The website being hacked must be a bad day. Not a disclosure letter.

That sentence is a design requirement in this product's architecture, and the design below is what it bought. All of it is live today.

• A vault per tenant. Your books live in their own database with their own credentials — not a row-filter over a shared table. Row-level security guards the inside of the vault on top.
• Every page that shows money passes a capability check, every request. Entitlements are rows you can revoke; a revocation takes effect on the next page load, with no deploy and no support ticket. There is no admin route and no debug endpoint that dumps a row.
• Your bank credentials never touch us. The connect flow runs on Plaid's hosted site; we hold a scoped token, and disconnecting purges it.
• Sessions that refuse forgery. Sign-in issues a signed, HttpOnly, SameSite=Strict cookie. A tampered cookie is refused outright — never quietly downgraded to a fresh anonymous session.
• An append-only record. Judgements are appended, never edited. The books re-derive from the record, so tampering with a balance means forging history that the record does not contain.
• No money at rest on your device. The installable app deliberately caches only its shell — never a page with a number on it.
• No trackers. These pages carry no analytics, no third-party scripts, and send no referrer. This page holds no data of its own — and neither does the tier that serves it.

Security disclosures reach us fastest through the address on your welcome mail; honest reports get honest answers.