Security
We encrypt customer data, limit access, monitor core services, and keep regular backups. Financial information should only be available to the people meant to see it.
Customer data is encrypted in transit using modern TLS and at rest where supported by our infrastructure providers.
We use SuperTokens for session management with secure password hashing and rate-limiting on authentication endpoints.
FinButler is hosted on managed cloud infrastructure with regular database backups and basic availability monitoring.
Application development is informed by OWASP Top 10 guidance, with internal review and automated dependency scanning.
Role-based access control limits who can reach specific features and data inside an account.
Your data belongs to you. We do not sell it. You can export or delete it.
We monitor core services for availability and unusual activity, and we operate documented incident response procedures.
Internal access to production systems is limited to people who need it for their role and is tracked through our access management process.
Email security@finbutler.ai. Include a description, steps to reproduce, potential impact, and a suggested fix if you have one. We acknowledge receipt within 48 hours.
