Security
Your financial data is sensitive. Here's how we protect it.
Encrypted in transit and at rest
Folloop runs on Supabase for the database and Vercel for hosting. Traffic uses TLS 1.2 or better, and your data is encrypted on disk by Supabase. Both providers publish their own independent security audits — those certifications are theirs, not ours.
Your hub is isolated in the database
Every read and write is checked by row-level security inside Postgres, against your membership of that hub. It is not a filter the app applies and could forget — a request for a hub you are not in returns nothing, whoever makes it.
Your statement never leaves your device
When you import a CSV, it is parsed in your browser. The file is never uploaded, never stored, and never reaches our servers. Only the transactions you choose to keep are saved.
No bank connections at all
Folloop cannot see your bank, and cannot move money. There is no card number, no account number, and no payment credential anywhere in the system. Everything it knows, you typed or imported.
Sign-in is handled by Supabase Auth
Passwords are hashed with bcrypt and never stored or seen by us, and sign-in attempts are rate-limited. You can use Google instead and have no password with us at all.
If something goes wrong
If a breach affects your personal data, GDPR requires us to notify you and the relevant regulator within 72 hours, and we will. You can also export everything you have at any time from Settings, so your data is never only in one place.
Responsible disclosure
If you discover a security vulnerability in Folloop, please report it responsibly. Folloop is a small team, so the honest commitment is this: we will acknowledge your report within five working days and tell you what we intend to do about it. We will not pursue legal action against anyone acting in good faith.
security@folloop.app