How We Protect Your Data
We take a defense-in-depth approach. Multiple layers of security ensure that even if one layer is compromised, your data remains protected.
Encryption Layers
| Layer | Technology | What It Protects |
|---|---|---|
| In Transit | TLS 1.3 | All data between your browser and our servers |
| At Rest | AES-256 | Entire database encrypted on disk |
| Field-Level | AES-256-GCM | OAuth tokens, imported bank data, chat history |
| Passwords | bcrypt (cost 12) | Account passwords and worker PINs |
What We Encrypt
Third-Party Tokens
When you connect Xero or other services, the access tokens are encrypted before storage. Even with full database access, these tokens are unreadable without the encryption key.
Imported Transaction Data (CSV)
When you import CSV files, the raw transaction data is encrypted. Your transaction details are protected even if someone gains database access.
AI Conversations
Your chat history with the AI assistant is encrypted. The personal details you share in conversations are protected.
Authentication Credentials
Passwords and worker PINs are cryptographically hashed with bcrypt. We literally cannot see them — verification happens mathematically.
What This Looks Like in Practice
Most companies tell you their data is encrypted. We can show you.
When we rolled out field-level encryption across the full customer dataset, we caught a bug the same day: one nested relation wasn't being decrypted on read. A user loading that page would have seen this:
That's real customer data as it exists in our database — rendered exactly as stored. The bug was immediately visible because there's no plaintext fallback anywhere in the system. When decryption fails, it fails loudly. The data doesn't silently degrade to readable text.
We patched it the same day using Prisma's DMMF introspection to identify every affected field. No data was exposed. No one hit the broken page before the fix was live.
This is what “we take your data seriously” looks like when it's real rather than a policy document.
Access Control
Data isolation
Your data is kept separate from every other user's. Every request is checked in our code so it only touches your own records.
Limited access
Our admin screens show activity (counts and dates), not your transactions. Database access is limited to TrustTech's founder and the tools he uses to maintain it, for support and maintenance.
Encryption Keys
Encryption keys are stored separately from the database, in secure environment variables.
What This Means for You
If our database was stolen...
Attackers would get encrypted data they cannot read. Your OAuth tokens, bank imports, and chat history would be useless gibberish without our encryption key.
If a rogue employee tried to snoop...
Your data is kept separate from every other user's. Every request is checked in our code so it only touches your own records. Names, descriptions, notes and connection tokens are encrypted before they're stored. Amounts and dates aren't, so Solvent can do the maths for you.
If someone intercepted your connection...
TLS 1.3 encryption means all traffic between your browser and our servers is encrypted. Man-in-the-middle attacks won't work.
Infrastructure
| Service | Provider | Security |
|---|---|---|
| Hosting | Vercel | SOC 2 Type II certified, automatic HTTPS |
| Database | Neon Postgres | Encrypted at rest, isolated connections |
| Payments | Stripe | PCI Level 1 certified (we never see card numbers) |
| AI | Anthropic | Data not used for training, SOC 2 Type II |
Our Commitment
- We encrypt sensitive data — not just at rest, but field-by-field for the most sensitive information.
- Our admin screens show activity (counts and dates), not your transactions. Database access is limited to TrustTech's founder and the tools he uses to maintain it, for support and maintenance.
- We use trusted providers — every service we use meets enterprise security standards.
- We're transparent — we tell you exactly what we protect and how.
Questions?
We're happy to discuss our security practices in more detail.
Email: security@getsolvent.online