Security and your data at Abacus & Olive

Last updated: June 23, 2026

We know you’re trusting us with sensitive financial information — account balances, credit card transactions, real estate equity, investment values, beneficiaries. This document explains what we do (and what we don’t do) to keep that data safe. It’s written to be honest and specific. If anything here is unclear or you want more detail, email us at info@abacusandolive.com.

The short version

• Your data lives on encrypted servers (AWS US-East via Supabase) and is fetched fresh each time you open the app.
• Only you and the household members you explicitly invite can see your data. Other customers cannot, even if they tried — the database enforces this at the row level.
• We never see your credit card number (Stripe handles that). We never see your password in readable form (only a salted hash). We never sell your data, ever.
• Every administrative account on our side requires two-factor authentication, with recovery codes stored offline.
• We never train AI on your data. Period. Our AI assistant (“Stache”) only sees the chat messages you send it, and under our agreement with Anthropic, those messages aren’t used to train models.

Where your data lives

Your financial data is stored in a PostgreSQL 17 database managed by Supabase, in their US-East-1 region (Northern Virginia, USA). Supabase runs on AWS infrastructure, which is SOC 2 Type II, ISO 27001, PCI DSS, and HIPAA certified at the infrastructure level.

Your uploaded files (receipt photos, etc.) live in either:

• Our private Supabase storage bucket (the default), or
• Your own Google Drive, OneDrive, or Dropbox if you opt into our “Bring Your Own Cloud” plan. In that case, the files are in your cloud account — we just hold an OAuth token that lets the app read and write to a sandboxed folder you create. You can revoke that access from your cloud provider’s settings at any time.

Our web application is hosted on Vercel, a global edge platform. Vercel doesn’t store your data — it just serves the HTML, JavaScript, and CSS that make up the Abacus & Olive interface.

Payment processing is handled entirely by Stripe. Stripe is PCI DSS Level 1 certified — the highest level. Your credit card number never touches our servers. It goes from your browser directly to Stripe, who returns us only a payment-method token (an identifier we use to charge subscriptions through them, but which is useless to anyone else).

How we protect access to your account

Your password is hashed with bcrypt before being stored, with a unique per-user salt. We genuinely cannot read your password — even if someone broke into our database, they wouldn’t get a usable list of credentials. If you forget it, you reset it (we email you either a one-time link or a 6-digit code, your choice).

Sign-in sessions are stored in your browser as encrypted JWTs (JSON Web Tokens). They auto-expire after a period of inactivity, and our app force-signs-you-out after extended idle time (currently 30 minutes) on every device.

Two-factor authentication is supported. We strongly recommend turning it on (Settings → Security → Two-Factor Authentication). Use an authenticator app — not SMS — for the strongest protection against account takeover.

Device limits. A single account can be active on up to 4 devices at once (configurable). When you exceed the limit, we ask you to pick a device to sign out before letting the new one in. This means if your phone is stolen, you can sign in elsewhere and revoke the phone immediately.

How we isolate customers from each other

Every database table that contains user-specific data has Row Level Security (RLS) policies enforced at the PostgreSQL level. RLS means a query like “give me all transactions” doesn’t return all transactions in the database — it only returns rows where the caller’s authenticated identity matches the row owner. This isn’t a check in our app code (which we could forget to write); it’s a check inside the database itself.

The practical result: even if a logged-in attacker somehow crafted a malicious query, the database would refuse to return anyone else’s rows. We rely on this as the primary isolation guarantee, not just as a backup.

Inside a household (where you’ve invited a spouse, partner, or family member), the members you’ve granted full access to can see everything in that household. Members granted limited access can only add receipts. You control the invite codes, you control who has which role, and you can remove a member at any time from Settings → Household.

How we encrypt your data

In transit: every connection between your browser and our servers uses TLS 1.2 or higher (HTTPS). You can see this in your browser’s address bar — there’s no HTTP fallback.

At rest: the Supabase database, Supabase file storage, and AWS-backed infrastructure all encrypt data on disk using AES-256. This means if someone physically stole a drive from an AWS data center, they couldn’t read the contents.

Database backups (we keep nightly snapshots) are also encrypted.

How we monitor for problems

• Error monitoring via Sentry — when something breaks in the app, we get notified within minutes and can usually fix and deploy a patch the same day.
• Semiannual security audits — every January and July, we audit every API token, every connected service, and re-verify two-factor authentication is still enabled on every administrative account.
• Dependency scanning — we use npm audit to detect known vulnerabilities in our software dependencies and apply patches.
• Customer feedback alerts — when you submit feedback or a bug report through the in-app form, we get an email immediately. We see it within hours, usually faster.

What we don’t store (and never will)

• Your password in any readable form. Only the salted hash, which can’t be reversed.
• Your credit card number. Stripe holds that; we only see a payment-method token.
• Your bank login credentials. We don’t have any “connect your bank” feature that asks for your bank password. All transactions are entered by you, by your household members, or via OCR’d receipts you forward to us.
• Any data on your computer or phone permanently. The app caches some files (the app’s own JavaScript and CSS, plus a sign-in token) but your financial data is fetched fresh from our servers each time you open the app.
• Anonymous tracking, ad pixels, or third-party analytics scripts. No Google Analytics, no Facebook Pixel, no Mixpanel sending us data about your browsing habits.

Backups and disaster recovery

We take a nightly snapshot of your household’s data and store it in encrypted form. If you’re on the “Bring Your Own Cloud” plan, the snapshot also goes to your cloud folder so you have an independent copy you can keep even if you cancel.

You can also download a full JSON export of your household’s data at any time from Settings → Household → Download backup. This gives you a copy of every transaction, account, bill, property, receipt, and beneficiary you’ve ever entered.

If we ever experienced a catastrophic failure of our primary database, we could restore from the most recent snapshot — typically losing at most 24 hours of data.

Subprocessors

We share specific slices of your data with the following service providers, each only with the data needed to perform their job:

If we add new subprocessors in the future, we’ll update this list and notify active subscribers by email.

Our internal security practices

A short list of things we do behind the scenes that customers don’t usually see:

• Two-factor authentication is enabled on every administrative account we have — Stripe, Supabase, Vercel, Webflow, Squarespace (DNS), and both Google Workspace accounts. Recovery codes for every account are stored offline in an encrypted password manager.
• Stripe-issued customer emails come from our domain (receipts@abacusandolive.com, billing@abacusandolive.com, etc.) — DKIM-signed and SPF-aligned so phishing impersonation is harder.
• DMARC enforcement on our domain prevents spoofed “from Abacus & Olive” emails.
• No long-lived API tokens with broad scope. Service-to-service calls use short-lived JWTs; long-lived secrets (database service keys, Stripe secret key) live only inside our edge function environments.
• Semiannual rotation of any tokens that are over 12 months old, with audit logs of each rotation.
• Production deploys via Git — every change ships through a reviewed pull request and an automated build. No direct edits on production servers.

Bring Your Own Cloud (BYOC)

If you’d rather keep your receipt photos and database backups on your own infrastructure, our BYOC plan lets you connect Google Drive, OneDrive, or Dropbox. The app reads and writes to a sandboxed folder in your cloud, and we never touch the underlying file storage.

This is a great option if you have strict data-residency preferences, a corporate compliance policy, or just want belt-and-suspenders ownership of your financial records. There’s a small monthly discount on the BYOC plan because we don’t carry the storage cost.

You can switch between BYOC and our Hosted plan at any time from Settings → Billing.

Reporting a vulnerability

If you discover a security vulnerability in Abacus & Olive, please email info@abacusandolive.com with the details. We treat security reports seriously and respond within 48 hours.

Please don’t publicly disclose vulnerabilities before we’ve had a chance to fix them. We commit to:

• Acknowledging your report within 48 hours
• Fixing confirmed vulnerabilities promptly
• Crediting you publicly if you’d like (or keeping you anonymous if you’d prefer)

We don’t currently run a paid bug bounty program, but we genuinely appreciate good-faith reports and will thank you publicly.

A note on honesty

No software is 100% secure. We’ve done our best to make the right architectural choices (database-level isolation, end-to-end encryption, two-factor everything, professional subprocessors), but anyone who claims their system can never be breached is selling something.

What we can promise:

• We’ve designed Abacus & Olive so that a breach in one area (say, a stolen developer laptop) doesn’t expose your data — too many layers between attacker and your financial records.
• If something does go wrong, we’ll be transparent. We’ll email affected customers, explain what happened in plain language, and tell you what we’re doing to fix it.

Questions? Just email info@abacusandolive.com. We read every message.

— John and Jess
Abacus & Olive