Security

Our Commitment to Security

At Monytar, security is not an afterthought - it is foundational to everything we build. We handle sensitive financial data and take that responsibility seriously with enterprise-grade security measures.

Infrastructure Security

• Data is encrypted in transit (TLS) and at rest by our managed infrastructure providers
• Hosted on established cloud providers (Vercel and Supabase) that maintain their own SOC 2 attestations
• Managed Postgres with automated backups and point-in-time recovery
• Secrets and credentials stored as environment variables, never in source or the client

Application Security

• Role-based access control (RBAC) with granular, per-action permissions
• Row Level Security (RLS) policies enforcing data isolation between organizations
• Server-side authorization on every mutating action — client identity is never trusted
• Parameterized queries throughout to prevent SQL injection
• Private receipt storage served only through short-lived signed URLs
• Generic authentication errors to prevent account enumeration

Authentication & Access

• Email and password authentication managed by Supabase Auth
• Industry-standard password hashing handled by the auth provider
• Secure, HTTP-only session cookies
• Complete, immutable audit trail of sensitive actions

Two-factor authentication and SSO/SAML are on our roadmap and are not yet generally available.

Compliance

Monytar is designed to help organizations maintain good financial controls. The platform provides complete audit trails, data export for regulatory reporting, and configurable role-based access. Formal certifications (such as SOC 2) are a roadmap item and are not currently held by Monytar itself.

Reporting Vulnerabilities

If you discover a security vulnerability, please report it responsibly to security@monytar.com. We commit to acknowledging reports within 24 hours and providing a resolution timeline within 72 hours.