This page is maintained by Cashly to describe how we protect customer data. This is a draft for review — please consult with legal counsel before Plaid production submission or public launch.
Encryption in transit
All connections between your device and Cashly are encrypted using TLS 1.2 or higher. HTTP requests are automatically upgraded to HTTPS. Server-to-server traffic between Cashly and our data providers (Plaid, Stripe, Supabase) is also TLS-encrypted.
Encryption at rest
User data is stored in a managed Postgres database with disk-level encryption (AES-256). Sensitive credentials (Plaid access tokens, Stripe customer IDs) are stored server-side only and are never sent to the browser.
Authentication
Cashly supports email + password sign-in and social sign-in via Google and Apple. Password minimum length is 8 characters and leaked-password protection can be enabled by the account owner. Optional two-factor authentication (TOTP authenticator apps) is available to all users in Account Security. Administrative access to Cashly internal tools requires two-factor authentication.
Access controls
Every database table is protected by Row Level Security policies scoped to the authenticated user's ID. Users cannot read, write, or modify each other's data. Administrative access is gated by a separate role table and audited.
Bank account connections
Cashly uses Plaid to connect to your bank. Your bank login credentials are entered directly into Plaid's interface and never touch Cashly's servers. We only receive a limited access token from Plaid, which is stored encrypted server-side and used solely to fetch transactions you have authorized.
Payment processing
Payments and subscription management are handled by Stripe. Cashly does not store full card numbers or CVVs — these are collected and stored by Stripe under PCI DSS compliance.
Audit logging
Administrative actions and key security events (sign-ins, password changes, two-factor changes, bank connections) are recorded in an append-only audit log for incident response and account recovery.
Reporting a vulnerability
If you believe you have found a security issue, please email security@mycashlyapp.com. Please give us a reasonable time to investigate and remediate before public disclosure.
Shared responsibility
Cashly protects the platform and our infrastructure. You are responsible for the security of your own device, your password, and your authenticator app. Sign out when using shared devices and enable two-factor authentication for the strongest protection.