Security overview
This page says what we actually do. It is not a claim that AskCash is compliant with the FTC Safeguards Rule, GLBA, Section 1033, or any other regime. Using Plaid does not decide that.
Transport
The public site is https://askcash.app. Sign-in links and the agent connection use HTTPS.
What is encrypted in the field
Plaid access tokens are encrypted before they are stored. Custom category labels are encrypted the same way. Secrets sit in Doppler, not in the page.
Receipt notes you save are field-encrypted the same way.
We do not claim that every column in the database is encrypted. Email addresses and institution names are not described here as field-encrypted.
What we do not store
We do not store your transactions. We do not store Plaid transaction payloads. We do not store balances. A transaction id is not a stored transaction. Card numbers are entered on Stripe Checkout, not on AskCash.
Receipt notes and an encrypted category label may be stored when you set them, keyed to a Plaid transaction id. Those are not the transaction.
Advertising
We do not use bank data for advertising.
Disconnect
When you disconnect a bank and a live bank connection is configured, we ask Plaid to disconnect it. That stops our ability to use that bank link. Bank connection credentials do not expire on their own until they are disconnected or replaced.
Reporting a problem
Write to privacy@askcash.app. Do not send a token or a bank payload in the email.
Adapted from the Basecamp open-source policies / CC BY 4.0.