Operational policy
Data and Security Policy
OfferLake is designed so customers, assigned specialists, and administrators see the right information for their role. This page summarizes the operational safeguards planned for launch preparation.
Operational draft · September 2026
Use this operating policy for setup and review. Before the paid launch, confirm the final legal entity, jurisdiction, refund rules, data retention, vendors, and dispute process with qualified counsel.
Private documents and evidence
Resume files and submission evidence are stored in private storage and checked through the user’s role before download. Customers can delete resumes they no longer want to use. Submitted application records keep the historical resume name and evidence needed for service proof.
Role-based access
Clients can access their own workspace. Specialists can access only assigned clients. Administrators can manage service operations. Staff accounts should use two-step verification before the system is opened to real customers.
File and form protections
Uploads are limited by file type and size, and public forms are rate-limited to reduce spam. The public site should not collect passwords, banking information, or documents that are not needed for the requested service.
Monitoring, backups, and recovery
Before full launch, the team should confirm error monitoring, database backups, restoration steps, access reviews, and incident escalation. A backup is only useful after the team has tested that it can restore the data.
Deletion and incident response
The final operating procedure should define who handles deletion requests, how long backups are retained, how vendors are contacted, when customers are notified, and how security incidents are documented.
Questions about this policy?
Contact support@offerlake.co. Do not send passwords or sensitive documents by email.