Security & trust

Coinpath holds some of the most sensitive information a household has. Coinpath Financial Software, LLC builds the product so that every record is scoped to the person or household that owns it, and so that no internal shortcut can quietly widen that scope.

Encryption

• TLS 1.2+ for all traffic between your device and our edge network.
• AES-256 encryption at rest for the database, backups, and uploaded documents.
• Uploaded files live in private buckets reachable only via short-lived signed URLs.
• Credentials and API keys are held in a managed secret store, never in source code.

Access controls

• Every table enforces row-level security. Reads and writes are filtered by your user id or your household membership at the database layer, not just in application code.
• Roles are stored in a dedicated table and evaluated by a hardened database function, so a compromised profile record cannot grant itself elevated access.
• Administrative screens sit behind a separate role gate with an append-only audit trail.
• Bank and credit connections are opt-in and revocable from your settings at any time.

Monitoring and testing

• Automated security scans and dependency audits run on every pull request.
• Row-level-security regression tests run in CI and block merges on failure.
• Production health, uptime, and error budgets are monitored continuously.
• Backups are taken daily and restore drills are exercised on a recurring schedule.

Subprocessors

We share the minimum data required with the following providers:

• Supabase — Managed Postgres, authentication, and encrypted file storage
• Cloudflare — Edge hosting, TLS termination, and DDoS protection
• Plaid — Bank account linking and transaction retrieval (opt-in)
• Array — Credit score and credit report retrieval (opt-in)
• Paddle — Subscription billing and tax handling
• Resend — Transactional email delivery

Responsible disclosure

If you believe you have found a vulnerability, report it privately to security@coinpathapp.com or through our contact form using the “Security report” topic. We acknowledge reports within two business days and aim to ship a fix or mitigation within 30 days.

Please do not run automated scans against production, access accounts that are not yours, or degrade service for other users. We will not pursue legal action against researchers who follow this policy in good faith.

Your data rights

You can export or permanently delete your data from your account settings at any time. See our privacy policy for retention periods and legal detail.