Effective Date: August 11, 2025 | Version 1.0
Our Commitment to Security
We take the security of your personal and payment information seriously. This policy outlines the comprehensive measures we implement to protect your data and ensure secure transactions.
Data Protection
Encryption Standards
- All sensitive data encrypted at rest using AES-256 encryption
- TLS 1.2+ encryption for all data transmission
- Bank account tokens secured with additional application-level encryption
- No plain text storage of payment credentials
Data Categories We Protect
- Payment Information: Bank account details, payment history, transaction records
- Personal Information: Name, address, phone, email
- Account Security: Passwords, authentication tokens
- Business Records: Order history, invoices, statements
Payment Security
ACH Payment Processing
- Manual ACH processing through secure banking channels
- Bank account information encrypted with AES-256-GCM
- All payment data stored in encrypted format
- Multi-factor authentication required for payment processing
- Compliance with NACHA Operating Rules
Payment Protection Measures
- Identity verification for all new accounts
- Manual review and approval of payment details
- Fraud detection and velocity checks
- High-risk transaction monitoring and review
Access Control
- Multi-factor authentication for administrative access
- Role-based access control (RBAC) throughout the platform
- Session timeout after 30 minutes of inactivity
- Strong password requirements (12+ characters)
- Regular security audits and access reviews
Infrastructure Security
- Hosted on secure cloud infrastructure with DDoS protection
- Web Application Firewall (WAF) enabled
- SSL/TLS certificates maintained and auto-renewed
- Regular security updates and patches
- 24/7 monitoring and alerting systems
Security Monitoring
Continuous Monitoring
- Real-time authentication attempt monitoring
- Failed payment tracking and alerting
- Comprehensive audit logs for all administrative actions
- Automated alerts for suspicious activities
Incident Response
We maintain a comprehensive incident response plan that includes immediate containment, investigation, remediation, and customer notification within 72 hours if required by law.
Compliance
- PCI DSS compliance for payment card industry standards
- NACHA Operating Rules for ACH transactions
- State privacy law compliance (CCPA, etc.)
- Regular third-party security assessments
Data Backup and Recovery
- Daily automated encrypted backups
- Geographic redundancy for backup storage
- 30-day retention policy
- Recovery Time Objective (RTO): 4 hours
- Recovery Point Objective (RPO): 24 hours
Vulnerability Management
- Critical security patches applied within 24 hours
- Monthly security updates
- Automated dependency vulnerability scanning
- Input validation and sanitization
- Protection against SQL injection, XSS, and CSRF attacks
Your Security Responsibilities
- Keep your account credentials confidential
- Use strong, unique passwords
- Report suspicious activity immediately
- Keep your contact information up to date
- Review your statements and transaction history regularly
Security Updates
This policy is reviewed annually and updated as needed to address new threats, technologies, and regulatory requirements. We continuously improve our security measures to protect your information.
Contact Us
For security concerns or to report an incident, please contact us immediately:
- Email: contact@shawnnance.com
- Response Time: Critical incidents handled 24/7
This document demonstrates our commitment to information security and our implementation of industry-standard security controls for e-commerce and payment processing operations.