Security overview

Last updated: October 26, 2026

Your financial data deserves the same care you’d expect from a bank. Here is exactly how we protect it.

Bank connections

• Accounts are connected through Plaid Link. You authenticate with your bank inside Plaid’s interface; your bank credentials are never sent to or stored by Shkor Money.
• Our access is read-only (Transactions and Liabilities products). We cannot move money.
• Plaid access tokens are encrypted at rest with AES-based authenticated encryption (Fernet: AES-128-CBC + HMAC-SHA256); the key is stored separately from the database with owner-only file permissions.
• Plaid webhooks are verified: we check the ES256-signed Plaid-Verification JWT against Plaid’s published key, its freshness, and the SHA-256 of the request body before acting on it.

Application security

• TLS 1.2+ everywhere (HTTPS only, HSTS), certificates managed automatically.
• Multi-factor authentication for every account: after the password, each sign-in requires a 6-digit one-time code sent to your verified email (10-minute expiry, 5 attempts). Bank connection is available only after MFA.
• Passwords hashed with scrypt and a per-user salt; minimum 10 characters; login rate limiting.
• Session tokens are random 256-bit values, stored server-side only as keyed HMAC hashes, delivered in HttpOnly, Secure, SameSite cookies, expiring after 14 days.
• Strict Content-Security-Policy, X-Frame-Options DENY, origin checks on all state-changing requests (CSRF protection), no third-party analytics or ad trackers.
• All user data access is scoped by user ID on the server; an audit log records sign-ins, bank links, disconnects and deletions.

Infrastructure

• Hosted in an ISO/IEC 27001-certified data center (Hetzner Online, Helsinki, Finland).
• Services run behind a reverse proxy bound to localhost; only ports 80/443 are public for the app. SSH is key-only.
• Database and secret files are readable only by the service account; encrypted backups.
• Production access is limited to named administrators with SSH keys and MFA on administrative accounts; access is reviewed quarterly.
• Documented information security policy and incident response plan; affected users are notified without undue delay in case of a breach.

Your controls

• Disconnect any institution in one click — we call Plaid /item/remove and delete its data.
• Export everything we store about you as JSON.
• Delete your account — all connections revoked and data erased.

Report a vulnerability

If you believe you’ve found a security issue, email support@shkor.com with “SECURITY” in the subject. Please give us reasonable time to fix it before disclosure; we won’t take legal action against good-faith research that respects user privacy.