1. Purpose
This policy sets Moogul’s expectations for protecting information entrusted to us and the information we use to run our business. It establishes rules to keep that information confidential, accurate, and available, and to protect customers, personnel, and partners from accidental or deliberate harm.
It is the parent policy for Moogul’s information security program. The supporting policies below explain specific responsibilities and safeguards.
2. Security Policy Ownership
The Chief Executive Officer (CEO) owns the security policies and approves changes. The Security Review Team consists of designated members from engineering, product, and operations who are responsible for reviewing the policies.
The CEO and Security Review Team are responsible for implementing the processes and controls in these policies, involving other team members, employees, contractors, or vendors as needed. The CEO records membership and responsibilities; one person may cover several functions while Moogul is small. Until additional members are designated, the CEO performs these responsibilities.
3. Schedule
The CEO must review the security policies with the Security Review Team every six months, and sooner after a significant change or security incident. Reviews must record participants, findings, decisions, and follow-up owners. Approved changes must be communicated to affected personnel.
Policy reviews are separate from the quarterly access reviews and monthly risk reviews required by the operating procedures.
4. Scope
This policy applies to founders, employees, interns, contractors, and third parties with authorized access to Moogul information or systems. It covers customer and company information in any format, including financial records, credentials, source code, and private business material.
It covers the Moogul app, APIs, administrative tools, websites, corporate accounts, networks, cloud services, and development, staging, and production environments. It applies to company-owned, personal, or third-party devices and services used for Moogul work, wherever information is accessed or stored. Vendor responsibilities must be reflected in applicable agreements.
5. Our Policy Promises
These commitments define the safeguards Moogul must implement and maintain:
- Confidentiality: Protect information according to its sensitivity and limit access to an approved business need. Follow zero trust access architecture principles: verify identity and authorization rather than trusting network location alone. Use centralized identity and access management, including approved Google Groups for group-based permissions where supported, to reduce inconsistent access. Minimize collection, sharing, and retention; encrypt client/server connections with TLS 1.2 or later and encrypt consumer financial data, sensitive records, and backups at rest using managed keys with restricted access. Never collect bank passwords; use our bank data providers’ secure authentication flows.
- Integrity: Protect information from unauthorized or accidental changes through role-based access control (RBAC), logged administrative actions, and reviewed, tested, versioned changes. Conduct quarterly access reviews and periodic audits of permissions and control records. Separate production from tests and use synthetic or redacted test data.
- Availability: Protect services and information against disruption through restricted network exposure, monitoring, timely vulnerability fixes, backups, and documented recovery instructions. Test recovery before systems enter production, annually, and after material recovery changes. Report suspected incidents immediately to [email protected] or directly to the CEO; contain harm, preserve evidence, recover, and make required notifications.
- Compliance: Meet applicable legal, regulatory, and contractual obligations. Assess which privacy requirements apply, including the GDPR and the CCPA as amended by the CPRA, and implement the required notices, rights handling, retention, deletion, and safeguards. Determine Moogul’s controller, processor, or service-provider role for each relevant data flow and document the required agreements before processing. Approve vendor and AI data flows, terms, and settings before sharing sensitive information; send only the information needed for the approved purpose.
- Continuous improvement: Maintain a system/vendor inventory and risk register, review risks monthly, and track corrective actions. Teach personnel their responsibilities; require encrypted, updated, locked work devices protected against loss and unauthorized physical access. Keep secrets out of code, logs, tickets, and AI prompts. Retain dated evidence so that security claims reflect actual operation.
Vulnerability Management
Scan every employee and contractor work computer and every production asset using tools appropriate to the asset. Track coverage, findings, owners, deadlines, and verified remediation. Apply critical security fixes within 24 hours of the vendor’s patch release. Assess critical issues immediately; if no fix is available, isolate or mitigate the exposure and record the remaining risk. Missed deadlines remain exceptions, not successful patching.
Keep packages, frameworks, and tools no more than six months behind the latest stable release, and always on supported versions. Monitor vendor end-of-life notices separately; upgrade or replace software before support ends. Other findings require a risk-based deadline recorded by the CEO; critical fixes take priority over the six-month freshness limit.
6. Supporting Policies
Read this policy together with the following policies, in order:
- Access Control Policy: how access is approved, limited, reviewed, and removed.
- Personnel Policy: security responsibilities, training, performance reviews, and the personnel lifecycle.
- AI Development and Customer Data Policy: permitted AI use, customer-data boundaries, internal calculations, AWS model hosting, and AI governance.
- Asset Management Policy: asset inventory, ownership, safe handling, return, and disposal.
- Data Retention and Disposal Policy: retention limits, consumer requests, bank disconnection, secure deletion, and anonymization.
The operating procedures describe recurring work. The control-status record identifies implementation evidence and remaining gaps.
7. Exceptions And Enforcement
Exceptions require written CEO approval, compensating safeguards, and a review or expiry date in the risk register. Everyone must report suspected policy violations. Violations may result in access suspension or employment/contract action, subject to applicable law and agreements.