Security

Transport security

• ✓HTTPS only on all endpoints. HTTP requests are redirected.
• ✓HSTS with preload. Your browser will never connect over plain HTTP.
• ✓Strict Content Security Policy with per-request nonces.

Authentication

• ✓Email one-time code (OTP) only. No passwords stored, ever.
• ✓OTP codes are SHA-256 hashed with a server secret before storage. Plain codes are never written to the database.
• ✓Sessions are JWT-signed HTTP-only, Secure, SameSite=Lax cookies with 30-day expiry and server-side revocation.
• ✓Rate limiting: 5 OTP codes per email per hour to block enumeration.

Data isolation

• ✓Two-layer tenant isolation: every query is scoped by workspace_id in application code, and PostgreSQL Row Level Security enforces the same constraint at the database level. The application role has BYPASSRLS disabled.
• ✓A CI test asserts that querying any tenant table without setting the workspace context returns zero rows.
• ✓No full account numbers stored — last 4 digits (mask) only. No SSN or EIN stored beyond last 4.

Secrets at rest

• ✓Plaid access tokens are encrypted with AES-256-GCM before storage. The encryption key is a separate environment variable, never in the database.
• ✓Statement files and generated exports are stored in private buckets. Access is via presigned URLs with 15-minute expiry.
• ✓Uploaded files are validated by magic bytes, not just extension. Maximum 25 MB per file.

Data export and deletion

• ✓Self-serve full data export at any time, in any subscription state. Settings › Export produces a CSV bundle of all transactions, chart of accounts, journal entries, and rules.
• ✓Workspace deletion is a 30-day soft delete with a restore option, then a hard purge job. No accidental permanent deletion.
• ✓User account deletion cascades only where the user is the sole workspace member. Other members' data is unaffected.

Audit logging

• ✓Every state-changing action writes an audit event: categorization, posting, period locking/unlocking, member changes, billing events. Retained indefinitely.
• ✓Audit log is visible to all workspace roles in Settings › Audit Log.

Subprocessors

These third-party services process data on our behalf. We maintain Data Processing Agreements with each.