FinBoard Security Overview
At FinBoard, we prioritise the security of our users' financial data through a minimal data storage approach. We store only essential authentication and integration data. Our data infrastructure is hosted within the United States. Here's an overview of our security practices.
Core Security Principles
Minimal Data Storage
We store only essential user authentication and integration data
User financial data is processed in real-time and is not stored on our server
US-Based Operations
All infrastructure, data processing, and storage are entirely US-based, utilising secure cloud services within US data centers
Backend Infrastructure
Data Storage and Processing
User authentication: Securely stored with industry-standard hashing
QuickBooks integration: AES-256 encrypted at-rest in US-based databases
Financial data: Processed in-memory, never persistently stored
Sensitive info: No caching or logging of financial details
Data locality: All processing on US-based servers
API Security
TLS 1.3 encryption for all API communications
Stateless authentication using JSON Web Tokens (JWT)
Short-lived access tokens with configurable expiration
Secure token signing using HS256 algorithm
Regular rotation of server-side JWT signing keys
Debugging and Troubleshooting
Anonymised, ephemeral log data for issue resolution
No user-identifiable financial information in logs
This security overview is regularly updated. For the latest version or to report security concerns, please contact our security team at [email protected].