Security Overview
Last updated May 2026 · Prototype document, informational only.
We take the security of your financial data seriously. This overview describes the practices we use to protect your information. As a prototype, our controls will continue to harden over time.
Authentication
Accounts are protected by email and password authentication with securely hashed credentials. Sessions are managed using signed tokens, and access to your data requires an authenticated session.
Data access
Financial records are scoped to your account. Database row-level security policies ensure that one user cannot read or modify another user's data.
Bank credentials
We never store your bank username or password. Bank connections are handled by a specialized provider, and the resulting access tokens are stored encrypted on the server and never exposed to the browser.
Secrets and keys
API keys and other secrets live in server-side environment variables and are never shipped to the client. Sensitive integrations, including AI requests, are routed through backend endpoints.
Reporting a concern
If you believe you have found a security issue, please contact us so we can investigate promptly.