How we keep your money data safe

Financial data deserves more than a password. These are the protections built into Shortbread from the first line of code.

Your household is walled off by the database

Every record belongs to one household workspace, and Postgres row-level security decides who can see it. The app connects with a database role that cannot bypass those rules, so even a bug in our code can't show one household's data to another. Automated tests try to read, change and link across households on every change we make, and they must fail.

Two-factor sign-in on every session

• Sign in with single sign-on or with an email and a password of at least 12 characters.
• An authenticator code is required for every session, including single sign-on. It can't be turned off.
• Backup codes let you recover access if you lose your phone.
• Sign-in attempts are rate-limited.

Sensitive fields are encrypted

Account numbers, wallet addresses, tax ids, bank connection keys and receipt files are encrypted with AES-256-GCM before they reach the database. The keys live outside the database, and each value is tied to its household and field, so a copied value can't be decrypted anywhere else.

Roles for everyone in the household

• Owner: everything, including members and settings.
• Editor: can add and change financial data.
• Viewer: can see everything and change nothing.

The database enforces these roles too, not only the screens.

API keys you control

Personal API keys are shown once and stored only as a hash. Each key belongs to one person and one household, and is either read-only or read and write. Keys never return encrypted fields, and you can revoke them at any time.

AI stays optional and read-only

AI features are off until a household owner turns them on. When they're on, only what's needed to answer goes to the AI provider: descriptions, merchant names, amounts, dates and categories. Account numbers, tax ids and wallet addresses are never sent, and receipt photos only go if you separately turn on receipt reading. The assistant can only read; anything it suggests changing waits for you to confirm.

No money moves

Shortbread reads balances and transactions. It never initiates payments or transfers.

Your data stays yours

• Export everything as JSON, or transactions as CSV, whenever you want.
• Delete your workspace and its data at any time.
• Product analytics and emails never contain amounts, balances, account numbers or merchant names.

Found a problem?

If you think you've found a security issue, please email security@shortbread.money before sharing it publicly. We'll reply quickly.