The short version
- Your data is isolated at the database level. Every row carries its organization and PostgreSQL row-level security decides what a query may see. Application code cannot forget to filter.
- Nothing internal is reachable from the internet. Only ports 22, 80 and 443 are open. The database publishes no port and never joins the public network. This is checked by an automated script after every deploy.
- Card details never touch our servers. Checkout and the billing portal are hosted by Stripe; we store customer and subscription identifiers only.
- No model, no estimate. Every figure is exact decimal arithmetic over the file you uploaded. Nothing guesses, rounds or fills a gap, and no language model is ever authoritative for a financial value.
Accounts and sessions
- Passwords are hashed with Argon2id. Only the hash is stored, and a database constraint refuses anything else. Minimum twelve characters.
- Unknown email, wrong password and disabled account produce the identical response, at the same speed, so an attacker cannot tell which addresses exist.
- Sessions are opaque random tokens. Only their SHA-256 digest is stored, so a database read cannot yield a usable session. Cookies are HttpOnly, Secure and SameSite. No authentication state is kept in browser storage, and there are no JWTs, because a stateless token cannot be revoked and revocation is what logout needs.
- Two-factor authentication with an authenticator app and recovery codes is available on every plan. Owners can require it for their team.
- Roles: owner, admin, analyst, viewer. API keys are scoped, shown once, and revocable. Every invitation, key, import and case change is written to an audit trail the organization can read.
Requests
- Cookie-authenticated writes are checked against the request origin as well as SameSite, and a write with no origin at all is refused rather than trusted.
- Rate limits on sign-in attempts, uploads and authenticated changes. Upload size is enforced on the declared length and again on the bytes actually streamed.
- The API is served on the same origin as the application under HTTPS with HSTS. Response headers forbid framing, sniffing, inline scripts and every external script, style, font and image.
- Interactive API documentation is disabled in production and blocked again at the proxy in case it were ever enabled by accident.
Money
- Amounts are PostgreSQL numerics, Python decimals and JavaScript integers. No floating point anywhere in the money path; a lint rule refuses it.
- Currencies are never combined and no exchange rate is ever applied. Totals are reported per currency.
- The database refuses a recovery larger than its shortfall. Overpayments are flagged for review and can never be netted against a shortfall.
Backups and continuity
- The database is backed up nightly and the newest backup is restored into a throwaway database and checked every week, automatically.
- If you stop paying, you stop importing. Read access and both exports remain, so your reconciliation history is never held as leverage.
- You can ask for your organization to be erased; the procedure exists and is tested.
Where the data lives
On infrastructure operated by GoldenRock LLC, the company behind MarginShield, with the sub-processors listed on the sub-processors page. The Data Processing Addendum sets out the terms; the privacy policy confirms there are no analytics or advertising trackers on the application.
What it does not do yet
Listed here because a security page that hides them would be one you could not trust.
- No single sign-on or SCIM. Enterprise identity providers are not supported yet. Two-factor authentication is.
- Rate limits are per process. The API runs as one process today, so the limits are exact; scaling out would need a shared counter, and that is planned for when it happens.
- Sign-up does not yet verify the email address. A wrong address on sign-up means the trial notes never arrive; nothing worse.
- No third-party audit yet. The controls above are enforced by tests and by the database, and the tests run before every deploy, but no external firm has certified them. When a customer needs a SOC 2 report, that is the conversation to have.
Found something? Write to security@marginshield.app. Reports are answered by a person, and fixes are deployed before they are discussed.