Security

All traffic between your browser and our infrastructure is served over HTTPS using modern TLS. API requests, authentication exchanges and file uploads are encrypted end to end in transit.

Databases, backups and uploaded receipt files are stored encrypted at rest by our managed infrastructure provider, with keys managed by the platform rather than the application.

Every table that holds user data is protected by row-level security policies, so each request can only read or write rows that belong to the authenticated account. Access is enforced in the database itself, not just in the application layer.

Sign-in supports email and password with verified email addresses, plus Google OAuth. Sessions use short-lived access tokens that refresh automatically, and password resets are single-use and time limited.

Access to production systems is limited to those who need it, dependencies are kept current, and errors are monitored so issues can be identified and resolved quickly.

If you believe you have found a vulnerability, please report it privately to support@usefinwiseai.com with steps to reproduce. We will acknowledge your report, keep you updated, and ask that you avoid accessing other users' data while testing.