Security

Last updated: May 28, 2026

$pipeline reads your financial data so it can organize it. It never moves money. Below is how we protect what you connect to us.

Hosting & infrastructure

• Vercel (US): serverless application hosting (SOC 2 Type II).
• Supabase (US region): managed PostgreSQL + authentication (SOC 2 Type II).
• No self-managed servers.

Encryption in transit

TLS 1.2+ everywhere. Vercel and Supabase both enforce HTTPS; non-HTTPS requests are rejected at the edge.

Encryption at rest

Supabase encrypts all database storage at rest at the volume level (AWS-managed keys).

Plaid access tokens are additionally encrypted at the application layer with AES-256-GCM. The encryption key lives in our hosting environment (not in the database), so a database read alone cannot decrypt them. Tokens never appear in logs or backups in plaintext form.

Access control

• Postgres row-level securityisolates each household's data. A signed-in user can only ever query rows that belong to them.
• The app server uses a least-privilege key for user reads.
• A separate service-role key (never shipped to the browser) handles privileged writes from server-side routes only.
• Plaid tokens are never exposed to the browser.

Authentication

• Supabase Auth (email + password). Passwords are hashed with industry-standard algorithms. We never see them in plaintext.
• TOTP-based two-factor authentication available, with single-use recovery codes.
• Sessions are short-lived and re-validated on every protected request.

Secrets management

All API keys (Plaid, Anthropic, Stripe, our application encryption key) are stored as platform environment variables (Vercel and Supabase). Nothing sensitive lives in source control. Pre-commit secret scanning is enabled on the repo.

AI data minimization

When we use AI to suggest a merchant's category, we send only the merchant name, description, transaction amount, date, and Plaid category. Never account numbers, balances, or credentials. Our AI provider (Anthropic) does not train on data sent through its API.

Money movement

None. $pipeline is advisory only. We read transactions and balances to organize them and project your cash flow. We do not, and the Plaid integration does not authorize us to, move money out of any account. The product literally cannot initiate a transfer.

Disconnect & deletion

You can disconnect any institution at any time from the in-app settings, which calls Plaid /item/remove, marks the connection revoked, and stops syncing that institution. Your existing transaction history stays in your account.

You can delete your account and all data from the in-app settings, which calls Plaid /item/remove for every connected item and purges every row associated with your account within 30 days. We instruct Plaid to do the same.

Incident response

We maintain a written incident-response and breach-notification plan with defined severity tiers, containment playbooks, and notification windows. Targets: ≤24 hours notification to Plaid when our handling of Plaid data is implicated; ≤72 hours to affected users for material risk to their data; the strictest applicable timeline for state regulators and CCPA / GDPR supervisory authorities. Report a suspected incident to support@moneypipeline.io.

Subprocessors

Plaid, Supabase, Vercel, Anthropic, Stripe, PostHog, listed in our Privacy Policy. Each is contractually bound to use your data only to provide their service to us.

Reporting a vulnerability

If you believe you've found a security issue, email support@moneypipeline.io. Please give us a reasonable window to respond before public disclosure.