Information Security Policy

1. Purpose and scope

This policy sets the security requirements for linkhaus, LLC and its hosted creator platform. It covers company systems, personnel and service providers with access to company data, including creator accounts, imported content, product and affiliate links, platform authorization tokens, and earnings information. It applies throughout collection, use, storage, sharing, and deletion.

2. Ownership and review

The company owner is responsible for this policy, access decisions, security issues, and coordinating incident response. This policy must be reviewed at least annually and whenever material changes occur in the product, infrastructure, data use, or platform requirements. Exceptions must be documented with a reason, responsible owner, and review date.

3. Access and account protection

Administrative access must be limited to authorized people who need it for their work, reviewed when responsibilities change, and removed when no longer needed. Multi-factor authentication must be enabled on administrative services that support it. Company devices used for administration must use disk encryption, screen locking, and supported software with security updates.

Creator access is authenticated, and application data access is scoped to the creator account. Passwords are stored as hashes. Supported platform connections use OAuth so creators authorize access without giving Linkhaus their platform passwords.

4. Credentials and data protection

Platform access and refresh tokens stored by the application are encrypted. Application secrets must be kept in restricted runtime configuration or a secret-management service and excluded from source control, public pages, and diagnostic output. Exposed credentials must be revoked or rotated.

Public website traffic uses HTTPS. Sensitive data must use encrypted connections and access-controlled storage. Access to production data must be limited to operating, supporting, and securing the service. Public creator guides intentionally expose the content and links selected for publication; private account credentials and earnings must not appear in those guides.

5. Hosting and application safeguards

Linkhaus uses managed cloud services, including Google Cloud Run and Cloud Storage, Neon, and Vercel. Public application pages are separated from authenticated account functions through application access controls. Administrative access to hosting and data services must be restricted. This is not a claim that every service runs within a private network.

The application includes request-origin checks for applicable state-changing requests, authentication rate limits, and account-scoped data access. Code and dependency changes must be reviewed for security impact and checked before release. Suspected vulnerabilities must be assessed and addressed according to their severity.

6. Data use, retention, and service providers

Data must be collected and accessed only for supported product features, authorized integrations, support, and security. Platform permissions must be limited to the features being provided. Service providers must be assessed for the data they receive and the controls relevant to that service.

Retention and deletion must follow the purpose of processing, applicable platform requirements, and the Privacy Policy. Requests to disconnect platforms or delete accounts must be handled through the available product controls or support. Backup and recovery arrangements must be reviewed for the systems holding production data; restoration procedures must be documented and checked after material changes.

7. Security incidents

Suspected unauthorized access, exposed credentials, data loss, or service compromise must be reported promptly to shie@linkhaus.ai. The owner must assess impact, contain access, preserve relevant evidence, rotate affected credentials where appropriate, and coordinate recovery. Affected users, platform partners, or authorities must be notified where required by applicable obligations. The response and corrective actions must be documented and reviewed.

8. Contact and related information

For security reports or questions about this policy, contact shie@linkhaus.ai. Please describe the issue without including passwords, access tokens, or unnecessary personal data. This policy establishes company requirements; it is not a statement of independent certification or a guarantee that incidents cannot occur. See our Privacy Policy for information about personal data and deletion requests.