Security

1. Our Security Commitment

Security is built into how we design, build, and operate Access2Cap — not added as an afterthought. We apply industry-standard, defense-in-depth practices across our application, infrastructure, and processes so that your information is protected at every layer.

2. Data Encryption

• Encryption in transit: All traffic to and from Access2Cap is encrypted using TLS (HTTPS). We enforce HTTPS site-wide with HSTS.
• Encryption at rest: Sensitive fields — such as Tax IDs/EINs, SSNs, and access tokens — are encrypted in our database, separate from standard record storage.
• Password protection: Passwords are hashed using a modern, salted, one-way cryptographic algorithm and are never stored or visible in plain text.
• Secrets management: API keys and credentials are stored as protected environment configuration, not in source code.

3. Infrastructure & Network Security

• Hosted on hardened, regularly patched servers in the United States.
• Network-level controls and firewalls restrict access to internal services.
• Administrative and database access is limited to authorized personnel over secured channels.
• Regular backups support recovery and business continuity.

4. Authentication & Access Control

• Token-based authentication: Sessions use signed, expiring access tokens.
• Two-factor authentication (2FA): Available for added account protection.
• Single sign-on: Sign in with Google using OAuth 2.0 — we never see your Google password.
• Role-based access control: Merchants, lenders, and administrators each see only the data appropriate to their role.
• Email verification: New accounts confirm ownership of their email address before gaining full access.

5. Application Security

• Input validation and output encoding to guard against injection and cross-site scripting.
• Protection against cross-site request forgery (CSRF) on state-changing actions.
• Bot and abuse protection (including reCAPTCHA) on sensitive flows such as registration.
• Dependencies are kept up to date and reviewed for known vulnerabilities.
• Security-conscious development practices and code review before changes ship.

6. Monitoring & Incident Response

We maintain audit logs of significant account and data activity, including timestamps, user actions, and source information, to support accountability and investigations.

7. Third-Party & Vendor Security

We work with established providers that maintain their own robust security and compliance programs:

• Plaid — secure bank account connectivity. We receive tokenized access and do not store your banking login credentials.
• Stripe — PCI-compliant payment processing for subscriptions.
• SendGrid — authenticated email delivery (SPF/DKIM/DMARC) for transactional notifications.

We share information with these providers only as needed to deliver our services, and we review their security practices.

8. Compliance

We align our data handling with applicable U.S. financial and privacy regulations, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) safeguarding principles, and state privacy laws such as the CCPA/CPRA.

For details on how we collect, use, and share information — and your rights — please review our Privacy Policy and Terms of Service.

9. Responsible Disclosure

We welcome reports from security researchers. If you believe you've found a vulnerability in Access2Cap, please report it to us privately so we can investigate and remediate.

10. Your Role in Security

Security is a shared responsibility. You can help protect your account by:

• Using a strong, unique password and enabling two-factor authentication.
• Keeping your login credentials confidential and never sharing them.
• Being alert to phishing — Access2Cap will never ask for your password by email or phone.
• Signing out on shared devices and keeping your devices and browser up to date.
• Contacting us immediately if you notice suspicious account activity.

11. Contact