Owner: The owner and sole operator (Alpha Covenant Holdings LLC, a Pennsylvania limited liability company, entity 0016032097). Version 2026-10-04. This document describes controls actually in place; where a control is absent it says so. Other policies: Access Control Policy · Incident Response Plan · Change Management Policy.
This policy covers the Alpha Covenant Holdings platform: the FastAPI backend, React frontend, MongoDB database, scheduled jobs and the public-record files it holds. It covers the one person who operates it. It does not cover the hosting provider's own controls, which are the provider's (see Hosting).
Three classes. Public-record content (agency files and the rows a receipt prints): public by origin. Customer-submitted data (names, keys, roster CSVs, contact emails, webhook URLs): confidential; held only for the purpose submitted. Operator secrets (API keys, signing keys, database URL): restricted; held in the hosting provider's environment settings, never in the repository or in chat.
The platform runs on Emergent's managed Kubernetes hosting. Encryption in transit is TLS at the edge for every public route. Encryption at rest, physical security, hypervisor patching and network segmentation are the provider's controls and we hold no attestation for them; a reviewer who needs one should ask us for the provider's documentation and we will forward what the provider publishes. We do not claim SOC 2, ISO 27001 or HITRUST.
See the Access Control Policy. One operator account; no shared credentials; operator routes require a signed session; partner API keys are hashed at rest (SHA-256) and shown once.
Secrets live in environment settings. The repository is scanned for secrets before each release (see Change Management). Keys are rotated when a provider reports exposure or when the operator has reason to; rotation is recorded in the change log.
Every receipt is recorded in a registry with its SHA-256 and time. Sentinel (every 15 minutes) checks service health, job backlogs, disk, source silence and disclosure surfaces, heals what it can and records every finding publicly at /audit. The daily self-audit recomputes registry hashes and anchors the day's archive with OpenTimestamps. Dependency vulnerability scans (pip-audit, yarn audit) run weekly and their results are published.
Weekly automated scans; findings rated by the scanner's severity. Critical and high findings are patched or mitigated within 7 days of detection, medium within 30, low at the next release. If a fix is not available the finding and the mitigation are written into the scan record.
MongoDB is backed up by the hosting provider. The platform additionally keeps rolling local backups of its own collections under a size cap; the public-record files it holds are re-fetched from source and are not the system of record for anything. Recovery objective: a fresh deployment from the repository plus the latest database backup; the operator has rehearsed a redeploy and a local restore drill, not a restore from the provider's backup — that gap is open. Since 2026-10-25 a daily manifest of registered receipt hashes and the signed log head is written off-site to a Backblaze B2 bucket under Object Lock COMPLIANCE retention (7 years), so a restored database can be checked against hashes locked outside this host (SOP-12; /api/public/offsite-copies).
One operator. There is no CTO, CIO or security officer other than the owner. This is a key-person risk and we say so; a successor-operator note (where the code, keys and runbooks are) is kept with the owner's records.
This policy is reviewed by the owner at least annually and when the architecture changes. Last reviewed 2026-10-04.
Evidence surfaces: /audit · /trust · software bill of materials · registry freshness.