Information Security Policy

1. Purpose and Scope

This policy describes how Sage Studio identifies, mitigates, and monitors information security risks relevant to the personal, business, and financial data it processes on behalf of its users. It applies to the Sage Studio web application, its underlying infrastructure, and the third-party service providers it relies on to deliver the product.

2. Organization and Responsibility

Sage Studio is a founder-led company. Information security responsibility — including this policy's maintenance, access-control decisions, incident response, and vendor risk review — is currently centralized with the founder, Will Sage. As the team grows, security responsibilities will be formally delegated and this policy updated accordingly.

3. Data We Handle

Sage Studio processes account information (name, email), user-generated content (site content, tasks, financial records the user enters), and, for users who connect a bank or credit card, transaction data and account metadata obtained through Plaid. Sage Studio never receives or stores bank account credentials directly — those are handled entirely within Plaid's own secure authentication flow.

4. Technical Controls

5. Secure Development Practices

All code changes are tracked in version control with a full history. Dependencies are regularly updated and checked for known vulnerabilities (`npm audit`) before release. Every deployment goes through an automated build and type-check step before reaching production, and security-relevant changes (access control, encryption, payment and financial data handling) receive a dedicated review pass before being shipped.

6. Third-Party Service Providers

Sage Studio relies on established infrastructure providers rather than operating its own servers or database hardware: Vercel (application hosting), Supabase (database and authentication), Plaid (bank connections), Stripe (payments), and Resend (transactional email). Each provider maintains its own independent security and compliance program. We select vendors that publish their own security documentation and review new integrations before granting them access to user data.

7. Monitoring

Application and infrastructure logs (via Vercel and Supabase) are reviewed when investigating reported issues or anomalies. Financial records maintain an audit trail of who created or modified them and when. As Sage Studio grows, this will be supplemented with automated alerting.

8. Data Retention and Deletion

Users can disconnect a linked bank account at any time, which stops further data collection from that account. Users can delete their financial entities, sites, or account entirely; deletion cascades to remove associated records, including encrypted third-party tokens.

9. Incident Response

In the event of a suspected security incident, Sage Studio will: (1) contain the issue, including revoking affected credentials or access tokens, (2) assess what data may have been affected, (3) notify affected users and relevant partners without undue delay, and (4) remediate the underlying cause before restoring full service.

10. Policy Review

This policy is reviewed at least annually, and whenever a material change is made to how Sage Studio handles user data or connects to new third-party services.