Your data is safe
Data security is a priority for us. We design our safeguards around the practices recommended by NIST and industry standards. Below is what we actually do.
Encryption everywhere
Data kept in our database and in our file store is encrypted at rest with AES-256.
Every connection to Taufolio goes through TLS. In production the browser also receives an HSTS header, which forces HTTPS.
Read-only access to your broker
When you connect a brokerage account we ask for read-only access to positions and transactions. We cannot place orders or move funds, and we change nothing on your account.
You sign in on the connection provider’s page, not with us, so we neither receive nor store the password to your brokerage account. You can disconnect at any time in Settings.
An extra layer for broker access
We encrypt the access key of a broker connection ourselves, before it reaches the database, with AES-256-GCM.
Each user has a separate key, derived with HKDF from a random salt stored with the record and from a secret pepper that we keep outside the database. Access to the database alone is therefore not enough to read that key.
When we change the pepper we can still read data encrypted with the previous one, so a change does not cut off existing connections.
We do not know your password
Sign-in to Taufolio is handled by a specialised authentication provider. Your account password does not reach our database, and we never see it.
Your files are private
Brokerage statements go to a private store. No file has a public address, and every read goes through our server after authentication.
We keep statement files for up to 365 days so we can fix the importer when it skips or misreads something. We delete screenshots right after the analysis, and if the analysis fails, after 7 days at the latest.
We will delete a file on any request (write to support@taufolio.com). We also delete it at once when you cancel an import, and when you delete your account if you are the only user of your space.
We do not sell data
We never sell your data. It goes only to parties that process it on our behalf, to the extent described in the Privacy Policy, and to authorities when the law requires it.
Questions and reports
Have a question about security, want your files deleted, or suspect a flaw in our safeguards? Write to support@taufolio.com.
See also: Privacy Policy and Terms of Service.