GoPhaze

GoPhaze / Policies & your data

Information security policy

Current policies for GoPhaze, Phaze2 and Mail. Clear responsibilities and practical choices.

Updated October 29, 2026Version 2026-10-29.2Phaze 2 LLC · GoPhaze
On this page
  1. Responsibility and scope
  2. Products and Plaid review
  3. Verified operator controls
  4. Risk and access management
  5. Data protection
  6. Secure changes and vulnerabilities
  7. Monitoring, incidents and recovery
  8. Privacy, vendors and training
  9. Review and reporting
  10. Passkeys and recovery
  11. Endpoints and lifecycle
  12. Deletion and financial readiness

01Responsibility and scope

Phaze 2 LLC, doing business as GoPhaze, is responsible for the security program covering GoPhaze, Phaze2, Mail and Unseriety. Antonio DeBlasis is the operator contact at tonideb@gophaze.com. Version 2026-10-29.2, October 29, 2026. This policy sets requirements; it is not a certification or a statement that every control has already been independently verified.

02Products and Plaid review

Phaze 2 LLC, doing business as GoPhaze, owns and operates Unseriety, a GoPhaze software product. The Plaid account and security review are under Phaze 2 LLC / GoPhaze; Unseriety is the product using the proposed integration, not a separate operator. Bank connections remain inactive. Any activation requires a separate consent flow and product readiness review.

03Verified operator controls

The GoPhaze operator workspace on unseriety.com uses Cloudflare Access identity verification, centralized staff roles, current-permission checks, expiring grants and recorded staff-lifecycle changes. A scheduled certificate-authenticated monitor checks Unseriety backup freshness and operator access rules. Automated technical reviews are separate from human business-need reviews. Product accounts remain distinct; customer workspace roles do not grant operator-wide access. These checks do not establish identical backup, MFA or endpoint protection coverage across every product or external provider console.

04Risk and access management

Management reviews risks monthly and after material changes. Access must be limited to the necessary role, individually attributable and reviewed quarterly. Privileged accounts must use MFA where supported, with recovery material protected privately. Revoke unneeded access and investigate suspected compromise promptly. Consumer account MFA is distinct from administrator MFA.

05Data protection

Minimize personal information, keep private content behind authorization checks, protect data in transit and evaluate each storage and backup path for encryption and access controls. Keep provider keys server-side. Never log passwords, authentication tokens, unredacted financial documents or mailbox content for diagnostics. Do not claim end-to-end encryption for services that do not implement it.

06Secure changes and vulnerabilities

Review changes affecting data collection, authentication, storage or providers. Test relevant access and data-integrity behavior before release and check dependencies for applicable advisories. Record findings, severity, owner and remediation target. Triage critical findings within one business day and promptly mitigate confirmed exploitable critical exposure. Endpoint scanning and vendor controls require separate verification; unit tests alone do not establish them.

07Monitoring, incidents and recovery

Review failures, authentication anomalies, backup age and security reports on business days. Verify notification delivery and retain sanitized review evidence. Incidents require a restricted record, containment, scope assessment, management escalation, recovery checks and follow-up. Determine actual notification duties rather than inventing a universal deadline. Test recovery with synthetic data in isolated environments and preserve deletion exclusions.

08Privacy, vendors and training

Publish accurate product notices and obtain specific consent before introducing optional sensitive processing. Review service providers and retention at least annually and before new transfers. Staff with access must understand phishing, lost-device and incident reporting procedures; real acknowledgements must be retained. Keep operational evidence and unresolved gaps in a restricted risk register.

09Review and reporting

Review this policy annually, next due October 29, 2027, and after significant changes. Report a security issue to tonideb@gophaze.com using a concise description and synthetic reproduction steps. Do not send passwords, keys or unredacted financial documents. There is no announced paid bounty. Unseriety publishes its product-specific security details at https://unseriety.com/legal/security.

10Passkeys and recovery

Domain-bound passkeys verify use locally through a device biometric or PIN. Recovery uses the account password and a separately enrolled, product-specific one-use phrase; the service stores a digest for verification. Recovery resets authenticator factors and sessions while preserving existing passkeys. Privileged provider consoles have separate authentication and recovery controls. Cloudflare Access passkeys do not by themselves establish complete phishing-resistant coverage.

11Endpoints and lifecycle

Maintain supported administrative devices and production software, review advisories and use appropriate vulnerability checks. Track findings by severity, owner, target and exception. Antivirus, automatic updates and unit tests address different risks; no statement here establishes complete endpoint scanning. Planned server purchases do not count as current controls.

12Deletion and financial readiness

Accept verified data requests at any time and assess active records, shared ownership, preservation obligations and recoverable copies. Before enabling bank linking in Unseriety, verify consumer consent, storage and transport protection, retention, deletion and provider requirements against the actual deployment.