Security
What we have built, and what we have not.
We handle finance data, so we will not claim controls we do not run. Everything on the left is live in the product today; everything in the middle is on the roadmap and named as such.
In place today
- TLS in transit and encryption at rest on managed infrastructure
- Passwords hashed with bcrypt (cost 12); credentials never stored in plain text
- Content-Security-Policy, X-Frame-Options and Permissions-Policy headers on every response
- Rate-limited API and encrypted session cookies
- Every query scoped to your own workspace
In development
- SSO and SAML for team accounts
- Immutable audit logs
- A completed SOC 2 Type II report
- Third-party penetration testing
- Data-residency options per region
How we handle your data
- No bank credentials: you import a statement or enter figures yourself
- No card numbers, and no money movement — we never touch your funds
- Tax and filing figures are cash-planning estimates, not filed returns
- Export or delete your ledger at any time
- Report a vulnerability to derbistimur@gmail.com and we will respond