Security and trust

Security model

Private records are owner-scoped in the application and stored on Cloudflare infrastructure. Provider credentials stay server-side. Plaid and SimpleFIN connections are used only to retrieve data the user authorizes. Sensitive mutations require an authenticated session, same-origin requests, and server-side validation.

Account protection

Rubato stores slow salted password hashes rather than readable passwords. Session tokens are random, stored server-side only as hashes, sent in HttpOnly cookies, and expire after 24 hours of inactivity or seven days absolutely. Password changes and successful resets revoke earlier password sessions. Email verification and recovery links are random, hashed at rest, single-use, and time-limited.

Data boundaries

Rubato does not request or store a user's financial-institution password. Plaid Link or the selected provider collects those credentials directly. Rubato does not sell financial data. Optional AI review receives bounded summaries needed for the requested review—not provider tokens, account credentials, full account numbers, or unrestricted raw transaction exports.

Infrastructure controls

The deployed application uses HTTPS, security headers, server-side secrets, no-store responses for private pages and APIs, encrypted connection credentials, rate limits, request-size limits, audit records, and tested owner isolation. No system is perfectly secure, and Rubato does not claim SOC 2 certification or a completed independent penetration test unless and until those reviews are finished and published here.

Report a vulnerability

Email security@rubatoplan.com with a concise description, affected URL, reproduction steps, and impact. Do not access another person's data, disrupt service, use social engineering, or retain sensitive information. Rubato will acknowledge a credible report and coordinate a reasonable remediation timeline.

Machine-readable reporting details are available at /.well-known/security.txt.

More detail

See the service-provider list, AI disclosure, and Privacy Policy for data flows and user choices.

AI abuse prevention

Optional OpenAI requests include a stable, one-way pseudonymous safety identifier derived from the normalized account email. It is sent instead of the email address and is used for provider abuse detection, not as a financial-planning input.