Security
How Fintrack Labs protects your data: no bank credentials, row-level isolation, TLS, and a strict content security policy.
Last updated: 27 August 2026 · Shyam Sundar (Sole Proprietor)
This page describes the security measures actually in place today. We have deliberately left out anything we cannot demonstrate — there is no certification we have not earned listed below.
1. We never hold the keys to your money
The single most important security property of Fintrack Labs is what it cannot do. There is no account-aggregation, screen-scraping or broker-login capability anywhere in the product. We never ask for your bank, broker, demat or mutual fund credentials, and we have no technical means to read those accounts.
This is a deliberate trade-off. It means more typing for you, and it means a breach of us can never become a breach of your bank — the credentials simply are not here to steal.
We also never receive your UPI ID, card number or bank details. Payments go directly to our payment partner; we only ever see the amount, date and a transaction reference.
2. Your data is isolated from other users
Your account and portfolio data live in a managed Postgres database (Supabase) protected by row-level security, so a query made by one account cannot return another account's rows. Passwords are hashed by our authentication provider and are never visible to us in readable form.
3. Encrypted in transit, everywhere
All traffic is served over HTTPS/TLS. The site sends a Strict-Transport-Security header with a two-year max-age covering subdomains, so browsers refuse to connect over plain HTTP even if a link tries to.
4. Hardened browser policy
The application is served with a strict Content Security Policy that permits scripts only from our own origin — no inline scripts, no eval, and no third-party script hosts. Framing is denied outright, MIME sniffing is disabled, referrer information is trimmed on cross-origin requests, and camera, microphone, geolocation and USB access are switched off at the browser level.
In practice this means that even if an attacker found a way to inject markup into a page, the browser would refuse to execute it.
5. Nothing financial is cached on your device
Our service worker is configured never to cache financial or authentication responses. Only versioned static build files are cached, and those change name on every deploy. Signing out clears the stored session.
6. Data you can take back
You can export your entire portfolio at any time from Settings, and delete your account and its data outright. Neither requires contacting us. See the Privacy Policy for retention periods and the complete list of service providers that process data on our behalf.
7. What we do not claim
We are a small, independent product and we would rather be plain about our limits than imply more than we have. We do not hold SOC 2, ISO 27001 or any comparable certification. We have not commissioned an external penetration test, and we do not operate a paid bug-bounty programme. No online service can promise absolute security.
Please use a strong, unique password. If we ever become aware of a personal data breach affecting you, we will notify you and the Data Protection Board of India without undue delay, as the law requires.
8. Reporting a vulnerability
If you believe you have found a security issue, please email [email protected] with enough detail for us to reproduce it. We will acknowledge your report within 2 business days and keep you updated until it is resolved.
Please give us a reasonable opportunity to fix an issue before disclosing it publicly, and please do not access, modify or delete data belonging to anyone else while investigating. We will not pursue action against researchers who follow those two principles in good faith.