Security & Privacy

Your data is safe.
Here's exactly how.

Nautilius Money is built on a deliberate principle: sensitive financial data should live inside certified infrastructure, not ours. We connect the pipes — Plaid, Supabase, and Stripe hold the data and carry the certifications.

🏦
Plaid
SOC 2 Type II · ISO 27001
Certified
Your bank credentials never touch our servers
  • ✓OAuth-based connection — you log in directly with your bank, not with us
  • ✓Nautilius Money receives a secure access token, never your username or password
  • ✓We request read-only transaction data only — no account or routing numbers imported
  • ✓Payment initiation products are not enabled, making fund movement architecturally impossible
🗄️
Supabase
SOC 2 Type II · HIPAA eligible
Certified
Data encrypted at rest and in transit
  • ✓AES-256 encryption at rest; TLS 1.3 in transit on every request
  • ✓Row-Level Security (RLS) enforced at the database layer — one user can never read another's data
  • ✓Data hosted in US-East region; no cross-border transfers
  • ✓Automated backups with point-in-time recovery
💳
Stripe
PCI DSS Level 1
Certified
Card numbers never enter our systems
  • ✓All payment processing handled entirely within Stripe's PCI-certified environment
  • ✓Nautilius Money never sees, stores, or logs your card number, CVV, or billing details
  • ✓Subscription tokens are the only payment reference stored on our side
  • ✓Stripe Radar fraud protection active on all transactions
How It Works

Security built into the architecture

These aren't policies or promises — they're constraints enforced by how the system is built.

🔑
Zero credential storage
We never store bank usernames, passwords, or PINs. Plaid's OAuth flow means your credentials go directly to your bank's servers. Nautilius Money receives only a time-limited access token.
🚫
No account numbers by design
Plaid offers an "Auth" product that returns account and routing numbers. Nautilius Money deliberately does not request it. We use transaction and balance data only — your account numbers are never in our database.
👁️
Read-only, always
The Plaid connection Nautilius Money creates has no payment or transfer products attached. Even if our systems were fully compromised, there is no technical path to move money from your accounts.
🏗️
Certified infrastructure, not certified Nautilius Money
Rather than pursuing our own SOC 2 certification (which audits internal processes), we architect so that sensitive data lives exclusively inside certified third parties. Plaid, Supabase, and Stripe carry their own Type II certifications — covering the data that actually matters.
🔒
Row-level isolation
Supabase Row-Level Security policies mean your financial data is isolated at the database layer — not just in application code. Even a bug in our API cannot return another user's data.
🗑️
Right to deletion
Disconnecting an account immediately revokes the Plaid access token and queues deletion of associated transaction data. You can delete your Nautilius Money account and all data from Settings at any time.
Our Commitments

What Nautilius Money will never do

These aren't buried in a terms of service. They're architectural decisions we've made permanent.

✕Store your bank username or password
✕Import account or routing numbers
✕Enable any payment or transfer capability
✕Sell your financial data to third parties
✕Share data with advertisers or data brokers
✕Store card numbers or CVV codes
📋
A note on SOC 2 certification

SOC 2 audits a company's internal systems and processes for handling sensitive data. Nautilius Money is designed so that the data requiring that level of oversight — bank credentials, card numbers, account numbers — never enters our systems in the first place.

The infrastructure partners we rely on (Plaid, Supabase, Stripe) each hold SOC 2 Type II certification and undergo independent annual audits. Our architecture is intentionally designed to keep Nautilius Money outside the scope of data that would require our own certification. As the product grows, we will pursue additional certifications where they add genuine user protection — not just compliance theater.

Security questions or concerns? security@nautiliusmoney.com