Security & Data Handling

This page describes the practices we follow to protect the financial information stored in Allata Money. It reflects how the application is built and operated today.

Encryption

• In transit: all traffic — browser to application, application to Plaid, application to database — uses TLS 1.2 or higher.
• At rest: our managed Postgres database and its automated backups are stored on encrypted volumes provided by our hosting providers.

Access control

• Every table storing user data has row-level security enabled and scoped to the authenticated user's ID, so a request can only ever return that user's own rows.
• Privileged database operations run only inside server-side functions that first verify the caller's session token.
• Administrative database credentials are held server-side only and are never present in the browser or in client-side code.

Authentication

Sign-in supports email and password, Google and Apple. Passwords are hashed by our authentication provider and are never stored by us in readable form. Sessions use short-lived tokens with refresh rotation.

Connected accounts (Plaid)

• Linking is optional and read-only — no payments, transfers or money movement.
• Bank credentials are entered directly into Plaid Link and are never seen, transmitted or stored by Allata Money.
• Plaid access tokens are stored server-side only, in a dedicated database table. They are never returned to the browser, never included in client bundles, and not written to logs.
• The browser only ever receives a short-lived link token. All calls to Plaid are made from our server.
• We request only the Auth and Balance products, and store only account name, type, mask and current balance.
• Unlinking removes the connection at Plaid and deletes the corresponding records and synced balances from our database.

Secret management

Third-party API credentials are kept in an encrypted secret store and injected as environment variables at runtime. They are not committed to source control and are not included in anything shipped to the browser.

Data minimization

We collect only what the product needs to show you your own financial picture. We do not store bank credentials, full account numbers, or payment card numbers.

Subprocessors

• Plaid Inc. — optional account linking and balance retrieval
• Supabase (on Amazon Web Services) — managed Postgres database, authentication and storage
• Cloudflare — application hosting, delivery and network protection
• Stripe — subscription billing and payment processing

We rely on these providers' own published security programs and compliance reports for the infrastructure they operate. We do not claim their certifications as our own.

Reporting a vulnerability

If you believe you have found a security issue, please email info@allataglobal.com with details and steps to reproduce. Please do not publicly disclose the issue until we have had a chance to respond. We aim to acknowledge reports within 5 business days.

Contact

Security and privacy questions: info@allataglobal.com