Security

Encryption

• Sensitive secrets are protected with AES-256-GCM envelope encryption — each record uses its own data key, wrapped by a master key, with key versions tracked for rotation.
• Data is encrypted in transit with modern TLS, and encrypted at rest in our database and backups.
• Encryption is bound to your account so one record’s key can never unlock another’s.

Authentication and access

• Passwords are hashed with Argon2id, a modern, memory-hard algorithm — we never store or see your plain-text password.
• Two-factor authentication (TOTP) is required, adding a second layer beyond your password.
• Sessions use short-lived access tokens with rotating refresh tokens and automatic reuse detection, plus idle and absolute timeouts.
• Sign-in attempts are rate-limited and locked out after repeated failures to resist brute-force attacks.

Bank connections

When you connect a bank, Plaid handles the secure connection to your financial institution. Your online banking credentials are entered with Plaid — not with Earmarkr — so we never receive or store your bank username or password.

Accuracy and integrity

Every amount in Earmarkr is stored and computed as an exact integer in minor units (cents) — never floating point — so there is no rounding drift. The core budgeting, credit-card reserve, and amortization engines are property-tested against their invariants, and a one-cent discrepancy is treated as a bug, not a rounding quirk.

Auditing and monitoring

Sensitive actions — authentication events and access to protected data — are recorded in an append-only audit log. We monitor the health of the service and design it so that a query without the proper account context simply fails, keeping each user’s data isolated.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability, please contact our security team using the address below and give us a reasonable chance to investigate and fix the issue before disclosing it publicly. We will not pursue action against good-faith research that respects our users’ privacy and avoids service disruption.

Your part

• Use a strong, unique password and keep your two-factor device safe.
• Sign out of shared devices and review your connected accounts periodically.
• Be alert to phishing — Earmarkr will never ask for your password or two-factor code by email.