Built with zero trust.
Engineered for financial integrity.
FinBrain treats security as a foundational architectural requirement. From database-level row isolation to zero-proxy document storage, your financial records are protected by defense-in-depth engineering.
Core Defensive Controls
Every layer of the FinBrain stack is built to minimize blast radiuses and prevent unauthorized data access.
Multi-Tenant Row-Level Security (RLS)
Every query in FinBrain executes under PostgreSQL Row-Level Security enforced at the database engine level. User data is partitioned by immutable user identifiers, ensuring complete cross-tenant isolation even under unexpected application-layer faults.
- Deterministic auth.uid() = user_id policy on all financial tables
- No shared tenant buffers or leaking query scopes
- Direct DB-level enforcement across accounts, transactions, and budgets
Direct Zero-Proxy Document Pipeline
When you upload bank statements or CSV files, your binary documents never pass through or buffer on intermediate web servers. FinBrain generates single-use, presigned PUT URLs directly to encrypted Cloudflare R2 object storage.
- Strict 300-second TTL on all presigned upload and download URLs
- Private-by-default buckets with zero public access
- MIME validation and magic-byte signature verification before processing
Non-Authoritative AI Boundary
Artificial intelligence in FinBrain is purely advisory and classification-oriented. Machine learning models extract merchant metadata and suggest categories, but have zero authority to mutate financial state or authorize transactions.
- AI outputs are strictly parsed and validated against deterministic schemas
- Ledger math is performed with exact integer cents, never floating-point LLM math
- Users maintain full manual review and override controls over all categorization
CSV Formula Injection Defense
Exporting financial data to spreadsheets carries known formula injection risks. FinBrain automatically strips and escapes dangerous leading characters before generating CSV exports, protecting downstream analysts.
- Automated sanitization of =, +, -, @, \t, and \r prefixes
- Prevents malicious DDE execution in Microsoft Excel and Google Sheets
- Safe deterministic CSV generation across all transaction exports
Server-Only Secrets & Key Isolation
Browser clients only receive public publishable configuration keys. All administrative credentials, master encryption keys, storage access tokens, and AI service secrets are isolated behind server-only boundaries.
- AES-256-GCM envelope encryption for sensitive stored credentials
- Next.js server-only compiler boundary preventing accidental frontend leaks
- Automated secret rotation and least-privilege IAM policies
PII Redaction & Clean Audit Logs
Operational telemetry, debugging sinks, and application logs are systematically scrubbed of Personally Identifiable Information (PII) before transmission.
- Automated masking of account numbers, tokens, and authorization headers
- Structured JSON audit logging for security-relevant administrative actions
- Strict data retention schedules for temporary processing artifacts
Responsible Security Research
FinBrain values the contributions of independent security researchers. If you believe you have discovered a vulnerability or security flaw in our platform, please report it immediately to our security response team.
Guidelines: Please do not attempt to access or modify data belonging to other users, execute denial of service attacks, or violate personal privacy. We commit to acknowledging valid security reports within 48 business hours.
Experience financial intelligence with true peace of mind
Start organizing your accounts, analyzing transactions, and managing cash flow today.