Encryption in transit and at rest
All traffic between your device and our servers uses TLS 1.3. Your data is stored encrypted at rest using AES-256 on managed-disk volumes.
Last updated: May 2026
Security & Privacy
Your money is yours. So is your data. Here is exactly how we protect it.
Postgres Row-Level Security (RLS)
All user-data tables have Row-Level Security enabled, with policies scoping every row to its owner (auth.uid() = user_id). We re-check these policies with the database security linter before each deploy.
Modern auth + biometrics
Email/password, Google, and Apple sign-in. Device biometrics (Face ID / fingerprint) are supported where the browser or OS allows it. Passwords are bcrypt-hashed and checked against the "Have I Been Pwned" (HIBP) database.
We never sell your data.
We do not sell, rent, or share your financial data with third parties. We do not connect to your bank (no Plaid, no similar). You enter transactions manually or import/export as CSV.
Certified vendor infrastructure
Dinero Claro runs on Supabase (database and auth) and a hosting platform served through Cloudflare. Those certifications (SOC 2 Type II, ISO 27001) belong to our infrastructure vendors, not to Dinero Claro: we have not completed an audit of our own and we do not claim one. This includes automatic daily backups, monitoring and regional isolation. We also do not process health data, so HIPAA does not apply to our service.
Minimal data collection
We only store: email, the financial data you enter, and app preferences. We do not track your location, access your contacts, or read your SMS. Period.
What YOU can do
- Use a unique strong password (12+ chars). The app rejects breached passwords.
- Enable device biometrics (Face ID / fingerprint) where available.
- Sign out from shared devices.
- Report suspicious activity immediately to contact@dineroclaro.app
Found a vulnerability?
If you are a security researcher and found an issue, please report it responsibly to contact@dineroclaro.app. We respond within 48 hours. We don't have a formal bug bounty yet, but we publicly credit contributors.
Technical controls we apply today. SOC 2 / ISO 27001 certifications belong to our infrastructure vendors, not to Dinero Claro.
TLS 1.3 AES-256 Postgres RLS Secure cloud stack