Security and confidentiality
Working version: 0.1 · No effective date
1. General approach
Protecting BlexSys Personal requires software controls, server configuration, human procedures and recovery. This document describes principles and does not constitute certification against a standard.
2. Identities and sessions
Passwords should be stored with suitable hashes and sessions limited in duration and privilege. The system should restrict repeated authentication attempts and protect session tokens in transit.
3. Authorization and isolation
Every read, create, update or delete action on financial data should check the signed-in user and corresponding ownership or permission. Household isolation must be tested with independent test accounts.
4. Receipts and uploads
Attachments require size and format limits, validation of actual file type, randomized stored filenames, prevention of script execution and download authorization. Private files should not be kept in publicly browsable paths.
5. Updates and changes
Official ZIP packages should be checked for version, internal paths and integrity before installation. Each update requires backup, regression checks, a change log and recovery planning.
6. Events and incidents
Sensitive events should be logged without passwords or complete financial records. Incidents should be investigated, contained, documented and disclosed where applicable laws require.
7. Providers, secrets and internal access
Server credentials, API keys and administrative accounts must be limited to authorized personnel. Third parties need contractual and technical controls proportionate to their access.
8. Limits and review
No document guarantees a system will never be attacked. Public security claims should be supported by current evidence, and procedures reviewed as infrastructure, code or markets change.