Legal
Information Security Policy
Public summary
Version 0.1 draft · Last updated September 7, 2026
This is the public summary of Rekoup's Information Security Policy. It condenses each section of the internal policy into one paragraph and names no internal systems.
Scope
The policy covers every system that stores, processes, or transmits merchant data, including the merchant dashboard, the hosted checkout, the API, the sensors that read bank and email data, and the infrastructure consoles that operate them. It applies to every person with access, including contractors.
Governance
A named Security Officer owns the policy, reviews it at least annually, and is the contact for security matters at security@rekoup.app. Material changes to systems or data handling require the Security Officer's review before release.
Access control and MFA
Access is granted on least privilege and reviewed quarterly. Phishing-resistant multi-factor authentication is required on every infrastructure console and on the merchant dashboard. Shared accounts are prohibited. Access is revoked the day a person's role ends.
Encryption
All traffic uses TLS 1.2 or better. All stored data is encrypted at rest by the hosting providers. Bank aggregator access tokens are encrypted a second time at the application layer with a key held outside the database, so a database read alone cannot expose them.
Bank data handling and minimization
Rekoup requests only transaction data for the accounts a merchant connects: date, amount, description, sender name, and account mask. It does not request balances, identity, income, or credentials. Data is used only to confirm payments and show merchants their own activity, and is never shared between merchants.
Secure development
Changes are reviewed before merge, tested automatically, and deployed through a managed pipeline. Secrets live only in the hosting provider's encrypted store. Money-affecting writes use compare-and-swap so they cannot apply twice, and any ambiguous match fails closed into a review queue.
Vulnerability and patch SLA
Dependencies are monitored continuously. Critical vulnerabilities are patched within 7 days, high within 30, and medium within 90. Good-faith security research is welcomed and acknowledged within one business day.
Logging
Application and access logs are structured, retained for operational and audit purposes, and never contain credentials, tokens, or full account numbers. Every confirmation records what arrived, from which sensor, which rule matched it, and when.
Incident response and notification
Incidents are triaged by the Security Officer, contained, and documented. Merchants and providers affected by an incident involving their data are notified without undue delay and within 72 hours of confirmation.
Vendor management
Vendors that handle merchant data are reviewed before adoption and at renewal for their security posture and data terms. The bank data aggregator is named in the Privacy Policy.
Retention and deletion
Unmatched raw bank data is deleted after 90 days. Matched payment records are retained for the life of the account and as the law requires. Aggregator tokens are deleted when an account is disconnected. Deletion requests are completed within 30 days.
Review cadence
The policy, access lists, and vendor list are reviewed quarterly. The full policy is reviewed annually or after any material incident.