Information Security Policy

1. Security governance & organizational responsibilities

Security governance at Rensure is overseen by executive leadership. The Designated Security Officer is responsible for establishing security baselines, monitoring threat intelligence, enforcing access policies, and conducting annual risk evaluations.

2. Banking & financial data security (Plaid Integration)

When users connect their financial institutions to synchronize bank accounts and transactions for IRS Schedule E tax reconciliation:

• Zero Credential Exposure: Rensure never receives, processes, or stores raw bank login credentials (usernames, passwords, or PINs). All authentication takes place via Plaid Link's encrypted OAuth protocol directly with financial institutions.
• Tokenized API Access: Rensure receives only an opaque, encrypted API token from Plaid that grants read-only access to account metadata and transaction history.
• Scoped Permissions: Bank connections are scoped exclusively to retrieve transactions and account balances necessary for rental property accounting and tax categorization.
• Revocation & Deletion: Users may disconnect their bank feed at any time from their account settings, which immediately invalidates the associated Plaid token.

3. Cryptography & data transmission

4. Access control & least privilege

Access to production environments, administrative consoles, and database layers is governed by the Principle of Least Privilege:

• Multi-Factor Authentication (MFA): Enforced on all administrative, developer, and infrastructure accounts without exception.
• Multi-Tenant Isolation: Customer tenancy data is strictly separated at the application and database level through tenant identifier isolation and PostgreSQL Row-Level Security (RLS).
• Zero Plaintext Passwords: User passwords are salted and hashed using industry-standard cryptographic algorithms (Argon2 / bcrypt) before database storage.

5. Vulnerability management & secure development

Our software development lifecycle enforces rigorous quality and security gates:

• Automated dependency vulnerability audits (npm audit / dependabot).
• Static application security testing (SAST) and brand/token linter verification on every build commit.
• Mandatory peer reviews and automated test suites for pull requests affecting authentication or data access.
• Prompt security patching schedule for underlying OS and runtime dependencies.

6. Incident response & breach notification

Rensure maintains a documented incident response procedure covering detection, containment, eradication, recovery, and post-incident analysis:

• Triage & Containment: Incidents are escalated immediately to the Designated Security Officer for risk assessment and system isolation.
• Customer & Partner Notification: In the event of a confirmed security incident impacting customer personal or financial information, Rensure will notify affected account holders and integration partners without undue delay and within seventy-two (72) hours of incident verification.
• Postmortem: Comprehensive root-cause analysis is conducted and documented to prevent recurrence.

7. Responsible vulnerability disclosure

We welcome reports from security researchers and users. If you believe you have discovered a vulnerability or security concern regarding Rensure: