Information Security

Overview

J&J Collins Technologies LLC operates Collins-Expenz with administrative, technical, and organizational controls designed to protect workspace data, receipts, and financial integration credentials. This page summarizes our Information Security Policy for customers, partners, and auditors.

Security contact: privacy@expenz.app. See also our Privacy Policy.

Policy effective August 6, 2026. Next review August 6, 2027.

Access control

• Application access — Clerk authentication with multi-factor verification (email one-time passcode) in production before users access the service, including bank connection flows.
• Role-based access — Workspace roles (owner, accountant, employee, viewer) limit who can view, approve, or manage integrations.
• Least privilege — Production infrastructure access is limited to authorized administrators with individual accounts and MFA.
• Tenant isolation — Each customer workspace is logically separated in the application and database.

Encryption and data protection

• In transit — All web and API traffic uses HTTPS (TLS 1.2 or higher).
• Integration tokens — Plaid and QuickBooks access tokens are encrypted at the application layer (AES-256-GCM) before storage.
• Receipts — Stored in private cloud object storage; not publicly accessible.
• Database — PostgreSQL hosted on a managed provider with provider-managed encryption at rest.

Financial account connections (Plaid)

Bank and card linking is optional and user-initiated through Plaid Link. We do not receive or store online banking passwords. Connection credentials are encrypted at rest. Users may disconnect accounts from the Accounts area at any time. See the Privacy Policy for data handling details.

Infrastructure and vendors

We use established subprocessors to operate the service, including:

• Clerk — authentication and organization membership
• Plaid — bank and card account linking (when enabled by the user)
• Intuit QuickBooks — accounting sync (when connected)
• Render — application hosting and PostgreSQL
• Cloudflare — receipt object storage

New vendors that process customer or financial data require security review before production use.

Vulnerability management

We identify and remediate security issues through:

• Dependency monitoring (npm audit, GitHub Dependabot)
• Managed cloud provider patching for infrastructure
• Operating-system security updates on administrator workstations

Remediation targets:

• Critical — 7 calendar days
• High — 30 calendar days
• Medium — 90 calendar days

End-of-life software (Node.js LTS, dependencies, database versions) is reviewed at least quarterly.

Access reviews and offboarding

Production system access is reviewed quarterly. When personnel leave or change roles, administrative and application access is revoked within 48 hours using a documented offboarding checklist.

Zero trust principles

We apply zero-trust principles appropriate to our scale: verify users explicitly (MFA), enforce least privilege, encrypt sensitive credentials, and avoid shared production accounts. Customer data is accessed through authenticated application APIs, not open database endpoints.

Secure development

• Source code in Git with reviewed changes deployed from the main branch
• Database migrations applied in the production pre-deploy step
• Secrets stored in environment configuration, never in source control
• Development authentication bypass disabled in production

Incident response

Suspected security incidents should be reported immediately to privacy@expenz.app. We contain affected access, assess scope, notify affected customers and partners when required, remediate root causes, and update controls as needed.

Policy review

This policy and related practices are reviewed at least annually and after material product or security changes. Personnel with production access acknowledge security requirements when access is granted.