Security

Last updated: October 24, 2026

Encryption at rest

Bank tokens (Plaid access tokens) are encrypted with AES-256-GCM before storage. Encryption keys are managed via AWS KMS (or environment variables in development). TOTP secrets for MFA are encrypted with the same AES-256-GCM layer. Passwords are hashed with scrypt (not bcrypt — scrypt is memory-hard and resistant to GPU attacks).

Encryption in transit

All HTTP traffic uses TLS 1.2+. HSTS is enabled. Mixed content is blocked. WebSocket connections (none currently) would use WSS.

Authentication

Email + password with scrypt hashing. Optional TOTP-based MFA (RFC 6238) via authenticator apps. Apple Sign-In and Google Sign-In available as OAuth alternatives. Session tokens are 32-byte cryptographically random, stored hashed (sha256) in the database, served via httpOnly cookies with SameSite=Lax. Sessions expire after 30 days. Password reset and email verification use single-use tokens with sha256 hashing and short TTLs (30 min and 7 days respectively).

Authorization

Every database query is scoped to the user's active household ID. The session resolver (getAuth) is called at the start of every authenticated route handler. No route returns data for a household the user is not a member of. Multi-tenant isolation is enforced via Prisma's query layer; in production (Postgres), row-level security policies provide defense in depth.

Rate limiting

Auth endpoints (sign-in, sign-up, password reset, MFA verify) are rate-limited per IP. The assistant is rate-limited per user (LLM cost control). Public quote and history APIs are rate-limited per IP. In single-instance deployments the limiter is in-memory; in multi-instance deployments Upstash Ratelimit + Redis is used.

Audit logging

Every sensitive action is logged: sign-up, sign-in, sign-out, MFA enable/disable, password reset, bank link/unlink, transaction import/export, scenario save/delete, estate document access, account deletion. Logs are retained for 7 years per GLBA Safeguards Rule requirements.

Honesty-first architecture

Sample data is always labeled with a Sample chip and never co-mingled with real data. Unconfigured services (Plaid, Stripe, email, OAuth) return honest error panels rather than fake success. The assistant's system prompt forbids fabricated numbers, fabricated filing claims, and fabricated property owner names. This is a deliberate compliance decision: it keeps MoneyMagic outside the regulatory perimeter of money transmission, broker-dealer regulation, and most insurance agent licensing.

Compliance

MoneyMagic maintains a Written Information Security Program (WISP) compliant with the GLBA Safeguards Rule (16 CFR Part 314) and Massachusetts 201 CMR 17.00. SOC 2 Type I audit in progress; Type II audit to follow. Annual penetration test by an external firm. Cyber liability + E&O + D&O insurance.

Incident response

We have a written incident response plan covering detection, containment, eradication, recovery, and notification. State data breach notification laws require affected residents to be notified within state-specific timelines (CA: 30 days; NY: "expediently"; most states: 45-90 days). If you believe you have found a security vulnerability, email security@moneymagic.app — we respond within 24 hours and acknowledge within 72 hours.

Vulnerability disclosure

We welcome responsible disclosure. Email security@moneymagic.app with details. We do not pursue legal action against good-faith reporters. We credit reporters in our public disclosure after the vulnerability is fixed.