Is my data secure?

Is my data secure?

Yes. Fiscal Flowcast takes data security seriously. We use industry-standard encryption, secure connections, and best practices to protect your financial information. Here's what we do to keep your data safe.

Encryption in transit and at rest

• In transit: All data sent between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS). We enforce HTTPS on all endpoints.
• At rest (infrastructure): All data stored on Google Cloud (Cloud Run, Cloud SQL) is encrypted at rest by Google Cloud's default storage encryption.
• At rest (application layer): A subset of high-sensitivity credentials — Plaid connection tokens and MFA secrets — are additionally encrypted with AES-256-GCM in the application before storage. Not every database column uses application-layer AES; see our Trust Center for details.
• Passwords: Passwords are stored as salted bcrypt hashes — plaintext passwords are never retained.

Secure bank connections

When you link a bank on Basic and above, we use Plaid, a trusted financial data platform used by thousands of apps (including Venmo, Robinhood, and Betterment). Free does not include bank linking. Here's how it works:

• You sign in to your bank through Plaid's secure window, not through Fiscal Flowcast. Your credentials go directly to Plaid and your bank, not to us.
• Plaid uses your credentials only to establish a secure connection. They are not stored in a way that allows anyone to log in as you.
• Fiscal Flowcast only receives the data you consent to: account names, types, balances, and transactions. We don't see your bank username or password.
• You can disconnect your bank at any time from the Accounts page, which revokes our access immediately.

Access controls

• Authentication: You must sign in with your email and password (or OAuth provider like Google) to access your account. We support optional two-factor authentication (2FA) for extra security.
• Session management: Sessions expire after a period of inactivity. If you leave your device unattended, you'll be logged out automatically.
• Role-based access: If you share an entity with team members (PREMIUM and ENTERPRISE plans), you can control who has access and what they can do (view, edit, or admin).

Infrastructure and compliance

• Hosting: Fiscal Flowcast is hosted on Google Cloud with monitoring, firewalls, and access controls.
• Backups: Your data is backed up regularly to multiple locations. If something goes wrong, we can restore your data quickly.
• Compliance: We follow best practices for data protection and privacy, including GDPR (for EU users) and CCPA (for California users). We don't sell your data to third parties.

What you can do

Security is a shared responsibility. Here's how you can protect your account:

• Use a strong, unique password. Don't reuse passwords from other sites. Use a password manager if needed.
• Enable two-factor authentication (2FA). If available, turn on 2FA in your account settings for an extra layer of protection.
• Log out on shared devices. If you use Fiscal Flowcast on a public or shared computer, always log out when you're done.
• Keep your email secure. Your email is the key to your account. Use a strong password and 2FA on your email account as well.
• Review recent sessions. Check your account settings for a list of recent sign-ins. If you see anything suspicious, change your password immediately.
• Be cautious of phishing. We'll never ask for your password via email or text. If you receive a suspicious message claiming to be from Fiscal Flowcast, don't click links or provide your password. Contact support directly.

Data privacy

• We don't sell your data. Your financial information is yours. We don't sell it to advertisers, data brokers, or anyone else.
• Minimal data collection. We only collect data necessary to provide the service (account details, transactions, usage analytics to improve the app).
• You control your data. You can export your data at any time (CSV, PDF, Excel, or JSON depending on your plan). You can close your account in Settings. That deletes the financial data in your books, disconnects linked banks, and signs you out. A closed account record can still include your name, and other records are kept. See the Data Deletion page.

What if I have a security concern?

If you believe your account has been compromised or you've found a security issue, contact us immediately at security@fiscalflowcast.com. We take security reports seriously and will respond promptly.

For our full public security posture, see the Trust Center. See also Account Security and Settings, Connecting your bank with Plaid, and our Privacy Policy (link in footer).

Related articles

• Account Security and SettingsManage your profile, password, and account settings.
• Connecting your bank with PlaidBasic and above: connect a US bank with Plaid. Free accounts add accounts and transactions by hand — no bank linking or sync.
• Getting Started with Fiscal FlowcastLearn how to set up your account, create your first entity, and start tracking your finances.