Cybersecurity Policy

This cybersecurity policy summarizes the administrative, technical, and operational safeguards BiasCoin uses to protect its website, API, account system, data pipeline, and user-directed automation product.

This policy is intended for commercial diligence and partner review. It should be reviewed by counsel and updated as BiasCoin's infrastructure, vendors, and compliance obligations evolve.

BiasCoin classifies data by sensitivity and business impact, including public website content, internal operational records, customer account data, billing metadata, brokerage-linked operational data, credentials, secrets, and security logs.

Sensitive data is limited to authorized business purposes, retained only as reasonably necessary, and handled through approved systems. Production data should not be copied to unmanaged devices, personal accounts, or non-production environments unless it has been appropriately minimized or sanitized.

Access to production systems, cloud resources, source control, billing systems, databases, and administrative tooling is granted based on least privilege and business need.

Privileged access should use unique user accounts, strong authentication, and periodic access review. Shared accounts are avoided where practical, and credentials or tokens must be revoked promptly when access is no longer required.

BiasCoin uses encryption in transit for website, API, and administrative traffic through HTTPS/TLS where supported by the hosting and service providers.

Sensitive secrets, OAuth tokens, and similarly confidential values are stored encrypted at rest or in managed secret storage. Database, storage, and backup encryption are handled through the applicable cloud, database, or platform security controls.

BiasCoin monitors application dependencies, infrastructure components, and managed services for security updates and known vulnerabilities using available package, platform, and provider tooling.

Security patches are prioritized based on severity, exploitability, exposure, and business impact. Critical vulnerabilities affecting internet-facing or privileged systems should be remediated as quickly as practical, with compensating controls considered when immediate patching is not possible.

BiasCoin maintains an incident response process for identifying, triaging, containing, investigating, and remediating suspected security events, including unauthorized access, credential exposure, service abuse, data loss, and suspicious production activity.

Incident response activities may include disabling affected credentials, isolating systems, preserving logs, notifying affected parties or vendors where appropriate, and documenting corrective actions.

Disaster recovery relies on managed infrastructure controls, source control, redeployable application code, database backups or exports where configured, and vendor recovery capabilities.

BiasCoin does not operate its own data centers. Physical security for hosted application infrastructure, databases, storage, and managed services is provided by the applicable cloud and service providers.

Company devices used for administrative access should use operating system security controls such as screen lock, disk encryption where available, and timely security updates.

BiasCoin relies on third-party providers for hosting, payment processing, data services, communications, brokerage connectivity, analytics, security tooling, and other operational needs.

Vendors are evaluated based on the sensitivity of data processed, service criticality, contractual obligations, security posture, availability, and regulatory or customer requirements. Vendor access and integrations should be limited to the minimum data and permissions required for the service.

Security responsibilities include maintaining secure development practices, protecting secrets, reviewing sensitive changes, logging important operational events, and promptly addressing security defects.

This policy should be reviewed periodically and updated after material architecture changes, new vendor relationships, significant incidents, or changes in applicable customer, legal, or regulatory obligations.