How we protect your data

We use AES-256-GCM encryption with random initialization vectors for all sensitive financial data. Bank account numbers, routing numbers, and payment metadata are encrypted at rest. Each encryption operation generates a unique IV and authentication tag to ensure data integrity.

Our system implements multiple layers of protection: layered rate limiting per account and per IP, progressive account lockout after repeated failed attempts, and automatic IP blocking for malicious actors. We also detect credential stuffing, distributed attacks, and bot patterns.

No. All payment processing is handled by Stripe, a PCI DSS Level 1 certified provider. We only store Stripe payment method IDs, never raw card data. This ensures your payment information is protected by the highest industry standards.

Yes! We support TOTP-based 2FA with authenticator apps (Google Authenticator, Authy, etc.). You'll also receive 8 backup codes for emergency access. 2FA can be enabled in your account settings and is required for sensitive operations like revealing bank account details.

All API endpoints use session-based authentication with JWT tokens. Sessions expire after 30 days and can be invalidated manually or automatically on suspicious activity. We also implement CORS protection, CSRF token validation, and internal API request validation.

We log all login attempts (IP, user agent, timestamp), track suspicious activities with severity levels, maintain comprehensive audit logs for user actions, log contract signatures with IP/location/device info, and detect security patterns like credential stuffing and distributed attacks.