Security & privacy

Encryption & storage

• Sensitive fields — profiles, transcripts, run snapshots, and narration — are encrypted with Fernet before they are written to the database. The database only ever stores ciphertext for those columns.
• The database itself (managed Postgres on Neon) is encrypted at rest and reachable only over TLS. Application-layer field encryption sits on top of that, so a leaked connection string alone does not expose plaintext financial data.
• The application is served over HTTPS in production; cookies are marked Secure.

Authentication & access

• Sign-in and sign-up are handled by Clerk, a dedicated authentication provider, with support for multi-factor authentication and breached-password detection. We never see or store your password. Clerk session tokens are verified on our server against Clerk's published signing keys on every request.
• Accounts created before the Clerk migration have bcrypt-hashed passwords — plaintext passwords have never been stored or logged.
• Every read or mutation verifies ownership server-side; another user's resource returns 404, so ids can't be probed.
• API keys and encryption secrets live only on the server — the browser never sees them.

Bank connections

• Account connections go through Plaid. Your banking username and password are entered with Plaid directly and are never sent to or stored on our servers.
• We hold only a revocable Plaid access token, encrypted at the application layer before storage and never logged or returned to the browser.
• Imported account data is always shown to you for confirmation before it enters your profile — ambiguous data becomes a question, never a guess.

Who processes your data

We deliberately keep the list of services that touch your data short. Each processes only what its role requires:

• Clerk — authentication. Holds your sign-in credentials and account email; never sees your financial data.
• Plaid — bank connections. Handles your banking credentials directly and returns account data to us with your approval.
• Neon — managed Postgres database. Stores your data encrypted at rest; sensitive fields arrive already encrypted by the application.
• Vercel and Railway — application hosting for the web interface and backend. The backend is where data is processed in memory to build your plan.
• Anthropic — the AI model behind the intake conversation. It extracts and organises what you tell it; it never computes a financial figure, and every call is proxied through our backend.

These providers are hosted in the United States. Cross-border handling and your rights under Canadian privacy law are covered in the Privacy Policy.

Web hardening

• CSRF protection on cookie-authenticated state-changing requests.
• Rate limiting on authentication endpoints.
• Security headers: X-Content-Type-Options, X-Frame-Options, and Referrer-Policy.
• PII redaction in application logs.

Deliverables & retention

• Artifacts are never publicly reachable. Downloads use short-lived, signed, owner-scoped URLs.
• Self-service deletion: individual runs, intakes, or your entire account and all data.
• Runs and artifacts are eligible for purge after a configurable retention period (default 365 days).

For the full technical posture, see web/SECURITY.md in the project repository. Read our Privacy Policy for how personal information is handled.