How your financial data is protected, in plain language

Financial data is about as sensitive as personal data gets, and it's fair to want a plain-language answer to "what actually happens to mine" before trusting a tool with it. Here's the short version, with a link to the full technical detail for anyone who wants it.

What's encrypted, and when

Sensitive fields — your assembled profile, conversation transcripts, and plan snapshots — are encrypted before they're ever written to the database. That's an application-layer step, separate from and in addition to the database's own at-rest encryption. In practice, that means a leaked database connection string alone wouldn't expose plaintext financial data — the application has to decrypt it, and only does so to serve it back to you.

Who can see it

Sign-in is handled by Clerk, a dedicated authentication provider — this product never sees or stores your password. Every read or write to your data is checked against who's asking: another user's resource simply doesn't exist as far as your account is concerned (it returns "not found," not "forbidden," so ids can't even be probed to confirm something exists).

Bank connections

If you connect accounts, that goes through Plaid. Your banking username and password are entered directly with Plaid — never sent to or stored on this product's servers. What's held afterward is a revocable access token, itself encrypted before storage and never logged or shown back to you. Anything imported from a connected account is shown to you for confirmation before it becomes part of your profile — ambiguous data is a question, never a guess.

The short list of who touches your data

The list of services involved is kept deliberately short, and each one handles only what its role requires: Clerk for authentication, Plaid for bank connections, a managed Postgres database for storage (receiving data that's already encrypted for the sensitive fields), hosting providers for running the application, and the AI provider behind the intake conversation — which extracts and organizes what you say, and never computes a financial figure itself.

Where to read more

This is a summary, not the full picture. The Security and Privacy pages carry the complete, current technical detail — this post exists to make that detail approachable, not to replace it.

Mensari is an educational decision-support tool, not licensed financial, tax, or legal advice. It illustrates tradeoffs based on the assumptions you provide — always confirm decisions with a qualified professional before acting.