Security Policy

Security Governance

Nellson Associates, LLC is an owner-operated company. Responsibility for information security rests with the owner (Jonathan Nellson, jon@nellson.net), who is also the only person with access to production systems. The practices on this page are the company's operating security policy: they are enforced directly in the engineering workflow, verified by automated tests where practical, and reviewed as the platform changes.

Access Control & Authentication

• Least privilege. Access to production infrastructure is limited to the owner. Staff-only site functions are gated by role-based access control.
• Multi-factor authentication. Administrative and infrastructure accounts — source control, cloud hosting, and financial-data providers — require multi-factor authentication.
• Service credentials. Non-human access (deployments, service-to-service calls) uses scoped tokens and platform-managed credentials, never shared passwords.
• Member sign-in. Members authenticate with one-time email verification codes protected by bot detection; no member passwords are created or stored. Sessions use HttpOnly, SameSite cookies.
• Future bank connections. Any future feature that lets members connect financial accounts will require additional step-up authentication before it launches.

Data Protection & Encryption

• All traffic to and from the site is encrypted in transit with TLS.
• Data is stored in managed cloud databases with encryption at rest.
• Secrets and credentials live in restricted configuration stores, never in source control.
• Payment card details are entered directly into our payment processor's secure form and are never stored on our servers.

Member Data Isolation

Every member-owned record is scoped to its owning account. Access checks are enforced in the application on every read, write, and delete, and these boundaries are covered by automated tests that run before every deployment. Member data never appears in example content, templates, or administrative screens.

Financial Data & Bank Connections

• Our money-management tools provide educational modeling only. The platform never initiates payments, trades, or transfers — nothing moves money.
• Where bank data is used, it is accessed read-only through regulated data aggregators.
• Aggregator access tokens are held in restricted stores with least-privilege scope. Bank connections are currently operator-managed and are not exposed to members.

Secure Development & Change Management

• All changes flow through version control and pass an automated test suite before deployment; deployments are automated and repeatable.
• Dependencies are kept current and patched as updates are published.
• Security-sensitive changes receive dedicated review before release.

Incident Response

The company maintains a documented incident-response runbook in its engineering repository. If an incident affects your data, we will notify you promptly, consistent with applicable law. To report a security concern, email jon@nellson.net.

Reporting a Vulnerability

We welcome good-faith security research. If you believe you have found a vulnerability, email jon@nellson.net with enough detail to reproduce it. We will acknowledge your report, investigate, and will not pursue legal action against good-faith research conducted without harming member data or service availability.

Your Data Rights

How we collect and use personal information is described in our Privacy Policy. You may request deletion of your account data by emailing jon@nellson.net, and members can delete their own saved money-management scenarios directly in the tools.