What we do, and what we don't claim.

What we do, and what we don't claim.

Household isolation

The isolation unit is the household, not the user. Every financial row — accounts, cards, transactions, recurring debits, subscriptions, alerts, reports, merchant memory — carries its household identifier as a foreign key, with cascading deletion. Nothing attached to a household is readable from another one.

— Verified by an integration test: a user cannot read another household's rows, even given the exact identifier.

Access controls

Every financial query is carried by an authenticated access and validated server-side, on every read and every write — not only at the entrance to a page. The business role in the household and the platform role are two distinct fields in two distinct tables: administering the platform confers no authority over a household, and owning a household confers no platform privilege.

— httpOnly cookie sessions, mandatory email verification, rate limiting on authentication endpoints.

Redacted logs

The logger masks sensitive values before writing: amounts, labels, emails, account identifiers, tokens. An import error records the import identifier, never the file contents.

— Behaviour covered by tests.

AI boundaries

The figures shown come from deterministic engines, not from a language model: the same question asked twice gives the same result. To date, no financial data is sent to an external language model. The assistant explicitly declines questions it cannot resolve rather than inventing an answer.

— Throughout the product, a bank fact — immutable — is distinguished from an interpretation, which is uncertain and marked as such.

Imported files

Size capped, types allow-listed, empty files refused. A statement is stored under an opaque key, never under its original filename, in a directory of its own and outside the code repository. A fingerprint is computed to recognise duplicates.

— Per-user rate limiting on uploads.

Deleting your data

Account deletion requires email confirmation, and the attached financial data disappears with the household by cascade — there is no path that leaves orphan rows. A redacted audit log, carrying no financial data, keeps the trace of security events.

— Cascade guaranteed at the database schema level, not by application convention.

Errors and headers

An unexpected error renders a localised generic page: neither stack trace nor internal detail reaches the browser. Security headers are set globally and the server signature is disabled.

— Application error codes mapped to safe HTTP responses.