Bank-Grade Security

Your financial data is protected with enterprise-level security, compliance, and monitoring.

🔒

Encrypted

TLS 1.2+ in transit. Encryption at rest on the 2026 roadmap.

✓

SOC 2 Ready

Designed for SOC 2 Type II compliance

👁️

Monitored

System health dashboard with in-app alerts

Data Protection

  • •
    Encryption in transit: TLS 1.2+ for all client connections. Encryption at rest is on the 2026 roadmap.
  • •
    Database Backups: Automated nightly backups of every production database, verified after each run and retained for 30 days
  • •
    Off-Site Backups: Not yet in place; off-site backup storage and continuous backup are planned
  • •
    Controls in Place Today: Field-level AES-256-GCM encryption of tax IDs and dates of birth; single sign-on via OpenID Connect and SAML 2.0; host firewall (ufw) and fail2ban; per-client request rate limiting at the reverse proxy

Access Control

  • •
    Multi-Factor Authentication: MFA policy configuration exists; runtime enrollment and enforcement are pending rollout
  • •
    Role-Based Access Control: Granular permission management
  • •
    Session Management: Automatic timeout and secure session handling
  • •
    IP Whitelisting: Available for Enterprise customers

Compliance

  • •
    GDPR Compliant: Full support for EU data protection requirements
  • •
    CCPA Compliant: California consumer privacy protections
  • •
    SOC 2 Type II Ready: Framework-ready infrastructure and controls
  • •
    Audit Trails: Immutable audit trail for financial and administrative changes

Infrastructure

  • •
    Cloud Infrastructure: Hosted on Hetzner Cloud in Ashburn, Virginia, on a single primary server (no standby replica yet)
  • •
    Automated Backups: Nightly logical backups of every production database
  • •
    Rate Limiting: Per-client request rate limiting at the reverse proxy
  • •
    Disaster Recovery: RPO up to 24hr (nightly backups), RTO target 4hr

Security Practices

Regular Security Audits

We conduct internal security reviews to identify and address vulnerabilities. A third-party penetration test is planned.

Secure Development

Our development process includes code reviews, static analysis, dependency scanning, and security testing at every stage. We follow OWASP Top 10 guidelines and industry best practices.

Incident Response

A system health dashboard with in-app alerts, fail2ban and account lockout, and documented incident response procedures. We commit to notifying customers within 72 hours of any confirmed data breach.

Employee Training

All employees receive comprehensive security awareness training, including phishing detection, data handling procedures, and incident reporting protocols.

Questions About Security?

Our security team is available to answer your questions and provide detailed documentation.

View Compliance DetailsContact Security Team