Information Security Program

Old Bones Therapy, Inc. · Last reviewed October 17, 2026

Scope and ownership

This program covers Old Bones Therapy, Inc. ("we"): oldbones.ai, the Olympus by Old Bones software that runs in each customer's account, our apps for Shopify and Klaviyo, and the accounts our team uses to build and run them.

Brandon Fields, Founder and CEO, is responsible for information security: this program, access, incident response, and its review. He has a computer science degree and worked as a software engineer before founding the company.

Security by design

• Customer data stays with the customer. Each Olympus is its own app and storage in the customer's Railway account. We have no access to it after setup unless the customer turns on support access (Settings, Support access), which they can turn off at any time.
• oldbones.ai holds as little as possible. It keeps the account details it needs to set up an Olympus and sign people in, and no tokens for any customer's Railway, Shopify, Google, Meta, Reddit or Klaviyo account (the one exception, read-only access to a Railway project a customer chooses to share with support, is stored encrypted). Tokens pass through it only for the moment needed to hand them to the customer's Olympus, renew them or end them.
• The narrowest access. Connections ask only for the read access they use. Our Klaviyo app, for example, is read-only and never requests customer profiles.
• Signed requests. Every request between oldbones.ai and an Olympus is signed with a key only the two share, and is refused after five minutes.
• Short-lived credentials. Access tokens expire (an hour for Klaviyo and Google), are renewed only through oldbones.ai, which alone holds each app's secret, and stop working once a customer disconnects or the platform refuses them.

Data protection

• In transit: oldbones.ai and every Olympus are served over HTTPS only.
• At rest: our hosting provider encrypts stored data at rest, and so does Railway for each customer's Olympus. Credentials an Olympus keeps are in files readable only by its own process.
• Secrets (app secrets, API keys) live in our hosting provider's secret variables, never in code or in our repository.
• Retention: we keep personal data only as long as our privacy policy says, and prune it automatically: signup records and Shopify notice records for 12 months, the record of Klaviyo connections for 13 months, a deleted store's owner details for 90 days.

Access control

• Access to company systems (code hosting, cloud hosting, DNS, email, payments and the platforms we integrate with) is limited to the people whose work needs it, and removed when it no longer does.
• Multi-factor authentication is required on those accounts.
• All access, administrative and standard, is reviewed every quarter.
• Inside Olympus, each team member has a role. The owner and admins manage connections and the team; standard access hides finances.
• Changes to our live storefront theme and store content require the owner's review before they go live.

Devices

Computers used for company work have full-disk encryption, a firewall, the operating system's built-in anti-malware protection, a login password, and a screen that locks automatically when idle.

Development and change management

• Our code lives in a private repository. Every change is committed with its reason and runs our automated test suite (over 3,000 tests) before it is accepted.
• Changes are deployed from that repository only; nothing is changed by hand on a running server.
• We use each platform's stable, current API versions and respect their rate limits.

Vulnerability management

• We're alerted to known vulnerabilities in the software we depend on through GitHub's security alerts and npm's audit.
• We remediate critical vulnerabilities within 3 days of a fix being available, high within 7 days, medium within 30 days, and low at our next scheduled dependency update, within 90 days.
• A fix deploys to oldbones.ai and to customers' Olympus installs in the same release, once it passes our automated tests.

Web application protections

• Sign-in through an established authentication library: hashed passwords, rate-limited sign-in attempts, secure session cookies.
• Every API route checks who is signed in and what their role allows.
• Changes are accepted only as JSON requests, with same-origin checks on sensitive pages, so another site can't make them on a signed-in person's behalf.
• Public endpoints on oldbones.ai are rate-limited.
• Everything a person types is escaped before it's shown on a page.
• Every page is sent with security headers: HTTPS only (HSTS), no content-type sniffing, and no framing by other sites.

Logging and monitoring

• oldbones.ai records each connect, renewal and disconnect for every integration it brokers (which Olympus, what happened, when; never a token), and keeps that record for 13 months.
• Every Olympus is checked for health every six hours, and each one's scheduled jobs record their outcome, so a failure is seen and repaired.
• Our cyber insurer's response service monitors for our credentials appearing in breaches.
• Our providers (Google Workspace, GitHub, Railway and others) alert us to suspicious sign-ins.

Training

Everyone on the team receives monthly phishing-simulation campaigns through our cyber insurer's response service. Payments to new vendors, and any request to change a vendor's bank details, are confirmed by phone on a number we already know before money moves.

Vendors

We use a small number of providers, each handling only what its job needs: Railway (hosting), Cloudflare (DNS), Resend (email), and the platforms our customers choose to connect (Shopify, Google, Meta, Reddit and Klaviyo). Our privacy policy lists them and what each does.

Incident response

1. Contain: revoke affected access and tokens, rotate affected secrets and keys, and take affected services offline if needed.
2. Assess: establish what happened, what data and which customers were affected, and how, using our records and our insurer's 24/7 incident response team.
3. Notify: tell affected customers, and partners whose data or users are involved (such as Klaviyo), without undue delay, and as the law requires.
4. Fix and learn: correct the cause and record what changed, so it doesn't happen again.

We carry cyber liability insurance, which includes incident response, forensics and notification support.

Review

This program is reviewed at least once a year, and whenever we add a new system, integration or kind of data.

Reporting a security issue

To report a vulnerability or a security concern, email support@oldbones.ai with "Security" in the subject. We'll acknowledge it promptly and keep you informed.