Security

We take the security of your financial data seriously. Here’s a short overview of how we protect your account and information.

Last updated: 2026-03-01

At a glance

All traffic is encrypted in transit (HTTPS/TLS).

Sensitive data is encrypted at rest; we never see or store your bank login credentials.

Multi-factor authentication (MFA) is available for your account.

Every request is authenticated and data is strictly isolated per account.

AI, bank linking, and payments run on secured backend services—no secrets in the browser.

We use Supabase Auth with email/password or OAuth. MFA (authenticator app) is available in Settings.

All traffic uses TLS (HTTPS). Sensitive data at rest is encrypted; session cookies are Secure and HttpOnly.

Your data is scoped to your account. Every query is restricted to your identity; no cross-user access.

AI, bank linking, and payments run on our servers. API keys and secrets never leave the backend.

We use Plaid to link accounts. We never see or store your bank credentials; tokens are stored encrypted.

AI dashboards run read-only queries on your data only. No access to other users’ information.

Session cookies use HttpOnly, Secure, and SameSite. Sensitive actions are protected with CSRF tokens.

Found a vulnerability? We support responsible disclosure and won’t pursue legal action against good-faith researchers.

Please report via our Contact page with as much detail as you can.