Effective date: July 18, 2026
Last reviewed: July 18, 2026
Atlanta Gold and Coin handles information that people reasonably expect us to protect: contact details, identification records, appointment and transaction history, accounting records, employee information, and the data used to operate BullionOS and AGCdesk. We take that responsibility seriously. This policy explains the safeguards we use and the review schedule that keeps security from becoming a one-time checklist.
1. Purpose and scope
This policy applies to Atlanta Gold and Coin employees, contractors, systems, devices, service providers, and business records. It covers information in paper and electronic form, including customer records, transaction data, accounting information, employee records, credentials, and confidential business information.
2. Responsibility
Hunter Rhodes and Tim Oh oversee the company’s information-security program. They set priorities, approve exceptions, review incidents, and coordinate security work with employees and service providers. Questions, concerns, or suspected security events should be reported promptly to support@atlantagoldandcoin.com.
3. Our security principles
- Access is limited to people who need the information to do their work.
- We collect and retain only the information reasonably needed for business, legal, and compliance purposes.
- Security is considered when systems, integrations, vendors, and workflows are selected or changed.
- Security events are documented, investigated, and corrected rather than handled informally.
- Employees and service providers are accountable for following the safeguards that apply to their work.
4. Access controls
Business systems should use unique user accounts. Shared credentials are avoided wherever practical. Multi-factor authentication is required where supported for administrative, email, financial, cloud, and other sensitive accounts. Permissions are assigned using least-privilege and need-to-know principles. Access is changed or removed promptly when a person changes roles or leaves the company.
Administrative access receives additional review. User accounts, roles, and privileged access are reviewed at least quarterly, with findings documented and followed through to completion.
5. Data and system safeguards
Confidential information is protected in transit using modern encrypted connections. Sensitive credentials, connection tokens, and integration secrets are encrypted at rest where the system supports it. Passwords and secrets are not placed in ordinary email, chat, or source-code repositories.
Business-critical systems are configured with logging, access controls, backups where appropriate, and a practical recovery plan. Production changes are reviewed, tested in proportion to their risk, deployed through an authorized process, and capable of being rolled back when practical.
6. Bank connections and financial data
When an authorized administrator connects a business bank account through Plaid, the connection is read-only. Atlanta Gold and Coin does not receive or store the bank username or password. The connection is used to retrieve permitted balance and transaction data for accounting and reconciliation. It cannot initiate a payment, transfer, or withdrawal. Connection tokens and other integration secrets are encrypted, and access is restricted to authorized personnel.
Imported bank activity does not automatically become a final accounting entry without the review and controls established in the accounting workflow.
7. Devices, networks, and physical security
Devices used for company work must use screen locks, supported operating systems, current security updates, and approved software. Sensitive information should not be stored on personal devices or removable media unless there is a legitimate business reason and an approved safeguard. Lost or stolen devices must be reported immediately.
Paper records, inventory areas, workstations, and network equipment are protected by physical access controls appropriate to the location and the sensitivity of the information.
8. Vendors and service providers
We consider security and privacy before giving a service provider access to company or customer information. The review is proportionate to the data involved and may include the provider’s security practices, contractual commitments, incident history, data location, access controls, and ability to return or delete information. Access and data sharing are limited to what the provider needs to perform the service.
Critical technology and data-service providers are reviewed at least annually and after a material security event or significant change in service.
9. Monitoring, logging, and vulnerability management
Security-relevant activity is logged where practical, including administrative changes, authentication events, data access, integrations, and important accounting actions. Alerts and logs are reviewed based on risk. Suspected misuse or unusual activity is escalated to Hunter Rhodes or Tim Oh.
Internet-facing and business-critical systems receive security updates and vulnerability review on a regular schedule. Higher-risk findings are prioritized, assigned to an owner, and retested after correction.
10. Incident response
Anyone who suspects lost information, unauthorized access, malware, phishing, credential exposure, or another security event must report it promptly. The response will be scaled to the event and may include containing access, preserving evidence, changing credentials, reviewing logs, contacting service providers, restoring systems, and documenting corrective action.
Hunter Rhodes and Tim Oh coordinate the response and determine whether customers, employees, law enforcement, insurers, regulators, or other parties must be notified. Required notices will be made within the time required by applicable law.
11. Backups, continuity, and recovery
Business-critical information is backed up or otherwise recoverable based on its operational importance. Recovery procedures are tested at least twice each year. Test results and gaps are documented, and significant gaps are assigned for correction.
12. Retention and secure disposal
Records are retained for business, legal, tax, anti-money-laundering, employment, and contractual needs. When information is no longer required, it is deleted, destroyed, or anonymized using a method appropriate to its sensitivity. Legal holds and regulatory retention duties take priority over ordinary disposal schedules.
13. Employee awareness
Employees receive practical security guidance when they join the company and at least annually afterward. Additional guidance is provided when roles, systems, or risks change. Topics include phishing, passwords, multi-factor authentication, handling customer information, clean work areas, incident reporting, and safe use of company systems.
14. Security review and audit schedule
The following schedule establishes the minimum review cadence. Reviews may happen more often when risk, business changes, or an incident warrants it.
- Continuous: Maintain security logging and alerts for supported critical systems; review significant events and failed controls as they arise.
- Monthly: Review patch and update status for internet-facing and business-critical systems; review unresolved high-risk security items and assigned corrective actions.
- Quarterly: Review active users, administrator roles, and sensitive permissions; scan internet-facing systems for vulnerabilities; verify completion of important control fixes.
- Semiannually: Test restoration of business-critical information and a practical continuity or recovery scenario; document the result and any corrective action.
- Annually: Review and approve this policy; complete a documented information-security risk assessment; review critical vendors; conduct an incident-response tabletop exercise; provide workforce security training; and arrange external penetration testing of internet-facing systems where appropriate to the risk.
- After a material change or incident: Perform a focused risk, access, and control review; verify remediation; and retest affected safeguards before closing the issue.
Review records should identify the date, scope, reviewer, findings, owner, target date, and evidence of completion. Significant findings are reported to company leadership.
15. Exceptions and enforcement
Any exception must be documented, include the business reason and compensating safeguards, have an expiration or review date, and be approved by Hunter Rhodes or Tim Oh. Failure to follow this policy may result in removal of access, corrective action, contract action, or other appropriate measures.
16. Policy maintenance
This policy is reviewed at least annually and whenever there is a material change in the company’s systems, services, legal obligations, or risk profile. The effective date and last-reviewed date are updated when a revised version is approved.
No security program can eliminate every risk. When we identify a weakness, we document it, assign an owner, set a reasonable due date, and verify the fix.
Contact
Atlanta Gold and Coin
8480 Holcomb Bridge Road, #200
Alpharetta, GA 30022
support@atlantagoldandcoin.com