Your financial data is treated like what it is.
Financial data is sensitive. We designed DeductSam's security from the ground up — not as an afterthought. Here is exactly what we do to protect your information.
256-bit encryption
All data stored in our database and file storage is encrypted at rest using AES-256 — the same standard used by financial institutions. All data in transit uses TLS 1.2 or higher. HSTS headers ensure your browser enforces HTTPS for every visit.
Read-only bank access
When you connect your bank account via Plaid, DeductSam receives read-only transaction data. We cannot move money, initiate transfers, or modify your accounts. Your banking credentials go directly to Plaid — DeductSam never sees them. You can revoke access from Settings at any time.
Server-side key management
API keys for Plaid, OpenAI, Stripe, Apple, and our email provider are stored exclusively on our servers and are never bundled into the frontend application code. If you inspect DeductSam's JavaScript, you will not find credentials there. Third-party integrations are brokered through our servers on your behalf.
No plaintext passwords
DeductSam never stores your password. Authentication is managed by Supabase Auth, which uses industry-standard bcrypt hashing. Password reset flows use one-time tokens delivered to your email — not security questions. Two-factor authentication (TOTP) is available from Settings and uses cryptographically secure recovery codes.
Rate limiting on API endpoints
Every API endpoint you call — including AI, account, and data operations — has server-side rate limiting. The endpoints that receive notices from Plaid and Stripe, and our scheduled jobs, are not rate-limited; they verify a signature or a secret instead. This protects against brute-force attacks, credential stuffing, and automated abuse. AI endpoints that interact with OpenAI have additional limits to prevent misuse.
Row-level data isolation
Our database enforces row-level security (RLS) policies that verify your user ID on every query. Your data is visible only to your account and to the people you invite to your team, with the access you give them — the database itself enforces this boundary, not just the application layer.
Security headers
Every response from DeductSam includes HTTP security headers: Content Security Policy (CSP) restricting resource origins, X-Frame-Options preventing clickjacking, X-Content-Type-Options preventing MIME sniffing, and Referrer-Policy controlling information leakage. These are enforced at the CDN layer — not just in application code.
Error monitoring
Application errors are tracked by Sentry so we can diagnose and fix bugs quickly. Error reports include the error message, a stack trace, the app version, your device model and OS version, and the IP address the request came from. Some reports also carry the internal identifier of your account, a workspace, or a record, so we can find the problem. We do not deliberately put your amounts, merchant names, or business data into error reports, and reports from our servers are scrubbed before they are sent. Reports from the app itself are not filtered the same way, so an error message can occasionally include something that was on screen, such as a file name. See the Privacy Policy for the full list of what a diagnostic report contains.
Where your data lives
A plain-language explanation of the data flow inside DeductSam.
Your expenses and receipts
Stored in Supabase-managed PostgreSQL (encrypted at rest). Receipt image and PDF files are stored in Supabase object storage (encrypted at rest). Storage paths are user-scoped — a URL for your receipt will not work for another signed-in user, other than team members you have invited with access to your receipts.
AI processing (Sam)
When Sam analyzes your expenses or answers a question, relevant data (expense descriptions and notes, merchant names, your business profile and household answers, and your messages to Sam) is sent to OpenAI's API via our server — never directly from your browser. To read a receipt or a tax form you upload, we send OpenAI the image itself, as it is: we do not screen or redact it, so anything printed on it — on a tax form that can include a Social Security number or an account number — goes with it. Cover those numbers before you upload if you'd rather they not. If you dictate an expense or a message, the recording itself is sent to OpenAI to be turned into text. We do not send your email address to OpenAI. OpenAI processes this data under their API data usage policy, which you can review at openai.com/policies.
Bank sync (Plaid)
When you connect your bank via Plaid, you authenticate directly with Plaid — your banking credentials never touch DeductSam's servers. Plaid provides us a read-only access token, which we keep on our servers. We use that token to pull transaction amounts, dates, descriptions, and merchant names. Full account numbers and routing numbers are never shared with DeductSam.
Payments (Stripe)
Subscription billing on the web is handled by Stripe. Payment card information is entered directly into Stripe's hosted checkout — it is never transmitted to or stored by DeductSam's servers. We receive a Stripe customer ID, your subscription status, and the details of each charge. If you subscribe in the iOS app, Apple handles payment and we receive the subscription status from Apple. If you connect your own Stripe account to take invoice payments, we also keep that account's ID.
Found a security issue?
We take security reports seriously. If you discover a vulnerability in DeductSam, please email us at admin@deductsam.com with "Security" in the subject line. We aim to acknowledge your report within two business days and will work to address the issue promptly. We ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it.
Report a Vulnerability →