Overview
OssFin helps you understand your financial life by bringing your accounts into one place. That means we handle sensitive information, and we treat protecting it as a core part of the product — not an afterthought.
We maintain a written information security program aligned to the GLBA Safeguards Rule (16 CFR 314) and structure our controls around the AICPA SOC 2 Trust Services Criteria. This page summarizes how we keep your data safe.
🔒 Encrypted
TLS in transit; sensitive data and account tokens encrypted at rest with AES-256-GCM.
🏦 Never your credentials
Bank logins are entered into Plaid, never transmitted to or stored by OssFin.
🗑️ Your control
Delete your account and all associated data — including bank links — at any time.
🚫 Not for sale
We do not sell or rent your personal or financial information.
How your bank connection works
OssFin connects to your financial accounts through Plaid, the same bank-connectivity provider used by many major fintech apps. When you link an account:
- Your bank username and password are entered directly into Plaid's secure interface — they are never transmitted to, seen by, or stored on OssFin's servers.
- Plaid returns a limited access token that lets OssFin read your balances, transactions, and holdings. That token is encrypted (AES-256-GCM) before it is stored.
- OssFin has read-only access. We cannot move money, initiate transfers, or trade on your behalf.
Encryption
- In transit: all traffic is encrypted with TLS.
- At rest: Plaid access tokens and the most sensitive customer information — hand-entered accounts, imported transactions, extracted statement data, and saved profile/financial settings — are encrypted at the field level with AES-256-GCM using a versioned key system that supports zero-downtime key rotation. All data is stored on encrypted, managed PostgreSQL.
- Passwords: we don't store any. Sign-in is handled by Google OAuth, so there is no OssFin password to steal.
Access controls & authentication
- Sign-in via Google OAuth — multi-factor authentication is enforced by your Google account settings.
- Every request is authenticated; all data queries are scoped to your user, and shared/household access is gated by an explicit membership check.
- Session revocation: signing out of all devices immediately invalidates existing sessions.
- Access to production systems follows least-privilege principles.
Infrastructure & monitoring
- Hosting: the application and database run on managed U.S. cloud infrastructure (Railway) with the frontend served via Vercel.
- Secure development: every change runs through automated CI gates before deploy — a full test suite, crash-class linting, dependency vulnerability auditing, and automated secret scanning — with a protected main branch and version-controlled review. Hardened HTTP security headers are applied on every response.
- Monitoring & logging: security and activity events are recorded to an audit log, and errors are monitored via Sentry.
- Rate limiting protects against abuse and credential-testing.
Resilience & backups
- Customer data is held in a managed PostgreSQL database with automated backups.
- We maintain a written disaster-recovery runbook and periodically run a restore drill that verifies backed-up data can be restored with its integrity intact (row counts and content fingerprints must match).
- Encryption keys are managed separately from the database and archived offline, so a restore never depends on secrets stored alongside the data.
Data privacy & your controls
- We collect only what's needed to run the app and never sell or rent your data.
- Complete deletion: deleting your account unlinks every connected bank (via Plaid) and erases all associated records from our database. Local caches are wiped on sign-out.
- Uploaded statement files are not retained — only the extracted figures you asked us to read are kept.
- Full details are in our Privacy Policy.
Subprocessors
We use a small set of established providers to operate OssFin. Each receives only the data necessary for its function.
| Provider | Purpose | Data |
|---|---|---|
| Plaid | Bank & investment connectivity | Account, transaction & holdings data (credentials entered at Plaid, never seen by OssFin) |
| Sign-in (OAuth) | Name, email, profile ID | |
| Stripe | Payments | Name, email, subscription status (card data held by Stripe, not OssFin) |
| Anthropic | AI document analysis & assistant | Contents of documents you upload for analysis; assistant messages |
| Railway | App hosting & database | Stored application data |
| Vercel | Frontend hosting | Static assets (no financial data) |
| Resend | Transactional email | Email address, name, summary figures |
| Sentry | Error monitoring | Technical error context (PII scrubbed) |
Incident response
We maintain a written incident-response plan covering detection, containment, recovery, and notification. In the event of a security incident affecting your information, we will investigate promptly and notify affected users and regulators as required by applicable law.
Compliance posture
- GLBA Safeguards Rule (16 CFR 314): we maintain a written information security program mapped to its requirements.
- SOC 2: our controls are structured around the SOC 2 Trust Services Criteria. A formal SOC 2 examination will be pursued as partner and customer requirements warrant.
- Privacy: handled per our Privacy Policy, including applicable U.S. state privacy rights.
Report a vulnerability
We welcome responsible disclosure. If you believe you've found a security issue, please email security@ossfin.com with details so we can investigate. Please give us a reasonable opportunity to address the issue before public disclosure.
Security questions?
Evaluating OssFin for a partnership or need to complete a security review? Reach out at security@ossfin.com and we'll be glad to help.