Written for a risk review. What authority we hold, what we keep, who can see it, and what happens if that fails.

The controls

1. 01

   Authorization

   Names us as agent for specific services, at a specific address, for a specific move. No rate or plan changes. Expires when the last named service completes or at 90 days, whichever is first. Timestamped. Produced on request.

2. 02

   Retention

   ID and occupancy files deleted no later than 30 days after the last named service completes. Transaction logs (what, when, which authorization, which operator) kept 7 years. No ID images in those logs. Deletion is automated and logged.

3. 03

   Encryption

   TLS 1.2+ in transit. AES-256 at rest, including backups. Managed, rotated keys. No documents over unencrypted email.

4. 04

   Access

   Role-based. Operators see only assigned files. Admin access is individual, MFA, revoked the day a role ends. Every read and write is logged.

5. 05

   Incidents

   Confirmed unauthorized access: notify the affected utility within 72 hours, with records involved, window, and containment. Households notified under Florida law. Written report follows.