Security
You're trusting Spendora with real financial data. Here's what we actually do to protect it — no vague "bank-grade" marketing claims, just what's built.
Authentication
Sign-in and account security are handled by Clerk, a dedicated authentication provider — we never store your password.
Encrypted in transit
All traffic to Spendora is served over HTTPS. Our database connection uses verified TLS, not just encryption without identity checks.
Data isolation
Every read and write is scoped to your account at the database level. There is no code path where one user can view or modify another user’s accounts, transactions, or invoices.
Input validation
Every server action validates its input before touching the database — amounts, currencies, and account references are checked, never trusted as-is from the browser.
Abuse & bot protection
Arcjet protects public and authenticated endpoints alike with rate limiting and bot detection, so scripted abuse of features like AI receipt scanning or guest invoicing is blocked automatically.
No data selling
We don’t sell your financial data, and we don’t use it to train AI models. It exists to power your dashboard — nothing else.
Found a vulnerability?
We take security reports seriously and will respond promptly. Please email hello@spendora.finance with details rather than disclosing publicly — we'll follow up directly.