Security
Privacy is part of the architecture.
Financial records deserve stronger boundaries than ordinary product data. Spenddeck is designed around least privilege and explicit ownership.
User-level isolation
Every finance table is protected by database row-level security. Queries are authorized against the signed-in user rather than a user identifier supplied by the browser.
- Row-level security on every owned record
- Foreign-key ownership checks
- No service-role secrets in the browser
Secure sessions
Authentication uses short-lived access tokens, refresh-token rotation, email verification, recovery flows, and secure cookie support.
Application safeguards
Inputs are validated at the form, service, and database layers. Content security and browser security headers narrow the impact of common web attacks.
- Strict validation
- Parameterized data access
- Security headers and no indexing of private routes
Privacy-conscious analytics
Product analytics must never contain balances, amounts, transaction descriptions, private notes, or goal values. Spenddeck does not sell financial information.