1. Purpose and scope
This policy describes how ETL Group LLC ("ETL Group", "we") protects the information and systems it uses to run its transportation businesses and internal software. It covers all company systems, cloud services, devices and people with access to them, including the internal tools that connect to our own financial accounts through Plaid.
2. Responsibility
Information security is owned by Amon Safarov, Owner (amon@etlgroupllc.com). The owner approves this policy, decides on access, and is the contact for security questions and incident reports.
3. Risk management
We identify risks to our data and systems, decide how to reduce them, and monitor for problems. Automated checks review uptime, email authentication (DMARC/SPF/DKIM), user accounts and application errors daily, and findings are reported to the owner. Risks are reassessed when we add a new system, vendor or data source.
4. Access control
- Access is granted on a least-privilege, need-to-know basis and is tied to a named individual; shared accounts are avoided.
- Production systems sit behind a private network (VPN) and are not exposed to the public internet unless they must be.
- Changes to accounts, permissions and production systems made through our automation require the owner's explicit approval before they run, and every request and outcome is logged.
- Access is reviewed regularly; accounts of people who leave or no longer need access are suspended or removed promptly.
5. Authentication
Multi-factor authentication (MFA) is required on all systems that hold company or financial data, including email and identity (Google Workspace), banking, the password manager and cloud consoles. Credentials are stored in a password manager or in access-restricted secret stores, never in source code or chat.
6. Encryption
- In transit: all traffic between clients and our services uses TLS 1.2 or higher.
- At rest: financial account access tokens and data received from Plaid are stored encrypted, with the encryption key kept separately from the data and readable only by the service that needs it.
7. Vulnerability and patch management
We follow security advisories and news for the software and services we use. When a significant vulnerability is disclosed, we assess whether we are affected and patch, mitigate or reconfigure promptly. Operating systems, dependencies and services are kept on supported, updated versions, and application errors are monitored centrally.
8. Data handling and retention
We collect only the data we need. Financial data obtained through Plaid is limited to ETL Group's own accounts and is used only for internal analysis. It is not sold or shared with third parties. A bank connection can be removed at any time, which revokes access and deletes the stored access token. See the Privacy Policy for details.
9. Vendors
We use established providers (for example Google Workspace, Amazon Web Services and Plaid) and give each only the access it needs.
10. Incident response
Suspected security incidents are reported to amon@etlgroupllc.com immediately. We contain the issue (for example by revoking sessions, resetting credentials or disconnecting integrations), investigate, fix the cause and notify affected parties and partners, including Plaid, as required.