We built Clarity Books with security as a first principle, not an afterthought. Here is exactly how your data is protected, in plain language.
Your database and file storage are encrypted with AES-256 at the infrastructure layer by our provider (Supabase), the same standard used by banks and the U.S. government. On top of that, we encrypt your Plaid bank-connection token with AES-256-GCM in our own application before it is stored.
All data traveling between your browser, our servers, and third-party providers is encrypted in transit with modern TLS (1.2 or higher). Our hosting and database providers negotiate current TLS versions and disable obsolete ones.
When you connect a bank account via Plaid, we receive a read-only token. We can see your transactions and balances. We cannot initiate transfers, move money, or interact with your account in any way.
Our database and authentication run on Supabase, which maintains a SOC 2 Type II certification, meaning an independent auditor has verified their security controls annually. Your code and assets are hosted on Vercel, which is also SOC 2 certified.
Internally, only the admin user you authorize can view your books. Access roles are encoded into your session JWT and verified on every request. No request can access another user's data, even with a valid session token.
Our database enforces row-level security policies at the Postgres layer, not just in application code. Even if a bug slipped through in our API, the database itself would reject unauthorized queries.
We never see or store your bank username or password. Plaid handles authentication directly with your financial institution using OAuth where available. Your credentials never touch our systems.
You can turn on two-factor authentication (TOTP) from your account settings on the web. Once enabled, signing in requires a one-time code from your authenticator app (Google Authenticator, Authy, 1Password, etc.) in addition to your password, an extra lock you control.
Close your account and your records (transactions, invoices, AI-learned rules, and the receipt and document files you uploaded) are deleted immediately and irreversibly. You can trigger this yourself from Settings: no phone call, no waiting. Encrypted infrastructure backups roll off within about 30 days.
We use Plaid to connect to your financial institutions. Plaid is trusted by Venmo, Robinhood, and thousands of fintechs. They authenticate you directly with your bank using OAuth wherever possible. Your username and password never pass through our servers.
The access token we receive is scoped to transactions and balances only. It cannot be used to initiate payments, view full account numbers, or change any account settings.
For categorizing transactions we send only a few fields. When you upload a document for the AI to read, the file is sent so Claude can read it. See the note below.
If you discover a potential vulnerability or have a question about how we handle your data, reach out directly. We take every report seriously.
brayden@claritybooksai.com