Security overview

Security

SafeSpend is designed to protect household financial data with a minimal-trust approach. This summary captures the current MVP security posture and the direction for the platform.

Authentication

  • Google is the initial sign-in provider.
  • The app uses cookie-based session auth after sign-in.
  • Household permissions are enforced by the app, not the background worker.

Financial data

  • Bank usernames and passwords are never stored.
  • Provider access tokens are encrypted at rest.
  • Only masked account numbers are stored.

App boundaries

  • Static assets stay public so the UI can load correctly.
  • Household data stays scoped to the signed-in user and household.
  • The background worker uses shared services, not user traffic, for scheduling.

Operational controls

  • Users can disconnect bank connections.
  • Users can delete household data.
  • Logging should avoid exposing sensitive financial details.
More detailed security controls, audit logging, and hardening steps will be documented as the product moves past MVP. For security questions, contact support@jsplaces.com.