● Zero-Trust Security & Consumer Deletion Instructions

Information Security Architecture & Data Deletion Guide

Security Officer: Brian Clark (support@blackdogstrategy.ai) | Standards: SOC 2, NIST SP 800-63B, NIST SP 800-88 R1, SEC Rule 17a-4

1. Enterprise Encryption & Zero-Trust Controls

Encryption in Transit & at Rest: All traffic enforces HTTPS / TLS 1.3. All aggregator access tokens and sensitive fields are encrypted at rest using symmetric AES Fernet cryptographic vaults backed by Google Cloud KMS / Secret Manager.
Phishing-Resistant MFA Gate: Consumer sessions require 6-digit TOTP or WebAuthn Passkey biometric verification plus explicit CFPB Section 1033 consent before Plaid Link can be initialized.
Cryptographic Webhook Verification: All inbound Plaid webhooks are verified using ES256 asymmetric JWK signatures, constant-time SHA-256 payload verification, and a strict 300-second anti-replay window.

You have absolute control over your connected financial accounts:

Self-Service Instant Purge: Visit the Client Security Portal and click "Disconnect & Delete My Data" next to any linked institution. HeldAway immediately invokes Plaid's /item/remove API, erases your tokens and transactions, and returns a verifiable SHA-256 NIST 800-88 Disposal Certificate.
Email Request: Email support@blackdogstrategy.ai from your registered email address; requests are processed within 24 hours.