We built Clarity Books with security as a first principle — not an afterthought. Here is exactly how your data is protected, in plain language.
Every row in our database — transactions, account balances, categorization rules, and your profile — is encrypted using AES-256 before it ever touches disk. The same standard used by banks and the U.S. government.
All data traveling between your browser, our servers, and third-party providers is encrypted end-to-end with TLS 1.3. Older, weaker TLS versions (1.0, 1.1) are rejected at the network level.
When you connect a bank account via Plaid, we receive a read-only token. We can see your transactions and balances — we cannot initiate transfers, move money, or interact with your account in any way.
Our database and authentication run on Supabase, which maintains a SOC 2 Type II certification — meaning an independent auditor has verified their security controls annually. Your code and assets are hosted on Vercel, which is also SOC 2 certified.
Internally, only the admin user you authorize can view your books. Access roles are encoded into your session JWT and verified on every request — no request can access another user's data, even with a valid session token.
Our database enforces row-level security policies at the Postgres layer — not just in application code. Even if a bug slipped through in our API, the database itself would reject unauthorized queries.
We never see or store your bank username or password. Plaid handles authentication directly with your financial institution using OAuth where available. Your credentials never touch our systems.
Close your account and your personal data, financial records, and AI-learned rules are permanently deleted from our systems within 30 days. You can trigger this yourself from Settings — no phone call, no waiting.
We use Plaid to connect to your financial institutions. Plaid is trusted by Venmo, Robinhood, and thousands of fintechs. They authenticate you directly with your bank using OAuth wherever possible — your username and password never pass through our servers.
The access token we receive is scoped to transactions and balances only. It cannot be used to initiate payments, view full account numbers, or change any account settings.
When we send a transaction to Claude for categorization, we strip all personally identifiable data first.
If you discover a potential vulnerability or have a question about how we handle your data, reach out directly. We take every report seriously.
brayden@claritybooksai.com