Security Policy

1. Our Security Commitment

At Direct Credit, the security of your data is fundamental to our business. As a financial services platform handling sensitive business and personal financial information, we maintain enterprise-grade security controls that meet or exceed industry standards for financial institutions.

This Security Policy describes the technical, administrative, and physical safeguards we implement to protect your information. We continuously evaluate and improve our security posture in response to evolving threats.

2.1 Encryption at Rest

• AES-256 encryption for all stored data, including databases, file storage, and backups
• Hardware Security Modules (HSMs) for cryptographic key management and storage
• Envelope encryption with regularly rotated data encryption keys (DEKs) and key encryption keys (KEKs)
• Field-level encryption for highly sensitive data such as Social Security Numbers and bank account numbers

2.2 Encryption in Transit

• TLS 1.3 enforced for all client-to-server communications with no fallback to older protocols
• Certificate pinning for mobile and API connections
• HSTS (HTTP Strict Transport Security) with a minimum max-age of one year and includeSubDomains directive
• Forward secrecy enabled with ECDHE key exchange to protect past sessions even if long-term keys are compromised

2.3 Key Management

• Cryptographic keys are managed through cloud-provider KMS with automatic rotation every 90 days
• Key access is strictly limited to authorized services via IAM policies with least-privilege enforcement
• Key usage is fully audited with tamper-evident logging
• Emergency key revocation procedures are tested quarterly

3.1 Cloud Infrastructure

• Hosted on SOC 2 Type II certified cloud infrastructure with geographic redundancy
• Virtual Private Cloud (VPC) isolation with private subnets for database and application tiers
• Web Application Firewall (WAF) with OWASP Top 10 rule sets and custom rate limiting
• DDoS protection with automatic traffic scrubbing and anomaly detection
• Container orchestration with immutable infrastructure and automated patching

3.2 Network Security

• Network segmentation with micro-segmentation between application components
• Intrusion Detection and Prevention Systems (IDS/IPS) at network boundaries
• DNS security (DNSSEC) to prevent DNS spoofing attacks
• Egress filtering to prevent unauthorized data exfiltration
• Network traffic encrypted between all internal services (mutual TLS)

3.3 Database Security

• Row-level security (RLS) policies enforce data access boundaries at the database level
• Parameterized queries to prevent SQL injection attacks
• Automated backups with point-in-time recovery (retained for 30 days)
• Database connections restricted to application-layer services only (no direct access)
• Query audit logging for all data access operations

4.1 Authentication

• Multi-Factor Authentication (MFA): Required for all employee accounts and strongly encouraged for customer accounts
• Password Requirements: Minimum 12 characters, complexity requirements, breach-database checking, and bcrypt hashing with individual salts
• Session Management: Secure, HttpOnly, SameSite cookies with automatic expiration and idle timeout
• Brute Force Protection: Account lockout after failed attempts with progressive delays and CAPTCHA challenges

4.2 Authorization

• Role-Based Access Control (RBAC): Granular permissions based on job function (borrower, lender, admin roles)
• Principle of Least Privilege: Users and services receive only the minimum access necessary
• Privileged Access Management: Administrative access requires additional approval and is time-limited
• Quarterly Access Reviews: Automated and manual reviews of all user access rights

4.3 Employee Access

• Background checks required for all employees with access to customer data
• Access provisioned based on role and revoked immediately upon termination
• All production access requires VPN with certificate-based authentication
• Customer data access is logged and subject to random audit review

5.1 Continuous Monitoring

• 24/7 Security Operations: Automated monitoring with escalation procedures for security events
• SIEM (Security Information and Event Management): Centralized log aggregation, correlation, and alerting across all systems
• Anomaly Detection: Machine learning-based behavioral analytics to identify unusual access patterns
• File Integrity Monitoring: Real-time detection of unauthorized changes to critical system files and configurations

5.2 Fraud Detection

• Real-time transaction monitoring for suspicious activity patterns
• Device fingerprinting and geolocation analysis for login anomalies
• Document authenticity verification using automated and manual review
• Integration with industry fraud databases and watchlists

Direct Credit maintains a formal Incident Response Plan aligned with NIST SP 800-61 guidelines.

6.1 Response Phases

• Preparation: Documented procedures, trained incident response team, and pre-established communication channels
• Detection and Analysis: Automated alert triage, severity classification (P1-P4), and forensic evidence preservation
• Containment: Immediate threat isolation, affected system quarantine, and credential rotation
• Eradication and Recovery: Root cause elimination, system restoration from verified clean backups, and service validation
• Post-Incident Review: Blameless retrospective, lessons learned documentation, and control improvement implementation

6.2 Response Time Objectives

6.3 Notification

In the event of a security incident affecting your data, we will notify you in accordance with applicable laws and our Data Breach Notification procedures. See our Privacy Policy Section 14 for detailed notification timeframes and procedures.

7.1 Security Testing

• Penetration Testing: Annual third-party penetration tests covering application, network, and social engineering vectors
• Vulnerability Scanning: Automated weekly vulnerability scans of all external-facing and internal systems
• Static Application Security Testing (SAST): Automated code analysis integrated into the CI/CD pipeline
• Dynamic Application Security Testing (DAST): Runtime security testing of deployed applications
• Dependency Scanning: Automated monitoring for known vulnerabilities in third-party libraries and dependencies

7.2 Patch Management

• Critical security patches applied within 24 hours of release
• High-severity patches applied within 7 days
• Medium and low-severity patches applied within 30 days
• Emergency patching procedures for zero-day vulnerabilities

7.3 Responsible Disclosure

• Background Screening: Comprehensive background checks for all employees and contractors with access to customer data, including criminal history, credit checks, and employment verification
• Security Training: Mandatory security awareness training for all employees upon hire and annually thereafter, covering phishing, social engineering, data handling, and incident reporting
• Role-Specific Training: Additional specialized training for engineering, operations, and support teams on secure coding practices, data protection procedures, and regulatory requirements
• Confidentiality Agreements: All employees and contractors sign non-disclosure and acceptable use agreements
• Phishing Simulations: Regular simulated phishing campaigns to test and reinforce security awareness
• Offboarding: Immediate revocation of all system access and return of company assets upon termination

We carefully evaluate the security posture of all third-party vendors and service providers:

• Vendor Assessment: Security questionnaires, SOC 2 report reviews, and risk assessments before onboarding any vendor with access to customer data
• Contractual Requirements: Data processing agreements (DPAs) requiring specific security controls, breach notification obligations, and data handling standards
• Ongoing Monitoring: Annual reassessment of critical vendors' security posture, compliance certifications, and incident history
• Data Minimization: Third parties receive only the minimum data necessary to perform their contracted services
• Subprocessor Management: Approval and oversight of any sub-processors used by our vendors

10.1 Business Continuity Plan

• Documented business continuity plan (BCP) covering critical business functions
• Business impact analysis (BIA) performed annually to identify critical dependencies
• Designated crisis management team with clear escalation procedures
• Communication plans for customers, employees, regulators, and media during incidents

10.2 Disaster Recovery

• Recovery Time Objective (RTO): 4 hours for critical systems
• Recovery Point Objective (RPO): 1 hour maximum data loss
• Geographic Redundancy: Data replicated across multiple availability zones and regions
• Automated Failover: Critical services configured for automatic failover to standby infrastructure
• DR Testing: Full disaster recovery drills conducted semi-annually with documented results

10.3 Data Backup

• Automated daily backups with incremental backups every 6 hours
• Backups encrypted at rest with separate encryption keys
• Backup integrity verified through automated restoration testing
• 30-day backup retention with long-term archival for regulatory compliance

11. Application Security

11.1 Secure Development Lifecycle

• Security requirements integrated into the design phase of all new features
• Mandatory code reviews with security-focused review criteria
• Automated security testing in CI/CD pipelines (SAST, DAST, SCA)
• Separation of development, staging, and production environments
• No customer data used in development or testing environments

11.2 OWASP Top 10 Protections

• Injection: Parameterized queries and input validation on all user inputs
• Broken Authentication: MFA, secure session management, and credential stuffing protection
• Sensitive Data Exposure: Encryption at rest and in transit, data masking in logs
• XML External Entities: Disabled DTD processing and external entity resolution
• Broken Access Control: Row-level security, RBAC, and server-side authorization checks
• Security Misconfiguration: Infrastructure as code, automated hardening, and configuration scanning
• Cross-Site Scripting (XSS): Content Security Policy headers, output encoding, and sanitization
• Insecure Deserialization: Input validation and integrity checks on serialized data
• Using Components with Known Vulnerabilities: Automated dependency scanning and alerting
• Insufficient Logging: Comprehensive audit logging with centralized SIEM analysis

11.3 API Security

• API authentication via JWT tokens with short expiration periods
• Rate limiting and throttling per API endpoint
• Request size limits and payload validation
• API versioning with deprecation policies for security updates
• CORS (Cross-Origin Resource Sharing) configured with strict origin allowlists

12. Physical Security

• Cloud data centers maintain SOC 2 and ISO 27001 certifications with physical access controls including biometric authentication, 24/7 video surveillance, and security personnel
• Company offices secured with access badge systems and visitor management procedures
• Clean desk policy enforced for all workspaces handling sensitive data
• Secure document destruction (cross-cut shredding) for physical records containing personal information
• Endpoint device management with encryption, remote wipe capability, and screen lock enforcement

13. Compliance and Auditing

13.1 Regulatory Compliance

• GLBA (Gramm-Leach-Bliley Act): Financial privacy and safeguards compliance
• CCPA/CPRA: California consumer privacy rights
• GDPR: European data protection regulation
• BSA/AML: Bank Secrecy Act and Anti-Money Laundering compliance
• FCRA: Fair Credit Reporting Act compliance for credit data handling
• ECOA: Equal Credit Opportunity Act compliance
• EFTA: Electronic Fund Transfer Act compliance
• State Data Breach Notification Laws: Compliance with all 50 state breach notification requirements

13.2 Audit Program

• Annual SOC 2 Type II examination by an independent CPA firm
• Regular internal security audits and control testing
• Compliance monitoring with automated policy enforcement
• External regulatory examinations as applicable

13.3 Audit Logging

• Comprehensive audit trails for all system access, data modifications, and administrative actions
• Logs stored in append-only, tamper-evident storage with minimum 1-year retention
• Log data protected from unauthorized access and modification
• Real-time log analysis for security event detection and alerting

14. Data Protection

14.1 Data Classification

We classify data into four tiers with corresponding security controls:

14.2 Data Loss Prevention

• DLP tools monitor and prevent unauthorized transmission of sensitive data
• Sensitive data masking in application logs, error reports, and non-production environments
• Email and messaging security scanning for outbound sensitive data
• Endpoint DLP agents on all company-managed devices

14.3 Secure Data Disposal

• Cryptographic erasure (crypto-shredding) for decommissioned storage
• NIST SP 800-88 compliant media sanitization procedures
• Certificate of destruction for physical media disposal
• Retention schedules aligned with regulatory and contractual requirements

15. Updates to This Policy

We review and update this Security Policy at least annually or whenever significant changes are made to our security practices. Material changes will be communicated through our website and, where appropriate, via direct notification.

16. Contact Us

For security questions, concerns, or to report a vulnerability: