How we protect your data

Security here is a set of enforced boundaries, not a promise. This page describes what the system actually does.

We never ask for your bank password

OctoLedger does not connect to your bank using your credentials. You download statements from your bank and upload them. There is no stored bank password, and no third-party aggregator between you and your account.

Encryption at rest

Financial records are encrypted before they are stored, using per-workspace keys that are themselves wrapped by a managed key service. Key material is never written to logs or returned to a browser.

Tenant isolation enforced by the database

Each household is a separate tenant, and isolation is enforced by row-level security inside PostgreSQL rather than only by application code. A query that is not scoped to your workspace returns nothing, even if application logic were to ask for it.

Least privilege by default

The application connects with a role that can call a small set of reviewed functions — it cannot read or write tables directly. Database objects are not created in a shared schema, and every privileged operation is schema-qualified.

Uploads are treated as hostile

Uploaded files are held in quarantine, scanned for malware before anything parses them, and size- and shape-limited. A file that fails scanning is rejected and never reaches the parser.

An append-only record

Significant actions are recorded in an audit trail that the application cannot modify or delete. Access to that record is itself restricted and audited.

Honest about what is not claimed

OctoLedger is in active development. We do not claim certifications we have not completed, and this page will say so explicitly when that changes. If you need a specific assurance for your situation, contact us before sharing data.

Last updated 2026-09-26