Logging and Monitoring Policy

1. Purpose

This policy describes how Monvo collects, retains, and reviews logs generated by its production systems. Logs are a primary control for detecting security events, diagnosing service issues, and demonstrating accountability for access to consumer financial data.

2. Scope

This policy applies to all production systems operated by Monvo, including application API routes hosted on Vercel, the Supabase database and authentication infrastructure, and integrations with third-party services such as Plaid and Anthropic.

3. Log sources

Application logs: Vercel captures logs for every serverless function invocation, including request metadata, response status codes, execution duration, and runtime errors. Logs are available in real time via the Vercel dashboard.

Database and authentication logs: Supabase records all authentication events (sign-in, sign-out, token refresh, failed attempts) and provides query-level logging for database operations. Logs are accessible via the Supabase dashboard.

Plaid API activity: all calls to the Plaid API are logged at the application layer with timestamps and outcome codes. Plaid access token identifiers (not the tokens themselves) are recorded to support audit tracing.

4. What is logged

Access events: authentication successes and failures, session creation and termination, and API key usage.

Data access events: API routes that retrieve or write consumer financial data log the requesting user identifier, endpoint, and response outcome.

Error events: all unhandled exceptions and HTTP 4xx/5xx responses are captured with stack traces and contextual metadata.

Infrastructure events: deployment activity, function cold starts, and platform-level alerts are logged by Vercel and Supabase.

Logs do not contain raw Plaid access tokens, banking credentials, or full account numbers.

5. Retention

Vercel function logs are retained for 30 days on the current plan. Logs are reviewed manually for anomalies on a periodic basis and in response to any incident.

Supabase authentication and database logs are retained per Supabase platform defaults. Material events identified during review are noted and preserved as needed.

6. Monitoring and alerting

Vercel provides real-time alerting for deployment failures and function error rate spikes. The founder is notified immediately of any failed production deployment.

Supabase dashboard alerts are configured to surface unusual authentication activity.

Log review is performed by the founder following any production incident, user-reported anomaly, or scheduled security review.

7. Access to logs

Access to production logs is restricted to the Monvo founder via authenticated sessions on the Vercel and Supabase dashboards. Both accounts are secured with strong, unique passwords. Multi-factor authentication is enabled on both platforms.

No third party has access to Monvo production logs except as part of the managed platform services described in Section 3.

8. Incident response

If logs indicate a potential security event, the founder will investigate immediately, take remediation steps proportionate to the severity, and notify affected users if consumer data was exposed.

Material security findings and their resolution are documented and retained.

9. Policy review

This policy is reviewed whenever a significant change is made to Monvo's infrastructure or logging architecture, and at minimum annually.

For questions about this policy, contact team.monvo@gmail.com.