HomeGift Information Security Policy

Security Owner

Information security is owned by the Director and Information Security Contact at SENDHOME.ONLINE LTD. Security contact: support@sendhome.online.

Security Principles

• Data minimisation, least-privilege access and secure-by-default configuration.
• No provider secrets in source code and separation of sandbox and production environments.
• Administrative authentication for sensitive functions and audit logging for sensitive changes.
• Encryption in transit, managed infrastructure with encryption at rest and secure payment-data handling.
• Regular security review before production launch and major changes.

Access Control And MFA

Production access must be limited to authorised personnel using individual accounts. Administrative routes and sensitive server-side mutations must require authentication and must fail closed if authentication is missing, invalid or expired.

Multi-factor authentication must be enabled for critical systems where supported, including source control, hosting and deployment, database, email, domain registrar, payment-provider dashboards and cloud services. Phishing-resistant MFA such as passkeys or security keys should be preferred where available.

Secrets, Logging And Deployment

API keys, signing secrets, webhook secrets, database credentials and admin session secrets must not be committed to source control. They must be stored in managed environment configuration or another approved secret-management mechanism.

Logs and diagnostics must redact full API keys, signing secrets, webhook secrets, database credentials, full signatures, unnecessary donor identifiers and sensitive church bank details unless display has been explicitly authorised for the relevant donor flow.

Before production deployment, lint, typecheck, tests, production build, dependency or security audit where applicable, and git diff checks should pass. Provider integrations remain disabled by default until configured and approved.

Monitoring And Incident Response

HomeGift should log security-relevant and payment-relevant events such as admin login attempts, failed admin access, rate-limit events, webhook verification failures, payment status changes, manual transfer instruction views and confirmations, disclosure acknowledgements, configuration changes and suspicious repeated failures.

Initial incident response includes containing the issue, disabling affected credentials or routes where needed, preserving logs, assessing affected data and users, rotating secrets if exposure is suspected, patching the issue, recording remediation and considering legal, regulatory, provider, church and user notification obligations.

Review

This policy must be reviewed at least annually and after any material security incident, provider change, church onboarding change or payment-flow change.