Security Incident Response Plan

Owner: Capalty LLC / MonthlyIQ. Security owner: Eric Zhivalyuk, Founder (security@monthlyiq.com). Effective September 27, 2026.

Suspected unauthorized access; compromised credentials; exposed API keys or Plaid tokens; malware; data exfiltration; cross-user data access; lost or compromised devices with production access; material service-provider incidents; and accidental disclosure of consumer financial information.

The designated security owner coordinates response, assigns technical remediation, maintains the incident record, and coordinates legal, consumer, vendor, regulator and contractual notifications.

• Identify and triage: record time, source, systems, data potentially affected, and severity.
• Contain: disable compromised accounts, revoke sessions, rotate credentials, isolate systems, block malicious access, preserve evidence.
• Investigate: determine root cause, scope, affected users and data, duration, and whether unauthorized acquisition or disclosure occurred.
• Eradicate and recover: patch, remove malicious access, restore clean systems, validate authorization boundaries, increase monitoring.
• Notify: as required by law and contract. Plaid is notified promptly where required by Plaid’s agreements or Developer Policy.
• Post-incident review: document root cause, timeline, impact, corrective actions, owners and deadlines.

Relevant logs and evidence are preserved securely with restricted access.

The plan is reviewed at least annually and after material incidents.

Email security@monthlyiq.com immediately if you suspect unauthorized access to your account or data.

Capalty LLC, doing business as MonthlyIQ (“MonthlyIQ,” “we,” “us,” or “our”).

• Privacy: privacy@monthlyiq.com
• Support: support@monthlyiq.com
• Security: security@monthlyiq.com
• Mail: 500 S. Australian Ave., Ste 600 #1072, West Palm Beach, FL 33480