Our approach
Kountr is built by a small team that handles meaningful financial data. We design with the assumption that bad days happen — networks misbehave, credentials leak, vendors get breached — and we build so that no single failure exposes your books. This page describes the controls we actually run today. Where we don’t do something, we say so instead of implying we do.
Data in transit & at rest
- TLS for all traffic between your browser, our API, and every provider we call. The API is not reachable over plaintext HTTP.
- Encryption at rest for the application database and for the files you upload, provided by Supabase.
- Row-level security on every table. Postgres RLS is enabled database-wide, so a query can only reach rows belonging to the signed-in account — a defence that holds even if application code has a bug.
- Per-account scoping in the application layer as well, so tenant isolation doesn’t rest on a single mechanism.
Authentication & access
- Sign-in, password storage, password reset, and email verification are handled by Firebase Authentication (Google). Kountr never receives or stores your password.
- The API verifies a Firebase-issued token on every authenticated request.
- What we don’t have yet: multi-factor authentication, single sign-on (SAML/OIDC), and multi-user accounts with roles. Accounts are single-user today. We’ll update this page when that changes.
- Production access is limited to the founder and is used only when needed to operate or debug the Service.
Bank connections (Plaid)
- Bank credentials are submitted by you directly to Plaid. Kountr never receives, stores, or has access to your online-banking username or password.
- We request only Plaid’s Transactions product. We do not receive your full account number or routing/transit number, and the Service cannot move money.
- Plaid access tokens are stored with AES-256-GCM envelope encryption under a key held outside the database, so a leak of the database rows alone does not hand an attacker a working bank connection.
- You can revoke any connection from Connections in the app or from my.plaid.com.
- More detail in the Privacy Policy §4.
AI pipeline
AI features — receipt and document reading, bill-of-sale extraction, and categorization suggestions — are called server-side only. Your browser never talks to an AI provider, and no AI provider key is ever shipped to the client. The pipeline enforces:
- One account per request. A request carries a single account’s data, so one customer’s records can’t leak into another customer’s result.
- Purpose limitation. Content is sent only to complete the action you triggered — never bulk-exported to a model for unrelated processing.
- No training. Under Anthropic’s commercial API terms, our inputs and outputs are not used to train their models.
- Minimum necessary content. We send the document or transaction the feature needs, not your whole ledger.
Read the full AI Disclosure.
Application security
- Every pull request runs typechecking and the automated test suite in CI before it can merge.
- Changes reach production through a reviewed pull request and an automatic deploy from
main. - Secrets live in the hosting platform’s environment configuration, never in the repository.
- Database schema changes run as versioned migrations at service boot.
- Rate limiting on file-upload endpoints.
- Database backups are managed by Supabase on their standard schedule.
Infrastructure
- Database and uploaded files: Supabase, Canada Central region.
- API server: Render, Virginia, United States.
- Web app and marketing site: Netlify.
- Because the API and our AI, payment, auth, email, and analytics providers run in the United States, your data is processed outside Canada. We set that out plainly in the Privacy Policy §7.
Monitoring & incident response
- Structured application logging, plus platform metrics and deploy/health monitoring from our hosting providers.
- We are a small team without a 24/7 on-call rotation. Issues are triaged during working hours and urgently outside them when severity warrants.
- If we confirm a breach of personal information that creates a real risk of significant harm, we will notify affected customers and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and we aim to notify affected customers within 72 hours of confirming it.
Certifications
Kountr is not currently certified to SOC 2, ISO 27001, or any comparable framework, and we have not yet had a third-party penetration test. We would rather tell you that than let a badge-shaped gap imply otherwise. We’ll update this page if and when that changes.
Responsible disclosure
If you believe you’ve found a vulnerability, please email info@kountrfi.ca with enough detail to reproduce it. Please give us a reasonable opportunity to fix the issue before disclosing it publicly, and don’t access, modify, or delete data that isn’t yours while testing. We won’t pursue legal action against good-faith security research conducted under this policy.