Daily Operations Security Baseline
linkhaus, LLC · Effective November 4, 2026 · Owner: Company owner · Review: At least annually
This policy establishes operating requirements. Implementation evidence, configuration records, and completed reviews are maintained separately; publication alone is not proof that every control has been implemented or audited.
Accounts and authentication
Personnel and contractors with access to Linkhaus systems must use individual accounts where available, unique passwords, and a password manager. Administrator passwords must be at least 14 characters where the service supports that length, must not be reused, and must satisfy any additional provider requirements. Multi-factor authentication must be enabled on administrative email, cloud, source-control, and hosting accounts wherever supported. Suspected exposed credentials must be replaced promptly.
Workplace and device controls
Devices must lock automatically after no more than 15 minutes of inactivity and require authentication to unlock. Personnel must lock screens when leaving a device unattended. Sensitive paperwork and removable media must be secured when not in use and disposed of securely. Credentials and customer information must not be left visible on desks, shared screens, or public displays.
Daily administration
Use supported and updated devices, encrypted storage, approved software, and access-controlled networks. Production secrets must be excluded from source control and public documents. Production changes must be traceable, reviewed for impact, and checked before release. Data exports and temporary files must be limited to the task and removed when no longer needed.
Verification and exceptions
The owner must check this baseline when granting access and at least quarterly, keeping records of account MFA, device protections, and exceptions. Exceptions require a reason, compensating safeguards, an owner, and an expiry date. These are required operating standards, not a statement that every device or account has been independently audited.
Exceptions require owner approval, documented safeguards, and a review date. Contact: shie@linkhaus.ai.