Security and Vulnerability Disclosure

• Two-step sign-in is required for every account. A password alone never opens a budget.
• Each person's data is walled off from everyone else's in the database itself, not just in the app.
• Bank access goes through Plaid. We never see your bank password, and the tokens that let us read your transactions are encrypted, readable only by our servers, and revoked when you disconnect a bank or delete your account.
• Everything is encrypted in transit (HTTPS only) and at rest.
• Passwords that have appeared in known data breaches are refused. Checking one sends only part of a scrambled form of it, never the password itself.

Email support@claros.money with "Security" in the subject. Include what you found, how to reproduce it, and what it could expose. We'll acknowledge your report within 3 business days and keep you updated until it's fixed.

• Test only against an account you created yourself, and never access, change or delete anyone else's data.
• Don't connect real bank accounts that aren't yours, run denial-of-service or high-volume automated tests, or try social engineering.
• Give us a reasonable time to fix the problem before telling anyone else about it.

If you follow this policy, we consider your research authorized, won't take legal action against you over it, and will credit you if you'd like. See our Privacy Policy for how we handle your data.