Security

1. Account protection

FinFuse operates its own sign-in. No third-party identity service sits between you and your account.

Passwords are never stored as written. Each password is kept only as a one-way scrypt hash with its own random salt, so it cannot be read back, including by us.

Repeated failed sign-in attempts are rate-limited, by network address and by email address, to prevent guessing.

2. Sessions

When you sign in, FinFuse sets a signed session cookie. It is marked Secure and HttpOnly, so it travels only over encrypted connections and cannot be read by scripts in your browser.

Your session is checked against your account on every request before anything is shown.

Sessions end after 30 days of inactivity. Changing your password, or choosing Sign out everywhere in Settings, ends every other session at once.

3. Password resets

A password reset link is sent only to the email address on the account. It can be used once and expires one hour after it is issued. Only a hash of each link is stored.

4. Encryption in transit

FinFuse is served only over HTTPS, with strict transport security, so information you send us is encrypted on its way.

5. Bank connections

Connecting a bank is optional. If you choose to, you sign in to your bank inside a window run by Plaid, our bank-connection provider. Your bank username and password go to Plaid and your bank. They are not entered on FinFuse, and FinFuse does not receive or store them.

What FinFuse receives from Plaid is an access token that lets it ask Plaid about the accounts you chose. FinFuse encrypts that token (AES-256-GCM) before storing it, with a key kept in the server’s configuration rather than in the database. The token is never sent to your browser.

FinFuse asks Plaid for the name, last four digits, type and balance of each account you chose, every time they are shown, and does not keep them. If you press Use its balances, those figures are copied into your saved numbers and stored with them. Linking also asks Plaid for permission to read transactions; FinFuse does not read or store them today.

Before the Plaid window opens, FinFuse shows what it will access and asks you to agree, and records when you did and which version of the words you saw. You can unlink your bank, or delete your account, at any time; either one tells Plaid to remove the connection. See the Privacy Policy and our data retention and deletion policy.

6. Encryption at rest

Bank access tokens are encrypted by FinFuse itself before they reach the database, as described above. Everything else we store, including your account details and saved numbers, sits in a database whose provider encrypts stored data at the storage level. FinFuse does not add its own encryption to those fields.

7. What we never hold

• Bank usernames or passwords. They go to Plaid and your bank, not to FinFuse.
• Your bank account and routing numbers. If you use a linked bank to fund an investing account, FinFuse gives your brokerage partner a one-time Plaid token instead of the numbers.
• Your money or securities. An investing account is opened and held by our brokerage partner, Alpaca Securities LLC, not by FinFuse. FinFuse sends orders you place to it and shows you the result, but does not hold the funds or the holdings.
• Card numbers. Payments for memberships are taken inside Whop’s checkout.

8. Your controls

You can download everything you have entered, delete your numbers, unlink a connected bank, sign out everywhere, or delete your whole account from Settings at any time.

9. Reporting a security issue

If you believe you have found a security issue, please contact us through our contact page. Please give us a reasonable chance to fix it before disclosing it publicly.