Data Security Overview
How we protect your financial data with Canadian-first security practices
Where Your Data Lives
We are transparent about where your data is processed and stored, and we publish every provider and its region on our Subprocessors page. No vague "servers we operate or contract with." Our application backend runs on Google Cloud Run in the northamerica-northeast1 (Montreal) region. Our primary database is hosted by Supabase on AWS in the us-west-2 (United States) region, encrypted in transit and at rest. Where data is processed outside Canada, PIPEDA requires comparable protection through contractual and technical safeguards, which we apply.
Encryption Everywhere
- In transit — every connection between your device and our servers uses HTTPS with TLS 1.2 or higher. Data cannot be intercepted or read in transmission.
- At rest — your data is encrypted on disk with AES-256 by Supabase. Backups inherit the same encryption.
Row-Level Security (RLS)
Our database enforces row-level security, which means your data is isolated at the database level. Every query is automatically scoped to your user account. Even in the unlikely event of a software bug, the database itself prevents one user from reading another's data.
This is a stronger guarantee than application-level security alone — it is defence in depth.
Sensitive Data Stays With Specialists
We deliberately hand off sensitive data to providers whose entire business is keeping it safe:
- Stripe processes all payment data — we never see or store your full card number. Stripe is PCI-DSS Level 1 certified, the highest tier in the payments industry.
- Plaid handles your bank login credentials when you link an institution. We never see your bank username or password — Plaid issues us a token that lets us read transactions on accounts you authorise.
No Third-Party AI on Your Data
NivoaFlow does not send your transactions, balances, or any personal financial data to third-party AI services. The AI categorisation engine runs against patterns and merchant data without exposing your identity to outside providers. We removed the last third-party AI dependency in February 2026 to keep PIPEDA compliance airtight.
API Rate Limiting
Our API endpoints are protected with rate limiting to prevent abuse:
- Limits are set per endpoint based on expected usage patterns
- This protects against automated attacks and ensures fair access for all users
- Normal usage is never affected by these limits
Regular Security Practices
We maintain security through ongoing practices:
- Security audits — regular reviews of our codebase and infrastructure
- Dependency scanning — automated checks for vulnerabilities in our software dependencies
- Secret scanning — automated detection (TruffleHog + Semgrep) to ensure credentials are never accidentally committed
- Access controls — strict internal access policies for production systems
See PIPEDA and privacy for our privacy commitments.
Your Role in Security
While we handle the infrastructure security, you can strengthen your account by:
- Enabling two-factor authentication — adds a second verification step at sign-in
- Using a strong, unique password — do not reuse passwords from other services
- Keeping your email secure — your email is the key to your account. Update it from account settings.