My AI Fin App

Security

How your data is protected

Specifics rather than adjectives: what is in place, how it works, and where the limits are. Everything here describes the app as it runs today. If something is unclear, or you find a problem, the address at the bottom of this page reaches a person.

Where your data lives

  • Your data is stored in a Postgres database run by Supabase. Connections to it are encrypted in transit, and Supabase encrypts its databases at rest.
  • Access is enforced by row-level security policies in the database itself: a household's rows can only be read or changed by members of that household, whatever the app code asks for. Household members have roles (owner, member, viewer), and the database checks the role on every write.
  • The website is hosted on Vercel and served only over HTTPS.

Bank connections

  • Connections go through Plaid. You sign in to your bank on Plaid's own screen; your bank username and password never reach our servers, and we never store them.
  • The access token Plaid gives us is encrypted with AES-GCM before it is stored, using a key that exists only as a server-side secret. The database alone is not enough to use it.
  • Disconnecting a bank in settings removes the connection at Plaid as well, not just in our database. Deleting your account does the same for every connected bank.

Signing in

  • Sign in with Google, with Apple, or with email and password.
  • New passwords are checked against known breaches using the Have I Been Pwned range API: only the first five characters of a hash leave your browser, never the password.
  • Email verification and password reset codes are generated with a cryptographically secure random number generator, checked in constant time, and rate-limited per account and per network address, so they can't be guessed by brute force.
  • An email when your account is signed into from a device it hasn't seen before, with a "this wasn't me" link that ends every session and starts a password reset. It's a security notice, so it can't be switched off.
  • Sign-in history and active sessions in settings, with sign-out of other devices.
  • After 30 minutes without activity, with a 5-minute warning, the app signs you out, or locks instead where it can. On the web it locks on a device where you have added or used a passkey, or on one you chose to remember if your account has a password; the passkey or the password unlocks it. The iOS and Android apps lock if you have turned on their Face ID, Touch ID or biometric lock. The clock only counts time the app is actually on screen: a hidden tab or a locked phone doesn't run it down.

Two-factor authentication

  • Two-factor authentication with any authenticator app.
  • Once it's on, the database itself requires it. Every table holding financial data carries a policy that refuses a session which hasn't passed the second factor, so even a stolen password plus a valid session can't read your balances or transactions.
  • Turning two-factor authentication on gives you ten single-use recovery codes, shown once, to save or print. If you lose your authenticator, any one of them turns two-factor authentication off at once, so you can sign in and set it up again. Without a recovery code, removing it by email takes 72 hours: we email you when the wait starts and again a day before it ends, each time with a link that cancels it, and using your authenticator in the meantime cancels it too. Nobody can shorten the wait, including our support team.

On your phone

  • The iOS and Android apps can lock with Face ID, Touch ID or your device's biometrics. It's opt-in under Settings → Security, and locks when you open the app and each time you leave it, or after 1, 5 or 15 minutes in the background, your choice. On iPhone, Face ID can also sign you back in after you sign out.
  • Hide every balance on the device you're using with one tap, for when someone is looking over your shoulder.

AI assistant access

  • Connecting Claude, ChatGPT or another assistant uses a personal access token you create in settings. We store only a SHA-256 hash of it, never the token itself.
  • Tokens are read-only unless you choose otherwise; with a read-only token the tools that change data don't exist at all. Connections authorized through OAuth are always read-only.
  • Every request runs as you, under the same database rules as the app, so an assistant can never see more than you can. Tokens can expire, and you can revoke any of them instantly.

In your browser

  • Strict Transport Security with preload, so browsers only ever connect over HTTPS.
  • A content security policy that limits where the page can connect to a short list of named services (our database, Plaid, the breach-check API and our error reporting) and only allows Plaid's frame to load.
  • The site cannot be embedded in another page, which blocks clickjacking, and the browser is told not to grant camera, microphone, location or payment access.

Error reports and analytics

  • Crash reports go to Sentry and identify you only by an internal account ID, never your email. Before anything is sent, values that look like tokens, passwords, codes, email addresses or phone numbers are stripped out of URLs.
  • Page-view counts come from Vercel Web Analytics, which is cookie-free. There are no advertising trackers, no Google Analytics and no Facebook pixel.

Your control

  • Download everything from settings at any time: one ZIP with a spreadsheet (CSV) for each kind of data, the same data as JSON, and a README explaining the files. It covers debts, accounts, transactions, budgets, goals, categorization rules, tags, net-worth history, your household, settings and sign-in history: everything you can see in the app. Passwords, bank access tokens and other secrets are never included.
  • Delete your account from settings. It's a button, not a support ticket: it disconnects your banks at Plaid, deletes your data and your profile picture, and removes your sign-in.

What we don't do

  • Sell your data or show ads. Revenue is Pro subscriptions.
  • Store bank credentials. We never see them.
  • Claim certifications we don't have. This is a small product; it has not had a SOC 2 audit and won't say otherwise.

Reporting a security problem

If you think you've found a vulnerability, write to us directly. We'd much rather hear it from you first.

support@myaifin.app

What to include

  • What you found, and how serious you think it is.
  • The steps to reproduce it, with the URL or the request you used.
  • Anything you saw that wasn't yours. Say so, and stop there.

If you're looking in good faith, don't access other people's data, and give us reasonable time to fix what you find, we won't pursue you or report you.

There is a paid bug bounty. Scope, rules and how rewards work are on the bug bounty page.

Expect a reply within a few days.

Contact page