Harbor Desk Systems

Policy

Information Security Policy

Harbor Desk Systems LLC · Last updated October 17, 2026

Scope

This policy covers Harbor Desk Systems LLC ("Harbor Desk"): the company's computers, accounts and hosted services, and the software it makes, Relay and Spoolhouse. Harbor Desk is a single-person company; the owner is the only person with access to company systems.

Access control

  • Every account has a unique password, kept in a password manager.
  • Two-step sign-in is required on every company account, including GitHub, Google, Cloudflare and Microsoft Azure.
  • Least privilege: each integration asks only for the permissions it needs.
  • Access is reviewed whenever a service is added or changed.
  • Anyone added later gets access only after agreeing to this policy, and only with two-step sign-in.

Devices

  • Full-disk encryption (FileVault on Mac, BitLocker on Windows).
  • Automatic screen lock that needs a password or biometric to unlock.
  • Built-in anti-malware always on (Microsoft Defender; macOS XProtect and Gatekeeper).
  • Operating system and browser updates install automatically.

Network

  • Customer data is not stored on the office network.
  • The office network sits behind a router firewall with no inbound ports forwarded.
  • Hosted services run on Cloudflare, and the signing service on Microsoft Azure once it is set up. They are separate from the office network, behind their firewalls and DDoS protection.

Data classification

Public
Website content and published release files.
Internal
Source code, business records and invoices.
Confidential
Customers' business data (it stays on the customer's own computer; Harbor Desk doesn't hold it), sign-in tokens, app secrets and signing keys, and customer contact details.

Confidential data is encrypted in transit (HTTPS, TLS 1.2 or newer) and at rest (full-disk encryption on company computers; AES-256 encryption of tokens and secrets in the software). Access is limited to the owner. It is never written to logs, and never shared except with the vendors named in this policy, for their stated purpose.

Encryption and secrets

  • HTTPS with TLS 1.2 or newer everywhere.
  • Signing keys and app secrets are kept only on the owner's encrypted computer, in a managed secret store (Azure Key Vault) or in encrypted offline backups. They are never put in code, logs or customers' computers.
  • In the software, sign-in tokens for sales channels are encrypted (AES-256) on the customer's own computer.

Data minimization

  • The software runs on each customer's own computer and keeps their data there. Harbor Desk doesn't host or keep copies of customers' business data.
  • Hosted services log request ids and outcomes only. Logs never contain tokens, secrets, request bodies or personal information.

Secure development

  • Code is version-controlled on GitHub, with two-step sign-in.
  • Automated tests and checks run on every change, including dependency vulnerability scanning and Dependabot alerts.
  • Updates are published with a signed release file, and the software checks that signature before it installs an update.

Incident response

Incident lead
The owner of Harbor Desk Systems, responsible for containment, investigation, notification and follow-up.
Reporting
Anyone can report a suspected security issue to harbordesksystems@gmail.com. Reports are acknowledged within 2 business days.
Notification
Affected customers and platform partners (for example, TikTok Shop) are notified by email without undue delay once a breach is confirmed, and within any deadline set by law or the partner's terms.

Every incident follows these steps:

  1. Contain: revoke and rotate affected keys and tokens, and disable access.
  2. Investigate using logs.
  3. Notify affected customers and platform partners without undue delay, and as required by law and platform terms.
  4. Record what happened and what changed.

Vendors

Cloudflare, GitHub, Stripe for payments (Harbor Desk never sees full card numbers), and Microsoft Azure for the signing service once it is set up.

Deletion

When a customer disconnects a sales channel, or the channel revokes access, the software deletes that channel's tokens and links from the customer's computer. Harbor Desk holds no channel data to delete.

Reporting a security issue

Email harbordesksystems@gmail.com. Reports are acknowledged within 2 business days.

Review

This policy is reviewed at least once a year and whenever our products or providers change.