Security

Encryption in transit and at rest

• All communications between your browser or device and our servers use HTTPS with TLS 1.2 or higher. We do not accept unencrypted connections.
• Receipt images and PDFs are stored encrypted at rest in Cloudflare R2, with access via short-lived signed URLs.
• The Convex database encrypts data at rest and in transit between internal nodes.
• Passwords are stored hashed with bcrypt via Better Auth. Never stored or transmitted in plaintext.

Authentication and access control

• Registration with email + password, or sign-in with Google OAuth.
• Sessions signed with rotating tokens, with expiration and revocation at logout.
• Multi-factor authentication (MFA) via TOTP available for all users. Recommended for owner and admin accounts.
• Every action within a workspace is validated against the user's role (owner, admin, contributor, viewer, accountant). No “inherited” privileges between workspaces.
• Workspace isolation: backend queries always restrict access to the user's workspaceId. A user of one workspace cannot see data from another workspace under any circumstance.

Fyxi team internal access

• Fyxi internal team access to production data is limited by role and used only for technical support, legal compliance, or incident investigation.
• Any access to specific workspace data is logged in the internal audit log with timestamp, actor, and reason.
• Access to Cloudflare R2, Convex, and Vercel is protected with MFA and rotating keys.
• We do not export customer data to personal laptops or unauthorized third-party services.

Backups and continuity

• Convex data is automatically backed up by the provider. We periodically verify restore capability.
• Objects in Cloudflare R2 have regional replication for fault tolerance.
• Backup retention: operational backups may persist up to 30 days after a deletion before being overwritten. After that they are unrecoverable.
• Availability target: 99.9% monthly uptime. Real-time status and incident history will be published at status.fyxi.ai.

Incident response

• We have an internal incident response plan covering: detection, containment, impact analysis, communication with affected users, and remediation.
• If we detect a breach affecting your personal data, we will notify you within 72 hours of confirmation, as required by applicable laws including California Civil Code § 1798.29.
• Public post-mortem at status.fyxi.ai for any incident affecting availability or data integrity.

Certifications and compliance

• Our main sub-processors (Vercel, Convex, Cloudflare, Google Cloud, Stripe, Twilio, Resend) are certified in SOC 2 Type II and in several cases ISO 27001. See the complete list at Sub-processors.
• We comply with applicable requirements of the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). Details at California Privacy Rights.
• Our own SOC 2 on roadmap: we aim to complete SOC 2 Type I in the year following public launch, and Type II the year after.

Report a vulnerability

If you discover a security vulnerability in Fyxi, please report it responsibly to security@fyxi.ai. We will respond as soon as possible and work with you on remediation. We do not yet have a formal bug bounty program, but we publicly recognize those who report responsibly.

Things we ask you to avoid while investigating: do not access other users' data, do not damage production services, do not perform social engineering against employees or customers, do not execute denial-of-service attacks.

Legal entity responsible: Fyxi LLC · California Filing #B20260341393
2108 N ST STE N, Sacramento, CA 95816, United States