Security you can verify, not just trust

A credential we never collect is a credential that cannot leak, cannot be phished, and cannot be sold. There is simply nothing there to steal.

• Family you invite. They see only what you allow. You set it feature by feature, choosing separately whether they can view, add, edit, or delete.
• Our team. We can see account basics — your plan, members, invoices, and permission settings — plus anonymous, combined usage stats. We cannot see your actual financial figures. If we review an AI chat, every amount, percentage, email, and phone number in it is blanked out on the server first. A staff member only sees real numbers if you approve it, for a time you choose (next section).

We never sell your data — to anyone.

They are not an audience for your data; they are the machinery that runs the app. Here is every one of them, what it does in plain English, and what it receives.

One more, only if you set it up: an outside AI app you connect to your account yourself gets the access you approve, and you can cut it off anytime in Settings.

That is the complete list. We don’t sell your data to any of them, or to anyone.

To see a household’s real figures, a staff member requests access to that one household with a written reason, using their own name. The account owner approves it from Settings → Privacy, choosing how long it lasts — 1 hour, 4 hours, 24 hours, or 3 days. The owner can deny the request or revoke an active grant at any time, and access ends on its own at expiry.

Every request, approval, denial, revocation, and use is written to an audit log the owner can read on that same page. The owner gets an email when access is requested, and a receipt email when they approve it.

This does not eliminate staff access — it gates it. Database administrators and the infrastructure providers named in the Privacy Policy necessarily retain technical access to run the service; this feature governs the Beyond Payday admin console, not the underlying infrastructure.

That rule lives one layer below the application — a backstop, not a slogan, and the same backstop the self-serve export runs through.

Encrypted in transit: TLS everywhere, HSTS enforced. Encrypted at rest: by our infrastructure providers (Supabase-managed Postgres, Vercel) — the industry baseline, not bank-level encryption.

A Permissions-Policy response header sets camera=(), microphone=(), geolocation=() — an empty allow-list, which means “no one, not even us.” You can read it in your browser’s developer tools under the Network tab.

This site cannot send you a push notification at all — there is no web-push code in it, and no advertising SDKs anywhere. Our phone apps can, but only after you allow notifications and choose what you want: account alerts like a failed payment are the only ones on to start with, reminders are off until you turn them on, and offers and news are off unless you ask for them.

Beth runs on Anthropic’s Claude. When you ask a question, the relevant figures from your account — or, if you scan a paystub (available on every plan), that image, which is read once and never stored — are sent to Anthropic’s API to generate the reply. Anthropic’s commercial API terms prohibit training their models on this data.

You can turn Beth off entirely in Settings. Your chats are stored with your account. When staff review a chat transcript to keep Beth accurate, every amount, percentage, email and phone number in it is blanked out on the server by default — seeing the real figures needs the same named, owner-approved, time-limited access described above. Beth can answer questions and file a support ticket for you, but it can’t change your financial data.

The account owner can permanently delete the entire account — every financial record, every member login — from Settings with a typed confirmation. No support ticket, no exit interview. Two honest footnotes: only the owner can do this (spouses and children can’t nuke the household), and billing identifiers are retained about 7 years because tax law requires it.

You can also take your data with you. Settings → Your Data has a self-serve export that downloads everything your family has entered as a .zip. It’s available on the Free plan, for the owner or spouse; child accounts are blocked. Here is the entire archive:

How to reach us. Send the report through our contact form and start the subject with “Security.” We don’t run a security@ mailbox yet, so the contact form is the fastest path to the right person. Our machine-readable security.txt (the RFC 9116 contact file) points here too.

What to include. The affected URL or feature, the steps to reproduce it, and what you were able to access or change. A short proof-of-concept helps us confirm it fast. Please don’t access, modify, or delete another person’s data — use your own test account, and stop as soon as you’ve confirmed the issue.

What we’ll do. We aim to acknowledge your report within three business days and to keep you updated as we investigate and fix it. We’re a small, independent US company, so we can’t promise a payout, but we’re glad to credit you once a fix ships if you’d like the mention.

Our commitment to you. If you report in good faith, follow this page, and give us reasonable time to fix the issue before disclosing it, we will not pursue or support legal action against you for your research. Denial-of-service, spam, social-engineering of our team or users, and physical attacks are out of scope.

Neither was hired and neither was asked — they’re security people who couldn’t sign up for a finance app without testing it first. Both went straight at the thing that actually protects your data: the database-level access rules (row-level security). Across roughly two dozen tables and paired two-account tests, the reviews found no way to read or write another account’s financial data. Both also confirmed that the only Supabase key in our browser code is the public “anon” key — the correct setup, with no privileged key exposed.

Two medium-severity issues were found — both in our application logic, not the data boundary — and both fixed on 24 July 2026:

1. 1. Signing up didn’t prove you owned the email you used. In the worst case that could let someone accept a family-sharing invite meant for an address they didn’t control. Fixed: accepting a family invite now requires the secret token from the invitation email and a confirmed email address, so only the real recipient can accept.
2. 2. A referral-partner earnings field was writable from the browser. A signed-in user could set their own earnings balance directly. Fixed: that write path is gone — those fields can only be set by our server, enforced by the database rather than trusted from the browser.

To be straight about what this is: two informal peer reviews at a point in time, not a formal certification — which is the same reason this page shows you mechanisms instead of a badge. We’re sharing them because the review was unprompted, and because we fixed both issues within a day of hearing about them.

Two-factor authentication: available now in Settings → Security, free on every plan. It’s authenticator-app codes (TOTP) with one-time backup codes, not text-message codes, because SIM-swap attacks make SMS weak. You can also review your recent sign-in activity — when, roughly where, and how each sign-in happened. And if you sign in with Google or Apple, your sign-in also inherits that provider’s two-factor protection.

Passkeys: you can also sign in without a password at all. Add one from Settings → Security, then sign in with Touch ID, Windows Hello, or a security key — no password typed, no code to enter. A passkey works side by side with your password, so adding one doesn’t take the password option away. And because a passkey already proves who you are and that you hold the device, signing in with one skips the two-factor code step.

We also email you when something security-sensitive changes on your account — a sign-in from an unfamiliar device or location, a password change, or a change to your two-factor setup. And changing your password automatically signs out every other session, so a stolen session can’t outlive the password it stole.

Whichever way you sign in, password sign-up is rate-limited — five tries per fifteen minutes, per IP address — and disposable-email domains are blocked.

One more honest note: we don’t wave around a SOC 2 or ISO badge. We’re a small, independent US company, and instead of a logo this page shows you the actual mechanisms and the settings you can check.

• Open your browser’s developer tools, go to the Network tab, reload, and read the response headers. You’ll see Strict-Transport-Security (HSTS) and Permissions-Policy: camera=(), microphone=(), geolocation=().
• Read our vulnerability-disclosure policy above, or fetch the machine-readable /.well-known/security.txt (RFC 9116) that points to it.
• Inside the app: run the self-serve export from Settings, or walk right up to the delete-account flow — it asks you to type a confirmation before anything happens.
• Also inside the app: open Settings → Security, switch on two-factor authentication, save your backup codes, add a passkey, and read your recent sign-ins under Login History.