Information Security & Data Retention Policy

1.1Passwords are hashed and account requests use signed sessions. External OTC credentials are server-side only. These measures do not establish a complete security audit or certification.

2.1Compliance evidence and identity documents must be private, least-privilege restricted and access-audited. Do not upload identity documents until an approved private verification workflow is available.

3.1A qualified retention schedule must cover financial, support and identity records, legal holds, deletion and incident handling. Security gaps and provider setup remain launch blockers; no ISO or other certification is claimed.