Security

Encryption in transit and at rest

• TLS 1.3 on every connection between your browser and our servers. Fallback to TLS 1.2 only if the client does not support 1.3. We reject anything lower.
• HSTS with preload enabled — modern browsers reject any attempt at an unencrypted connection to fyxi.ai.
• Receipts, PDFs and invoices are stored with AES-256 encryption at rest in Cloudflare R2. Each object has its own derived key; access requires short-lived signed URLs (15 minutes by default).
• The operational database (Convex) encrypts data at rest and in transit between internal nodes.
• Passwords are stored hashed with bcrypt (cost factor 12) via Better Auth. They are never stored, transmitted or logged in plain text.
• OTP and email verification tokens are stored as a SHA-256 hash, with a TTL of 10 minutes (OTP) and 1 hour (verification link).
• Bank and POS access tokens are protected with envelope encryption: each token has its own key, and the master keys live in a KMS separate from operational storage.

Authentication and access control

• Registration with email + password, or sign-in with Google OAuth.
• Mandatory email verification at sign-up — you cannot log in until you confirm you own the email address.
• Strong password rules: minimum 8 characters, with at least one uppercase letter, one lowercase letter, one number and one symbol. We block the 500+ most-breached passwords on record (per haveibeenpwned).
• Device verification by code when signing in from a new browser or network. Fyxi generates a SHA-256 fingerprint of the device and emails a 6-digit OTP before granting access.
• Email alerts on every login from a new device, with a one-shot "this wasn't me" link that revokes the session immediately.
• Rate limiting on sensitive endpoints (login, signup, password reset, OTP, webhooks) to prevent brute-force attacks and abuse.
• Sessions signed with rotating tokens via Better Auth, with configurable expiration and revocation at logout or through the revoke link in the email.
• Every action inside a workspace is validated against the user's role (owner, admin, contributor, viewer, accountant). There are no “inherited” privileges across workspaces.
• Workspace isolation: backend queries always restrict access to the user's workspaceId. A user in one workspace cannot see data from another workspace under any circumstance.

Connecting your bank and POS

• Bank (via CSV import): at this stage of Fyxi, bank import works by uploading the CSV your bank lets you download. You never share your bank password with us or with any third party — from the standpoint of your credentials, this is the safest possible model. The AI processes the CSV, categorizes each transaction to the correct Schedule C line, and feeds it into your dashboard.
• When we enable automatic bank connection (post-launch roadmap), it will be through a read-only aggregator with SOC 2 Type II certification. That provider can only read transaction history — it can NOT initiate transfers, payments or withdrawals. Neither can Fyxi.
• Uploaded CSVs are stored AES-256 encrypted in Cloudflare R2. They are processed, categorized, and made available to your accountant inside your workspace.
• We do not store SSNs, full bank account numbers or routing numbers. Only the last 4 digits, so you can identify the account.
• POS (Square, Shopify, Clover, Toast): connection via OAuth 2.0 — the secure standard used by Google, Facebook and Microsoft. Fyxi only receives read permissions for transactions. It cannot charge or move money.
• All bank and POS access tokens are stored encrypted in the operational database.
• Incoming webhooks (Stripe, Square) verify a cryptographic signature before processing any event. We reject requests without a valid signature.

Data residency and location

• All customer data is stored in the United States. Our infrastructure providers (Convex, Cloudflare R2, Vercel) operate in us-east and us-west regions.
• The Vercel CDN distributes static assets globally, but sensitive data (receipts, amounts, tokens) never leaves the United States.
• Backups replicate within the same jurisdiction (US) — never cross-border.
• No customer data is sent to third-party AI models for training. The AI CFO uses Gemini via API with explicit training opt-out (Google DPA).
• The full list of sub-processors with their jurisdictions is on the Sub-processors page.

Data retention and deletion

• While your account is active: we keep your receipts, transactions, reports and tax data so you can consult them. Tax data may require 7-year retention under IRS regulations applicable to the business.
• When you cancel your subscription: data remains accessible in read-only mode for 30 days so you can export it. After 30 days it is archived in cold storage.
• When you delete your account from Settings → Danger zone: we begin permanent deletion. Operational data is removed within 7 days. Backups overwrite that data within an additional 30 days.
• Legal exceptions: we may retain specific information required by law (for example, transaction records for active IRS investigations or pending legal audits). We notify you if this applies.
• Right to export: at any time you can export your entire financial history as ZIP + CSV from /archivos. No limits, no extra charge.
• Operational logs (access, errors, metrics) are retained for 90 days for debugging and then aggregated anonymously.

Internal access by the Fyxi team

• Access by the internal Fyxi team to production data is limited by role and used only for technical support, legal compliance, or incident investigation.
• Any access to a specific workspace's data is recorded in the internal audit log with timestamp, actor and reason.
• Access to Cloudflare R2, Convex and Vercel is protected with mandatory MFA and rotating keys.
• Principle of least privilege: by default, no team member has access to customer data. Access is granted on demand with automatic expiration (typically 24-72h).
• All team devices use mandatory disk encryption (FileVault on macOS, BitLocker on Windows) and automatic screen lock.
• We do not export customer data to personal laptops or unauthorized third-party services.

Employee and contractor security

• Onboarding: all employees and contractors sign an NDA before receiving any access. Those who touch production data also sign a specific DPA (Data Processing Addendum).
• Mandatory training: security awareness at onboarding (phishing, password hygiene, incident reporting) and an annual refresher.
• Background checks: for roles with direct production access, we run background checks through a certified provider (Checkr or equivalent), in jurisdictions where it is lawful.
• Offboarding: when the working relationship ends, we revoke access within 24 hours. Corporate devices are wiped remotely. Credentials and tokens are rotated immediately.
• Contractors with production access are subject to the same policies as employees.

Security testing and monitoring

• Static analysis (SAST): every pull request goes through automated code vulnerability analysis before merging to main.
• Dependency scanning: continuous monitoring of npm/pip dependencies with GitHub Dependabot. Critical vulnerabilities are patched within 48h.
• Secret scanning: automatic blocking of commits containing exposed API keys, tokens or credentials.
• Rate limiting + WAF: the Cloudflare WAF filters malicious traffic (SQLi, XSS, bot attacks) before it reaches our servers.
• Error tracking: Sentry monitors unhandled exceptions in real time. Anomalies trigger alerts to the on-call team.
• External penetration testing: on the post-launch roadmap — we plan an annual pentest with an accredited external firm. The first report will be published (summary version) on this page.
• Bug bounty: an active responsible disclosure program (see the section at the end). Formalization with HackerOne or similar is on the roadmap.

Backups and business continuity

• Convex data is backed up automatically by the provider. We periodically verify restore capability with documented drills.
• Objects in Cloudflare R2 have regional replication for fault tolerance.
• RPO (Recovery Point Objective): ≤ 1 hour — in the worst-case data-loss scenario, you could lose up to the last hour of activity.
• RTO (Recovery Time Objective): ≤ 4 hours — the maximum time to restore service after a major incident.
• Backup retention: operational backups may persist for up to 30 days after a deletion before being overwritten. After that they are unrecoverable.
• Availability target: 99.9% monthly uptime. Real-time status and incident history will be published at status.fyxi.ai.
• Continuity plan: if a critical provider (Convex, Vercel, Cloudflare) suffers a prolonged outage, we have runbooks to fail over to alternative providers at the layers where it is viable.

Incident response

• We maintain an internal incident response plan covering detection, containment, impact analysis, communication with affected users, and remediation.
• Defined roles: Incident Commander, Communications Lead, Forensics Lead. Documented playbooks per incident type (data breach, availability, integrity).
• If we detect a breach affecting your personal data, we will notify you within 72 hours of confirmation, as required by applicable law including California Civil Code § 1798.29.
• Public post-mortem at status.fyxi.ai for any incident affecting availability or data integrity.
• Post-mortems include: what happened, timeline, impact, root cause, mitigation applied, and preventive actions.

Certifications and compliance

• Our main sub-processors (Vercel, Convex, Cloudflare, Google Cloud, Stripe, Twilio, Resend) are certified SOC 2 Type II and in several cases ISO 27001. See the full list on the Sub-processors page.
• We comply with the applicable requirements of the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). Details on the California Privacy Rights page.
• Our payment processor (Stripe) is PCI DSS Level 1 certified. Fyxi never touches or stores full card numbers — the entire payment flow runs inside Stripe's iframe.
• Our own SOC 2 is on the roadmap: we aim to complete SOC 2 Type I within the year following public launch, and Type II the year after.
• Although Fyxi does not process PHI and is not subject to HIPAA, we apply equivalent controls to financial data: end-to-end encryption, access auditing, principle of least privilege, and breach notification.

Security FAQ

Report a vulnerability · Responsible Disclosure

If you discover a security vulnerability in Fyxi, report it responsibly to security@fyxi.ai. You can use any email address — you do not need a Fyxi account. PGP encryption available on request.

Our commitment when we receive a report:

• Acknowledgement within 72 business hours.
• Triage and initial severity assessment within 7 days.
• Periodic updates while we work on remediation.
• Public credit (with your permission) on our acknowledgements page once the issue is resolved.
• No legal action against good-faith researchers who follow this policy.

Scope · What we want you to test:

• fyxi.ai and all subdomains we operate directly
• The authenticated web app (dashboard, integrations, exports)
• Public APIs and webhooks (POS, bank, chat)
• Authentication, authorization, privilege escalation
• Handling of financial data (receipts, revenue, bank, tax data)

Out of scope · Please do NOT test:

• Denial of service attacks (DoS/DDoS), mass fuzzing, automated scraping
• Social engineering of employees, customers or partners
• Physical attacks on offices or sub-processor data centers
• Accessing other users' data (use your own test account — we will open one if you ask)
• Vulnerabilities already reported or known
• Reports about third-party services (Vercel, Convex, Stripe, etc.) — report those directly to the vendor
• Missing "best-practice" headers with no demonstrated impact (relaxed CSP, cookies without flags)

Rewards:

We do not yet have a formal paid bug bounty program. We commit to: (a) public credit, (b) Fyxi merchandise if the report is valid and high quality, and (c) considering monetary compensation for critical findings that prevent real harm to users. As the business scales, we plan to formalize the program (HackerOne or similar).

Responsible legal entity:

Fyxi LLC · California Filing #B20260341393
2108 N ST STE N, Sacramento, CA 95816, Estados Unidos
security@fyxi.ai · privacy@fyxi.ai · legal@fyxi.ai