Security practices
Published September 11, 2026. Operator: Evan Knight.
Security reports: louiecrooner@gmail.com. Please describe the issue without sending credentials or consumer financial records. Do not access another person's data to demonstrate an issue.
Current application safeguards
- Google identity tokens are verified server-side. Access requires an approved household membership or authorized owner setup.
- Application checks distinguish household administration and personal connection ownership. Household financial reads may be shared with approved members.
- Sessions use signed tokens and HTTP-only cookies. Bank-connection flows are bound to the acting user.
- Plaid access tokens are encrypted using AES-256-GCM before database storage, with the encryption secret configured separately from the database.
- The public website is served over HTTPS by Vercel. Supabase provides encryption at rest for its hosted database.
- The bank integration is read-only. Automated tests cover authorization and connection-ownership boundaries.
Scope of this statement
This page documents application practices, not an independent security audit or certification. Provider certifications do not certify Crooner. It does not attest to an operational enterprise security program, universal MFA enforcement, scheduled vulnerability scanning, or a fully implemented data-retention program.
Data requests
For access, correction, or deletion requests, email the same contact and see our privacy policy. Do not include passwords or full bank account numbers.