Security

1. What We Do to Protect Your Data

1.1 Encryption in Transit

All communication between your browser and Flotorq's servers uses HTTPS (TLS 1.2 or higher). Data is encrypted while moving between you and us. We do not serve any content over unencrypted HTTP connections.

1.2 Encryption at Rest

Your data is stored in Supabase-hosted databases. Supabase encrypts data at rest using AES-256 encryption. We do not manage the encryption keys directly — this is handled by Supabase's infrastructure.

1.3 Authentication

Account authentication is handled by Clerk, a dedicated authentication service. We do not store your password. Clerk handles password hashing, multi-factor authentication, and secure session management. We benefit from Clerk's security expertise rather than building authentication ourselves (which would be less secure).

1.4 Payment Security

We do not store payment card numbers, CVVs, or bank account details. All payment processing is handled by DodoPayments, which is PCI-DSS Level 1 compliant — the highest level of payment security certification.

1.5 Access Control

Production database access is limited to the application and, where necessary for debugging and maintenance, the Developer. We do not share database credentials with third parties beyond those necessary to operate the service.

1.6 Dependency Management

We make reasonable efforts to keep application dependencies updated to avoid known security vulnerabilities. We are aware that as a single developer, this review process is less systematic than an enterprise security team's.

1.7 Session Management

User sessions are managed by Clerk with appropriate expiration times. Sessions are invalidated on logout.

2. What We Do Not Do

We believe in radical transparency about our security posture. As a solo developer, we do not:

• Have a dedicated security team reviewing code and infrastructure continuously
• Conduct regular professional penetration testing (expensive; may be done periodically)
• Have a formal security incident response team
• Maintain SOC 2 compliance or other formal security certifications at this time
• Have a bug bounty program (though we welcome responsible disclosure — see Section 5)
• Guarantee zero-downtime security patching
• Review all third-party dependencies for security vulnerabilities on a defined schedule

This does not mean your data is unprotected. We use industry-standard infrastructure with strong built-in security. It does mean you should calibrate your trust accordingly.

3. Third-Party Security

A significant portion of Flotorq's security posture depends on our infrastructure providers:

• Supabase handles database security, encryption at rest, and infrastructure hardening
• Clerk handles authentication security, session management, and credential protection
• DodoPayments handles payment card security and PCI compliance
• Vercel handles web application hosting, DDoS protection, and TLS termination

Each of these providers has dedicated security teams and formal certifications. In many respects, using these established providers makes Flotorq more secure than if we built these components ourselves.

However, a breach at any of these providers could expose your data. We cannot control their security. If any provider suffers a breach that affects your data, we will notify you as described in Section 4.

4. Data Breach Notification

If we discover or are notified of a security breach that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to your personal data, we will:

• Investigate the incident to understand its scope and impact
• Contain the breach to prevent further unauthorized access
• Notify you by email as soon as reasonably practicable — and within 72 hours of becoming aware of a high-risk breach (as required under GDPR for EU users)
• Report to relevant data protection authorities where required by law
• Provide information about what happened, what data was affected, what steps we are taking, and what you can do to protect yourself

We will not delay notification to protect our reputation. You deserve to know promptly.

5. Responsible Disclosure

If you discover a security vulnerability in Flotorq, please report it to us responsibly before disclosing it publicly.

Our commitment:

• We will acknowledge your report within 48 hours
• We will investigate the issue and keep you informed
• We will fix confirmed vulnerabilities as quickly as possible
• We will not take legal action against security researchers who follow this responsible disclosure process
• We will credit you for the discovery if you wish (or maintain your anonymity)

We cannot currently offer monetary compensation for vulnerability reports, but we are genuinely grateful and will acknowledge your contribution.

6. Your Role in Security

Security is a shared responsibility. You can help protect your account:

• Use a strong, unique password for your Flotorq account
• Enable multi-factor authentication if available for your account
• Do not share your account credentials with others
• Sign out of shared devices after using Flotorq
• Keep your email account secure — it's the recovery path for your Flotorq account
• Export your data regularly if it is important to you
• Report suspicious activity to us immediately at whoose.mine@gmail.com

7. AI and Data Security

When you use Flotorq's AI features, your data interacts with third-party AI APIs (Anthropic, Groq). We take the following steps:

• We send the minimum necessary context to AI APIs
• We do not send raw journal entries to AI APIs without processing
• We do not send identified financial transaction details to AI APIs
• Queries to AI APIs are transmitted over HTTPS
• We do not store AI API responses beyond what is displayed to you

However, by using AI features, your queries and relevant context are sent to and processed by these third-party AI providers. Their data handling practices are governed by their own policies.

8. Known Limitations and Accepted Risks

By using Flotorq, you acknowledge these limitations and accept the associated risks. We are transparent about this because we believe you deserve to make an informed decision about where you store your personal data.

9. Updates to This Policy

We will update this Security Policy when our security practices change significantly. The "Last Updated" date at the top reflects the most recent revision.

For all security concerns: whoose.mine@gmail.com