Security

Your data, locked down by design.

Money Palava uses a privacy-first architecture: your financial data never leaves your device. Here is exactly how it works.

🛡️

Encrypted cloud database

Your data lives in a Supabase Postgres database in the EU, encrypted at rest with AES-256 and accessible only to you via row-level security.

🔐

Encrypted at rest

Account data on our servers (name, email, hashed password) is encrypted using AES-256.

🔑

Bcrypt password hashing

Passwords are never stored in plain text. We use bcrypt with per-user salts.

🚫

No bank credentials

We never ask for your bank login. We are not a Plaid integration. Your bank stays out of it.

💳

PCI-compliant payments

All payments handled by Stripe (PCI-DSS Level 1). We never see or store your card.

🔒

HTTPS everywhere

Every page served over TLS 1.3 with HSTS. Browser-level certificate pinning supported.

What we don't do

  • ❌ We never sell your data to advertisers, data brokers or anyone else.
  • ❌ We do not use third-party tracking pixels.
  • ✅ We use database-level Row-Level Security so each user can only ever read or write their own rows — enforced by Postgres itself, not just by our code.
  • ❌ We do not send marketing emails unless you explicitly opt in.
  • ❌ We do not require your bank account or credentials, ever.

How authentication works

When you sign up, your password is hashed using bcrypt with a per-user salt. The plain-text password never reaches our database — even our own staff cannot retrieve it. When you sign in, we verify your hash and issue a short-lived JWT token (1 hour expiry) signed with HMAC-SHA256.

All API requests carry this token. Every request is verified server-side, and the database itself enforces that user A can never read or modify user B's data — even if our code has a bug. That is what Row-Level Security guarantees.

Reporting a vulnerability

If you discover a security issue, please report it responsibly to security@moneypalava.com. We respond within 48 hours and credit reporters in our security advisory.

We do not currently run a paid bug bounty programme but we send swag and public credit for valid reports.