway | Application hosting and managed PostgreSQL | SOC 2 Type II |
| Sentry | Error monitoring and alerting | SOC 2 Type II |
| GitHub | Source code management, CI/CD, security scanning | SOC 2 Type II, FedRAMP |
Third-party provider security postures are reviewed annually. Data shared with third parties is limited to the minimum necessary for service delivery. All third-party API communications are encrypted via TLS.
This policy is reviewed and updated quarterly, or sooner if triggered by:
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0 | March 10, 2026 | Harvey Multani | Initial policy release |
This Information Security Policy has been reviewed and approved by the undersigned on behalf of HM Services Consulting Inc.