AFINCE is designed around read-only financial visibility. We do not initiate payments or store bank login credentials. Financial account connections are handled through user-authorized providers such as Plaid.
Security Commitments
- Read-only access: AFINCE uses financial data for visibility, categorization, budgeting, and recurring expense insights.
- Credential separation: Bank credentials are handled by Plaid or the user's financial institution, not stored by AFINCE.
- Encryption: AFINCE uses HTTPS/TLS for transport and relies on encrypted storage controls from infrastructure providers for stored data.
- Least privilege: Internal access is limited based on job need and reviewed when roles or responsibilities change.
- Administrative MFA: Administrative systems must use multi-factor authentication where supported.
- Logging: Security-relevant administrative events are logged and reviewed when needed for investigation or support.
Policy Library
Privacy Policy
Collection, use, sharing, retention, user rights, Plaid, and deletion requests.
Read policyTerms of Service
Service rules, disclaimers, user responsibilities, and liability limits.
Read termsAccess Control Policy
Least privilege, access approvals, reviews, offboarding, and logging.
Read policyMFA Policy
Multi-factor authentication requirements for administrative and sensitive systems.
Read policyData Retention Policy
How long AFINCE keeps account, financial, support, security, and backup data.
Read policyData Disposal Policy
Deletion triggers, secure disposal, Plaid disconnects, backups, and verification.
Read policyIncident Response
AFINCE investigates suspected unauthorized access, service abuse, data exposure, and security incidents. If an incident affects personal information and notice is legally required, AFINCE will provide notice through reasonable channels such as email, in-app notice, website notice, or other legally required methods.
Responsible Disclosure
Security concerns can be reported to support@afince.com. Please include a clear description, affected URL or feature, reproduction steps, and contact information. Do not access, modify, delete, or disclose user data while testing.