Executive Purpose
This manual establishes the policy library and operating controls used to support the Company's websites, software, AI-enabled tools, educational services, subscriptions, communications, intellectual property, and customer relationships.
Corporate Information
Legal Entity
The Tax Truths Technologies, Inc.
Entity Type
California corporation
State of Formation
California
Web Properties
www.thetaxtruth.com and www.yourtaxline.com
Effective Date
August 1, 2026
1. Information Security Management
Define security ownership, access control, authentication, encryption, logging, vulnerability handling, secure configuration, backups, and periodic reviews.
Minimum Controls
- Annual risk assessment
- Role-based access
- Multi-factor authentication for privileged access
- Encryption in transit
- Security event logging
- Documented backup and recovery testing
2. Privacy and Data Governance
Maintain a data inventory; document purposes, legal bases, sharing, retention, deletion, privacy rights, and sensitive-data controls.
Minimum Controls
- Data inventory
- Retention schedule
- Vendor register
- Privacy-request workflow
- Sensitive-data restrictions
- Annual policy review
3. AI Governance and Responsible AI
Approve AI use cases, assess risk, document providers and data flows, test outputs, require human review, monitor incidents, and prohibit unsupported professional conclusions.
Minimum Controls
- Approved-use register
- Risk classification
- Human oversight
- Provider diligence
- Output testing
- Incident and correction log
4. Software Development and Change Management
Use documented requirements, code review, testing, release approval, rollback planning, dependency monitoring, and production change records.
Minimum Controls
- Ticketed changes
- Peer review
- Pre-release testing
- Approval record
- Rollback plan
- Release notes
5. Incident Response and Breach Response
Establish reporting channels, severity levels, containment, preservation of evidence, legal assessment, notification decisions, recovery, and post-incident review.
Minimum Controls
- Incident team roster
- 24-hour internal escalation
- Evidence preservation
- Notification decision log
- Recovery checklist
- Lessons-learned review
6. Vendor Risk Management
Perform diligence before vendors receive data or system access; maintain contracts, security terms, confidentiality, breach notice duties, and termination procedures.
Minimum Controls
- Risk-tier vendors
- Security questionnaire
- Contract review
- Subprocessor tracking
- Annual reassessment
- Secure termination
7. Records Retention and Destruction
Assign retention periods by record category, preserve litigation or regulatory holds, and securely destroy information when authorized.
Minimum Controls
- Retention matrix
- Legal hold process
- Deletion approval
- Secure disposal
- Backup expiration
- Exception log
8. Workforce Confidentiality and Acceptable Use
Require confidentiality, least-privilege access, secure device practices, approved software, phishing awareness, offboarding, and return of Company property.
Minimum Controls
- Signed confidentiality terms
- Security training
- Device standards
- Access reviews
- Offboarding checklist
- Violation reporting
9. Intellectual Property Protection
Control ownership of code, content, course materials, data models, trademarks, domains, inventions, licenses, and third-party materials.
Minimum Controls
- IP assignment agreements
- Repository controls
- License inventory
- Domain custody
- Content approval
- Infringement response
10. Trademark and Brand Usage
Use only approved marks and spellings. The approved corporate trademark notice in this manual lists The Tax Truths™, Your Tax Line™, and The Tax Truths Technologies™.
Minimum Controls
- Approved mark list
- Brand usage rules
- Trademark notice
- Domain monitoring
- Third-party permission process
- Annual portfolio review
11. Website and Marketing Compliance
Substantiate claims, preserve approvals, disclose material terms, manage testimonials and affiliates, and maintain accessible legal links.
Minimum Controls
- Claims substantiation file
- Disclosure review
- Consent records
- Accessibility checks
- Email and SMS compliance
- Archive of published pages
12. Sales, Billing, and Subscription Compliance
Disclose total price, recurring terms, renewal, trial conversion, cancellation, refunds, and authorization before charging.
Minimum Controls
- Order form controls
- Consent capture
- Renewal notices when applicable
- Self-service cancellation where offered
- Refund decision log
- Chargeback response
13. Customer Support and Complaint Resolution
Log complaints, assign owners and deadlines, escalate legal or security concerns, document resolutions, and analyze recurring root causes.
Minimum Controls
- Central case log
- Severity and owner
- Response targets
- Escalation triggers
- Resolution confirmation
- Trend reporting
Governance Calendar
- Monthly: review incidents, complaints, vendor changes, and material website changes.
- Quarterly: access review, vulnerability review, AI-use review, and policy exception review.
- Annually: enterprise risk assessment, policy approval, workforce training, vendor reassessment, data inventory validation, and legal-document refresh.
Document Control
Each controlled policy should have an owner, approver, version, effective date, review date, change summary, and distribution record. Superseded versions should be archived and protected from routine use.
.png)