Written Information Security Plan

Our Qualified Individual, the person in charge of this plan, is Shia Hollender, owner of Balinco.

• Only Shia Hollender and staff he personally authorizes.
• Every person has their own login. Staff see only the clients assigned to them.
• Stored account logins and payment cards are visible only to Shia and staff he has specifically given that permission.
• Clients see only their own company's reports and requests.

All traffic to the Portal uses HTTPS. Stored account logins, payment cards and the connection tokens for outside systems (such as QuickBooks Online, Jobber and Shopify) are encrypted in the database, with the key kept in a separate secure vault.

Database rules keep each client's data separate, so one client can never see another's. Automated isolation checks sign in as test accounts and confirm this, and alert us if anything fails.

• The database is backed up daily, and backups are kept for 14 days.
• If syncing with a connected system fails, an alert appears in the owner's notifications so it can be fixed quickly.

If we learn that client information may have been accessed without permission, we will stop it, find out what happened and fix the cause. We will notify affected clients promptly. If 500 or more people are affected, we will also notify the FTC within 30 days of finding out.

• When a staff member leaves, their Portal access is removed right away.
• When a client ends its engagement, we disconnect its outside systems, remove its users' access and, on request, delete its Portal data within 30 days, except records the law requires us to keep.

We review this plan at least once a year, and whenever our systems or risks change, and update it as needed.

Security questions or concerns: info@balincony.com