ESNY Connect, Inc. takes the protection of your personal and financial data seriously. This page summarizes the controls we operate. To report a vulnerability, email alec.stallman@gmail.com — we acknowledge reports within 3 business days and ask that you avoid accessing other users' data while testing.

Encryption

• All client-to-server traffic uses HTTPS with TLS 1.2 or better; older protocol versions are not accepted.
• All data at rest — including consumer data received from the Plaid API — is encrypted with AES-256 by our managed database, object storage, and backup layers.
• Third-party credentials and access tokens are held in an encrypted secret store and are never exposed to browser code.

Access control

• Every database table enforces row-level security so a signed-in user can only reach their own records, plus records deliberately shared with them.
• Administrative access to cloud, database, source control, and payment consoles is limited to named individuals and requires multi-factor authentication.
• Access is granted on a least-privilege basis and reviewed when roles change or a person departs.
• Users can enable two-step verification (TOTP authenticator app) on their own account, and we recommend doing so before connecting a financial institution.

Application security

• Server-side authorization is enforced on every endpoint; client-side checks are never the security boundary.
• Automated dependency and static security scanning runs against the codebase, and identified issues are triaged and patched on a defined schedule — critical issues within 7 days.
• Managed platform components (runtime, database, and dependencies) are kept on supported versions; end-of-life software is replaced.
• Application and authentication logs are retained for monitoring and investigation.

Data handling

• We collect the minimum financial data needed to power the features you use.
• We never store bank login credentials; authentication happens inside Plaid Link with your institution.
• You can disconnect any financial institution at any time, which stops further data collection.
• Deletion and retention practices are described in our Privacy Policy and reviewed at least annually.

Incident response

We maintain a documented incident-response process covering detection, containment, eradication, recovery, and notification. If an incident affects your data we will notify you and applicable regulators or partners without undue delay, consistent with our legal obligations.