Your financial data is sensitive. We've built security into every layer of NetFiscus - from how we store your password to how we protect your sessions.
Authentication
Passkeys (Recommended)
We support passkeys - the modern, phishing-resistant way to sign in. Use Face ID, Touch ID, Windows Hello, or a hardware security key.
Why passkeys are more secure:
- Phishing-resistant - Can't be tricked into sending credentials to fake sites
- Device-bound - Private keys never leave your device
- Convenient - No password to remember or type
Password Authentication
If you use a password:
- Passwords are securely hashed using industry-standard algorithms
- We never store your password in readable form
- Changing your password immediately invalidates all other active sessions
Email Verification
New accounts must verify their email address before logging in. This confirms you control the email and prevents account hijacking.
Session Security
Your login session is protected by multiple layers:
- HTTP-only cookies - Session tokens can't be stolen by malicious JavaScript
- Secure flag - Cookies only sent over HTTPS
- SameSite protection - Prevents cross-site request forgery (CSRF) attacks
- Automatic expiration - Sessions expire after a period of inactivity
- Encrypted storage - Sessions stored with encryption at rest
Password Reset & Verification Links
Password reset and email verification links use secure, one-time tokens:
- Random tokens - Generated using cryptographically secure random bytes
- Hashed storage - Tokens stored as hashes - if our database were compromised, attackers couldn't use the tokens directly
- Time-limited - Tokens expire automatically
- Single-use - Tokens are deleted after successful use
Connected Apps and AI Assistants
You can connect an AI assistant to your account over the Model Context Protocol. See the setup guide.
- OAuth 2.1 with PKCE - apps sign you in through our authorization server. They never see your password.
- Explicit consent - a consent screen names exactly which permissions are requested before anything connects.
- Separate permissions - reading your data and changing it are granted separately.
- Short-lived tokens - access tokens expire and are refreshed. They are stored only as a hash, never in readable form.
- Scoped to one account - a credential reaches your data and nothing else. There is no admin access.
- Revoke at any time - Settings, Connected apps lists every authorized app and access token. Removal takes effect immediately, and a password reset revokes all of them.
- Rate limited - the endpoint caps how many calls a connected app can make.
- Confirmed changes - a connected app must show you a record and get an explicit yes before it changes or removes it, one record at a time. It can never create, archive or delete an asset or a debt.
Payment Security
We use Stripe for all payment processing:
- No card data stored - Credit card numbers never touch our servers
- Webhook verification - All payment events verified via cryptographic signature
- PCI compliant - Stripe handles all payment card security requirements
API Security
- Authentication required - All data endpoints require login
- Rate limiting - Public endpoints are rate-limited to prevent abuse
- CORS protection - API only accepts requests from authorized origins
- Input validation - All user input validated and sanitized
Data Isolation
Your data is yours alone:
- User-scoped queries - Every database query is automatically scoped to your account
- No cross-user access - Impossible to access another user's data, even with valid authentication
Infrastructure
- HTTPS everywhere - All connections encrypted in transit
- Managed database - PostgreSQL with automated backups
- Encrypted storage - Data encrypted at rest
Account Deletion
You can delete your account at any time:
- Two-step confirmation - Deletion requires email confirmation
- Complete removal - All your data is permanently deleted
- Grace period - Time to cancel before deletion is processed
What We Don't Do
- We don't sell your data
- We don't share your data with third parties, except Stripe for payments and any AI assistant you connect yourself
- We don't use tracking cookies or advertising trackers. We use anonymous product analytics only
- We don't store passwords or sensitive tokens in readable form
Reporting Security Issues
Found a vulnerability? Contact us through our Contact page. We take all security reports seriously and will respond promptly.
