Security

Your financial data deserves serious protection

Security is not a feature we bolted on — it is built into the foundation of Finly. Here is exactly what we do to keep your data safe.

AES-256-GCM Encryption at Rest

Sensitive fields — PAN numbers, folio numbers, bank account identifiers within investment records — are encrypted with AES-256-GCM before being written to the database. Keys are stored separately from data.

TOTP-Based Multi-Factor Authentication

All users can enable Time-based One-Time Password (TOTP) MFA via any authenticator app (Google Authenticator, Authy, etc.). MFA is enforced at login and for sensitive operations like data export and account deletion.

Secure Password Hashing

Passwords are hashed using bcrypt with a cost factor of 12 before storage. We never store passwords in plain text and never have access to your actual password.

JWT Authentication with Short Expiry

API access is authenticated via signed JWTs with short expiry windows. Refresh tokens are rotated on each use. Sessions are invalidated immediately on logout.

Rate Limiting & Brute-Force Protection

All authentication endpoints are rate-limited. Login attempts are throttled after repeated failures. API endpoints have per-user request limits to prevent abuse.

Google Cloud Storage — Private Buckets

Uploaded files (CAS PDFs, receipts, documents) are stored in private GCS buckets with no public access. Files are served via short-lived signed URLs that expire after 15 minutes.

Input Sanitisation & XSS Protection

All user inputs are sanitised server-side before processing. HTTP response headers include CSP, X-Frame-Options, and X-Content-Type-Options to mitigate common web attacks.

No Bank Linking — Zero Credential Exposure

Finly never asks for your bank credentials, broker logins, or Demat account passwords. There is nothing to steal. All financial data is entered manually or parsed from documents you upload.

Infrastructure Security

Finly runs on Google Cloud Run — a fully managed, serverless container platform. Cloud Run provides automatic isolation between requests, built-in DDoS protection via Google Cloud Armor, and auto-scaling to handle traffic spikes without manual intervention.

All data is stored in MongoDB Atlas with IP allowlisting, VPC peering, and at-rest encryption enabled. Database access uses least-privilege service accounts and credentials are never exposed in application logs.

All traffic between clients and our servers is encrypted with TLS 1.3. We enforce HTTPS everywhere and use HSTS headers to prevent downgrade attacks.

Application Security Practices

Our engineering practices include:

Static analysis and TypeScript strict mode enforced on every code change.
Dependency vulnerability scanning via npm audit on each CI run.
GitHub Actions CI/CD pipeline with automated build checks before deployment.
Secrets stored in Google Cloud Secret Manager — never in environment files or source code.
Database queries use parameterised inputs to prevent injection attacks.
Mongoose schema validation enforced at the model layer on all writes.

Responsible Disclosure

We take security vulnerabilities seriously. If you discover a potential security issue in Finly, please report it responsibly by emailing security@notchai.in.

Please include in your report:

A description of the vulnerability and its potential impact.
Steps to reproduce the issue.
Any proof-of-concept code or screenshots (if applicable).

We will acknowledge your report within 48 hours and aim to resolve critical vulnerabilities within 7 days. We ask that you do not publicly disclose the issue until we have had a reasonable time to address it.

We do not currently offer a bug bounty programme, but we deeply appreciate the effort of security researchers who help make Finly safer for everyone.

Questions about security?

We are happy to answer any security questions you have before trusting us with your financial data.

Contact Security Team