Security Practices

1. Overview

We design the product so sensitive credentials stay with appropriate processors (for example, bank passwords with your institution / Plaid Link; card numbers with Stripe). We apply access controls, encryption in transit, and least-privilege practices for production systems.

2. Application security

• HTTPS/TLS for traffic to the application.
• Authentication via our identity provider (Supabase Auth) with session cookies.
• Row-level security and role checks so workspace data is scoped to members with permission.
• Bank connect limited to authorized roles; consent required before opening Plaid Link.
• Secrets stored in environment configuration, not in source control.

3. Financial connections (Plaid)

• We store Plaid access tokens and Item identifiers needed to sync transactions — not your bank password.
• Tokens are held in our database with access restricted by workspace membership.
• Disconnecting a connection triggers Item removal with Plaid and deletion of local imported bank data for that link.
• Webhooks are verified so only authentic Plaid events update connection state.

Details: Bank Data & Plaid Disclosure.

4. Payments (Stripe)

Card and bank payment details for Checkout / Connect are processed by Stripe. We store payment metadata (status, amounts, customer references) needed for invoices and payouts — not full PAN data.

5. Infrastructure

Application hosting and database providers encrypt data at rest according to their platforms. Production access is limited to operators who need it. See Subprocessors.

6. Incident response

If we become aware of a security incident affecting your personal or financial-connection data, we will investigate and notify affected customers as required by applicable law. Report suspected issues to hello@economiqueelegance.com.

7. Your responsibilities

• Use strong unique passwords and protect account access.
• Invite only trusted teammates; revoke access when people leave.
• Disconnect bank links you no longer need.