Your bank credentials never reach us

How we protect your data

• In transit: every connection uses TLS 1.2 or higher, served over HTTPS only, with strict transport security and a content security policy.
• At rest: the database is encrypted, including its backups.
• Bank access tokens get a second layer. They are encrypted with a dedicated managed key before storage and are never written to logs or source code.
• Each organization's books live in their own isolated database schema rather than sharing tables with other customers.
• Every request is checked against your membership of the organization it names before any data is read.

Bank connections

We use Plaid to connect to your bank. Your banking username and password are entered into Plaid's interface and are never seen or stored by Even Margin. What we hold is a token that lets us read the account data you authorized, and nothing else.

Our access is read-only. Even Margin cannot move money, initiate payments, or change anything at your bank. You can revoke our access at any time from your Connections page or through the Plaid Portal.

What we do not claim

Being straight about the limits is part of being trustworthy about the rest. No system is perfectly secure, and we publish exactly what we do and do not do rather than implying certifications we do not hold.

Reporting a vulnerability

If you find a security issue, write to us. Test only against accounts you own, stop as soon as you have demonstrated the issue, and give us a reasonable window to fix it before disclosing.