Information Security Policy, Solutions Sparkops Inc.

Effective October 9, 2026, reviewed every year.

1. Scope: our clients' data and the company's financial data, including bank data read through Plaid.
2. Owner: Carlos Martins, President, carlos@sparkops.ca. He is also responsible for the protection of personal information.
3. Access: every access is individual and limited to what is needed.
4. Workstations: encrypted disk, firewall enabled, automatic security updates, session locked when unattended.
5. Secrets: API keys and tokens are kept outside any code repository, in files readable only by their owner. Never sent by email. Revoked at the slightest doubt.
6. Automation: our software agents have only the access they need. None of them signs in on a person's behalf or makes a payment.
7. Bank data: read-only access, no automated money movement.
8. Transmission: always encrypted, with TLS 1.2 or better, through recognized cloud providers.
9. Retention: accounting records are kept for six years, as required by tax law, then deleted. Bank access that is no longer used is revoked.
10. Incidents: every incident is logged. A confidentiality incident that presents a risk of serious injury is reported to the Commission d'accès à l'information and to the persons concerned.