Security
Your financial data, treated like the sensitive thing it is.
Personal finance data needs more care than typical SaaS, and FinSight is engineered with that in mind.
Tenant-scoped queries on every endpoint — no cross-workspace access
Encrypted sensitive fields at rest using Fernet-derived keys
JWT access tokens with refresh-token rotation
Argon2/bcrypt password hashing
Rate limiting, CORS allow-listing, secure CSV upload validation
Audit logging for sensitive actions and AI recommendation decisions
Webhook signature verification (Stripe)
Tenant + account data export and deletion endpoints — your data is portable