Owner: The owner and sole operator (Alpha Covenant Holdings LLC, a Pennsylvania limited liability company, entity 0016032097). Version 2026-10-04. This document describes controls actually in place; where a control is absent it says so. Other policies: Information Security Policy · Incident Response Plan · Change Management Policy.
Least privilege and no shared accounts. Public routes read public records and need no account. Customer routes (watches, rosters, partner API) are keyed to the email or API key that created them. Operator routes change the platform and are limited to the owner.
Operator routes require a signed session issued to the owner's address. Deployments are made through the hosting provider's console under the owner's account. The owner's accounts for hosting, DNS, Stripe, email sending, YouTube and SAM.gov use provider MFA where the provider offers it; the platform cannot verify this from the inside and does not claim it for providers that do not offer MFA.
Partner API keys are generated once, shown once, and stored as SHA-256 hashes with a four-character hint; tier and rate limits are enforced per key; revocation is immediate. Receipt Watch and roster actions use signed links sent to the owning email. No passwords are stored for customers.
Internal and automated traffic is excluded from visit counts by a browser flag or request header; this is a measurement control, not a security boundary.
The partner-key list and the operator session list are reviewed by the owner monthly; revoked and expired entries are kept for the audit trail. There are no contractor or employee accounts to review.
On a partner's request or non-payment, keys are revoked the same day; receipts already issued remain valid records and are not deleted, because a receipt is a dated statement of what a file printed.
Last reviewed 2026-10-04.
Evidence surfaces: /audit · /trust · software bill of materials · registry freshness.