Encryption at rest
All data encrypted with AES-256-GCM via managed KMS. Sensitive fields (notes, raw bank descriptions, OCR output) use per-user envelope encryption — your key, your data.
Security
Your money data is sacred.
We designed EXPOZOR from the ground up with privacy and security as first-class requirements — not afterthoughts.
Security pillars
Row-Level Security
Every user-scoped table in Postgres enforces RLS. Even if a bug exists in application logic, the database enforces that users can only see their own data.
Zero trackers in the app
No third-party trackers inside the authenticated experience. Analytics are first-party (PostHog, reverse-proxied). Your spending habits stay private.
Infrastructure
TLS 1.3 everywhere. HSTS preload. Strict CSP. SRI for any third-party script. Environment separation: real data never appears in local or preview environments.
GDPR & data rights
Export or delete your data in under 24 hours. Inactive accounts are warned after 24 months then auto-deleted. Audit logs retained 13 months.
Responsible disclosure
Found a security vulnerability? We take all reports seriously and aim to respond within 48 hours. Please email security@expozor.app with a description of the issue and steps to reproduce.
We follow a 90-day coordinated disclosure policy. Researchers who report valid vulnerabilities will be credited (with permission).