Information Security Policy

1Purpose

This policy is the governing document of Movik’s information security program. It states what Movik protects, who is accountable, and the controls every subordinate policy and procedure must implement. Movik advances funds against freight invoices and holds the financial records supporting those advances; a failure of confidentiality, integrity or availability in those systems causes direct financial loss to Movik and its customers. Security is therefore managed as an operating function rather than as a compliance exercise.

2Scope

This policy applies to all Movik personnel, contractors and service providers, and to all information and systems Movik owns, operates or controls — the application and its API, the production database, object storage, the AWS account, identity infrastructure, source control and the deployment pipeline, corporate communications and devices, and data held on Movik’s behalf by third-party providers. It applies regardless of location, device or employment status. Compliance is a condition of access to Movik systems.

3Policy set and document hierarchy

This policy sits above the documents below. Where a subordinate document addresses a subject in more detail, that document governs the detail and this policy governs the intent. Domains not carried by a standalone document are addressed directly in clauses 8 to 16 of this policy, which are binding on the same terms.

4Objectives

• Confidentiality. Customer financial information and personal information are disclosed only to those authorized to receive them.
• Integrity. Financial records and funding decisions are accurate, attributable and resistant to unauthorized modification.
• Availability. Carriers depend on Movik for working capital; the service and its records remain available and recoverable.
• Accountability. Privileged actions resolve to an individual, and security decisions are recorded with their rationale.
• Compliance. Movik meets the regulatory and contractual obligations applicable to its business, including those owed to its banking and data partners.

5Governance and responsibilities

Movik is a small organization and does not maintain separate security and engineering functions. Where separation of duties cannot be achieved by headcount, it is achieved by control: peer review of changes, logging that the actor cannot alter, and approval of exceptions by the Security Program Owner rather than by the implementer.

6Risk management

Movik maintains a risk register as the operational record of the program. Each entry records the asset and data involved, the threat, existing controls, residual risk, an owner and a review date.

• Risks are reassessed on a recurring cadence and on any triggering event: a new integration or data class, a provider change, an incident, a finding from testing, or a material architectural change.
• Treatment is recorded as mitigate, transfer, avoid or accept. Accepted risks name the person accepting them and the rationale, so acceptance is a decision rather than an omission.
• Findings from monitoring, testing, access reviews and incident post-mortems enter the register and are tracked to closure.

7Data classification and access

Movik classifies data as Restricted, Confidential, Internal or Public. The classification scheme, the handling rule for each class, the authorization model, privileged access, access reviews and offboarding are set out in the Access Controls Policy. Retention and disposal for each class are set out in the Data Retention and Disposal Policy. Those documents are binding parts of this program and are not restated here.

8Acceptable use

• Movik systems and data are used for Movik business. Personal use must not introduce risk to Movik data or systems.
• Credentials are individual and must not be shared, reused across systems, or stored outside an approved password manager.
• Restricted or Confidential data must not be copied to personal accounts, personal devices, unapproved cloud storage, or unapproved third-party tools, including general-purpose AI services.
• Devices accessing production systems or Restricted data must have full-disk encryption, an enforced screen lock, and current operating system and browser versions. Production access from shared or public devices is prohibited.
• Attempting to circumvent a security control, or accessing data without a business need, is a disciplinary matter regardless of intent.

9Cryptography and key management

• Data in transit is protected with TLS 1.2 or higher. Plaintext HTTP is redirected and HTTP Strict Transport Security is set. Internal service-to-service calls are likewise encrypted in transit.
• Data at rest is encrypted with AES-256 — the production database, object storage and backups — using keys managed by AWS Key Management Service.
• Movik implements no bespoke cryptography. Algorithms, protocols and libraries are those provided by the platform and by maintained, widely reviewed dependencies.
• Passwords are never stored by Movik in any form; authentication uses a zero-knowledge exchange as described in the Access Controls Policy. Token signatures are verified asymmetrically against the identity provider’s published keys.
• Keys, credentials and signing material are held as managed environment secrets, are not committed to source control, are not included in client-side bundles, and are rotated on a defined schedule and on suspected exposure.

10Secure development and change management

11Infrastructure and network security

• Movik operates entirely on Amazon Web Services and maintains no data centers or physical server infrastructure. Physical and environmental controls are inherited from AWS, whose facilities are covered by SOC 1, SOC 2, SOC 3, ISO 27001 and PCI DSS attestations.
• Public traffic terminates at a content delivery edge that absorbs volumetric and protocol denial-of-service traffic before it reaches application capacity, with network and transport layer protection always on.
• A web application firewall fronts the application with managed rule sets for common exploits and rate-based rules that throttle abusive sources.
• The production database is not reachable from the public internet. Application servers reach it over private network paths, and administrative access is restricted and logged.
• Cloud entitlements follow least privilege using scoped, role-assumed credentials rather than long-lived shared keys.
• Unauthenticated and sensitive endpoints are protected by an automated abuse assessment verified server-side on both risk score and declared action.

12Logging and monitoring

Application and infrastructure events are logged centrally in AWS with defined retention. Security-relevant events — authentication failures, authorization denials, privileged and administrative actions, support sessions taken on a customer’s behalf, and configuration changes — are captured and alerted on. Logs are scrubbed of secrets and sensitive values before they are written, access to logs is restricted by role, and log retention is governed by the Data Retention and Disposal Policy.

13Incident response

Movik maintains an Incident Response Plan. This clause states the requirements that plan implements.

• All personnel must report a suspected incident immediately on discovery, without first establishing whether it is genuine. Reports go to the Security Program Owner or to support@movik.us.
• Incidents are classified by severity, which determines response time, who is engaged, and whether an incident is declared formally.
• Response follows detection, containment, eradication and recovery, with evidence preserved for investigation before remediation destroys it.
• Where an incident affects customer or partner data, Movik notifies affected customers, partners and regulators without undue delay and within the timelines its agreements and applicable law require. Notification obligations owed to banking and data partners are met on the schedule those agreements specify.
• Every declared incident receives a post-incident review producing corrective actions with owners and dates, tracked in the risk register. Reviews address cause, not blame.

14Business continuity and disaster recovery

Movik maintains a Business Continuity and Disaster Recovery Plan with documented recovery objectives. This clause states its requirements.

• The production database is backed up automatically and encrypted, with point-in-time recovery. Restores are tested rather than assumed.
• Application infrastructure is managed and reproducible from source, so recovery is a deployment rather than a reconstruction.
• The plan addresses loss of an availability zone or region, loss of a critical provider, and loss of key personnel, and identifies the manual process that sustains customer funding obligations while systems are unavailable.
• Recovery objectives and the plan are reviewed at least annually and after any event that invokes them.

15Vendor and third-party management

• Providers are assessed before onboarding against their security posture, available attestations, the data they require, and the contractual terms they will accept. A provider that cannot meet the obligations of this program is not used for data in scope of it.
• Each provider receives only the data its function requires, and providers have no standing access to Movik production systems. Support access, where required, is time-boxed, supervised and revoked on completion.
• Agreements require providers to process Movik data only on instruction, to notify Movik of security incidents affecting that data, and to delete or return it on termination.
• Providers are reassessed periodically and on any material change to the service or the data they hold. Provider administrative consoles are treated as production systems under the Access Controls Policy.
• Movik does not sell customer data.

16Personnel security

• Personnel are subject to written confidentiality obligations covering Movik and customer information, surviving the end of the engagement.
• Background screening is performed where permitted by law and proportionate to the role, for roles with access to Restricted data or production systems.
• Access is provisioned on a need-to-know basis at hire, re-derived on a change of role, and revoked on departure under the Access Controls Policy.
• Security and phishing awareness training is completed on hire and at least annually, and on any material revision to this policy. Completion is recorded.

17Compliance obligations

Movik’s obligations arise from its business as a commercial freight financier and from its partner agreements. The program is maintained against the Gramm-Leach-Bliley Act Safeguards Rule; the Fair Credit Reporting Act and the FTC Disposal Rule where a consumer report is obtained; the Telephone Consumer Protection Act for messaging consent; state consumer privacy laws conferring access and deletion rights, to the extent applicable; federal and state recordkeeping requirements for financial records; and the security and notification terms of Movik’s banking, payments and data provider agreements. Movik holds no security attestation of its own at this time; obtaining third-party attestation of the controls in this program is a stated objective of the program roadmap.

18Exceptions

Any deviation from this policy or a subordinate document requires written approval from the Security Program Owner before the deviation occurs, or immediately after where an incident forced it. Exceptions are recorded in the risk register with the reason, the data and systems affected, a compensating control, an owner and an expiry date. Exceptions are reviewed at each cycle and are not renewed by default.

19Enforcement

Personnel are made aware of this policy on hire and at each material revision, and acknowledge it. Non-compliance may result in withdrawal of access and disciplinary action up to and including termination, and may be referred to law enforcement where the conduct warrants it. Contractor and provider non-compliance is handled under the relevant agreement.

20Review and maintenance

The Security Program Owner reviews this policy and the documents in clause 3 at least annually, and additionally on any material change to Movik’s architecture, data flows, provider set, regulatory obligations or risk profile. The review confirms that each clause still reflects operating practice; a clause that no longer does is corrected or removed rather than left aspirational. Revisions are versioned and the effective date in the document control block reflects the current version.

Questions about this policy or Movik’s security program: support@movik.us.