Information Security Policy & Procedures

Organization: Craftsman Painter, Inc. / Brush OS
Designated Security Officer: Torlando Hakes, President (torlando@craftsmanpainter.com)
Effective Date: February 3, 2026 | Last Reviewed & Operationalized: October 21, 2026

1. Purpose & Organizational Scope

Craftsman Painter, Inc. ("Craftsman Painter", "we", "us", or "Brush OS") is dedicated to maintaining industry-leading standards of data privacy, operational resilience, and banking security. This Information Security Policy defines the formal administrative, physical, and technical controls enforced across the Brush OS application ecosystem, including all AI/agentic pipelines, Treasury, Cash Flow, and financial data processing pipelines.

2. Security Governance & Roles

Security governance is actively managed at the executive level:

• Executive Oversight: Torlando Hakes, President, serves as the designated Information Security Officer responsible for security oversight, operational risk mitigation, and compliance enforcement.
• Annual Review: This security policy and all associated operational procedures undergo formal review and re-certification at least annually or upon significant architecture updates.
• Incident Response Team: The executive security team monitors threats and coordinates immediate containment and notification activities in the event of security incidents.

3. Financial Data & Banking API Integrations (Plaid)

Brush OS integrates with Plaid Inc. to provide automated bank account balance tracking and transaction synchronization for commercial painters. The following strict boundaries are operationalized:

• Zero Credential Ingestion: Brush OS does not collect, process, or store plain-text banking credentials, account passwords, or MFA codes. User authentication is conducted directly between the user and their financial institution via Plaid Link's secure interface.
• Restricted Tokenization: Plaid returns an encrypted, scoped access token that allows read-only transaction queries. Access tokens are stored in protected, server-side secret datastores and are never exposed to client browsers.
• Data Minimization: Only authorized business bank account summaries and transaction records relevant to cash flow distribution are retrieved.

4. Cryptographic Safeguards & Data Protection

• In Transit: All web traffic and API endpoints strictly mandate TLS 1.3/TLS 1.2 encryption with modern cipher suites. HTTP Strict Transport Security (HSTS) with preloading is enforced across all endpoints.
• At Rest: All databases, persistence volumes, and cloud logs are encrypted at rest using AES-256 encryption managed via Google Cloud Key Management Service (KMS).
• Key Management: Production API keys and database credentials are isolated through environment secrets and strict IAM access controls with continuous rotation capabilities.

5. Access Control & Identity Architecture

• Principle of Least Privilege (PoLP): Access to cloud resources, internal databases, and source code repositories is limited strictly to authorized personnel required for operational duties.
• Multi-Factor Authentication (MFA): MFA is required for all administrative access across Google Cloud, Firebase, and DNS management.
• Cryptographic Authentication: Client sessions use signed, expiring JSON Web Tokens (JWT).

6. Vulnerability Management & Threat Monitoring

We conduct automated vulnerability assessments across our codebases and dependencies on every continuous integration deployment. Google Cloud Armor, Cloud Audit Logging, and monitoring alerts are deployed to identify and neutralize anomalous activity, DDoS threats, and unauthorized access attempts.

7. Incident Response & 72-Hour Breach Notification

Craftsman Painter maintains a tested four-phase Incident Response Plan:

1. Identification: Continuous monitoring and automated threshold alerting.
2. Containment: Immediate isolation of affected components and credential invalidation.
3. Eradication & Recovery: Vulnerability resolution, forensic validation, and safe state restoration.
4. Mandatory Notification: In the event of a verified breach affecting personal or financial data, Craftsman Painter commits to notifying affected partners, customers, and regulatory authorities within 72 hours.

8. Data Retention, Revocation & Deletion

Users retain sovereignty over their financial connections. Disconnecting a banking connection in Brush OS immediately revokes the Plaid access token. Organizations may request complete erasure of historical transaction records at any time.

9. Agentic AI Governance & Responsible Use Guardrails

In alignment with the Google Cloud Agentic AI Responsible Use Guidelines, Google Cloud Platform Service Specific Terms (Sections 14, 15, 19, and 20), and Google Cloud Terms of Service (Sections 3.3 and 13.2) effective October 12, 2026, Craftsman Painter, Inc. enforces the following technical and administrative guardrails across all AI and autonomous agent workflows:

• Human-in-the-Loop (HITL) Authorization Gates: Autonomous and semi-autonomous agents (including SMS/voice estimating assistants, 3D LiDAR spatial calculators, and scheduling tools) operate strictly as decision-support systems. High-consequence actions—including binding customer contract execution, Change Order approvals, treasury fund transfers, and operator payout/commission releases—require explicit human-in-the-loop verification and cryptographic authorization.
• Scoped Tool Execution & Least Privilege: Agent tool calls are restricted to explicitly declared, schema-validated functions with read/propose boundaries. AI agents cannot bypass role-based access controls, modify production security rules, or access raw banking credentials.
• Prompt-Injection Defense & Abuse Monitoring: All external inputs submitted to customer-facing or internal AI endpoints undergo input validation, rate limiting, safety filtering, and audit logging to detect and block prompt injection, jailbreaking, automated scraping, or prohibited use under the Google Cloud Acceptable Use Policy and Generative AI Prohibited Use Policy.
• Intellectual Property & Data Isolation: Customer inputs and enterprise financial records processed via Google Cloud / Vertex AI / Gemini APIs remain isolated within our enterprise environment and are never sold or shared with third parties for advertising or external model training.