How we protect your data

All data stored by SpendLeak — including your transaction records, account data, and integration credentials — is encrypted at rest using AES-256 encryption managed by Supabase, hosted on AWS ap-southeast-2 (Sydney).

All communication between your browser and SpendLeak is encrypted using TLS (HTTPS). HTTP requests are redirected to HTTPS. We enforce modern TLS versions (1.2+).

SpendLeak uses Supabase Row Level Security (RLS) policies to enforce data isolation at the database level. Every query is scoped to your tenant — even a misconfigured application query cannot return another tenant's data. RLS is enforced on all tables containing user data.

When you connect a third-party accounting integration (e.g. MYOB Business), SpendLeak stores the OAuth access and refresh tokens required to retrieve your data. These tokens are:

• Encrypted at rest (AES-256)
• Scoped to the minimum OAuth permissions required
• Used only to retrieve your own transaction data
• Never shared with any third party
• Deleted when you disconnect the integration or close your account

Authentication is provided by Supabase Auth, which supports email/password sign-in with email verification. Sessions are managed via HTTP-only, secure, same-site cookies — they are not accessible to JavaScript running in the browser.

SpendLeak relies on the following third-party infrastructure providers:

• We do not store your bank login credentials — integrations use OAuth only
• We do not have the ability to initiate transactions or move money on your behalf
• We do not sell your data or use it to train machine learning models
• We do not use third-party advertising trackers

If you discover a security vulnerability in SpendLeak, please report it responsibly by emailing security@spendleak.com. Please include a clear description of the vulnerability and steps to reproduce it. We will acknowledge your report within 2 business days and aim to resolve valid issues within 30 days.

We ask that you do not publicly disclose the vulnerability until we have had the opportunity to address it.