Security

A few of the practices behind how your account and data are handled.

Encryption in transit and at rest

All traffic to and from your account is encrypted over HTTPS, and account data is encrypted at rest by our database provider.

Isolated account data

Database access rules enforce that you can only ever read your own accounts and transactions — never another user's.

No client-controlled balances

Transfers and admin-administered credits/debits are only ever applied through server-side functions that validate every request — your balance can't be edited directly.

Full transaction ledger

Every change to your balance is recorded as its own permanent, timestamped entry, so your history is always complete and auditable.