aWLCo Books

Security Policy

Effective June 27, 2026

Overview

aWLCo Books protects bookkeeping, bank, payment, and company financial data through limited access, encrypted tokens, managed infrastructure, and documented operational controls.

Access Control

Books uses role-based access by company workspace. Users are assigned only to the companies and roles they need. Access should be reviewed at least quarterly and removed when no longer needed.

Authentication

Users sign in with a six-digit email code and then complete authenticator-app two-factor authentication before accessing Books. Users may remember a trusted browser for 30 days after completing two-factor authentication. Administrative access to production services such as hosting, database, banking, and payment providers should use multi-factor authentication where supported.

Encryption And Secrets

Books is served over HTTPS. Production secrets are stored in managed environment variables, not source code. Bank access tokens are encrypted before storage.

Change Management

Code changes are made through the repository and deployed through Vercel. Important changes should pass type-checking, linting, production build checks, and review appropriate to the risk.

Vulnerability Management

Application dependencies are reviewed through dependency scanning and update review. Critical production issues should be prioritized and remediated based on severity and business risk.

Incident Response

If a security issue is suspected, aWLCo should limit affected access, preserve relevant records, rotate exposed secrets, review affected systems, notify affected parties or providers when appropriate, and document follow-up actions.