Security

Your plan is tied to the email you sign in with, and — if you subscribe — an opaque billing ID from Stripe, our payment processor. You don't have to use a real email, and any date of birth you enter is only an input to the projections, not an identity check.

The details that could identify you — your name, billing address, and card number — are entered on Stripe's secure checkout and are never stored by FinZot. So our own records hold no name, address, or card number to attach your net worth to — the plan data we store carries no real-world identity beyond the email you choose to sign in with.

We never link to your bank, brokerage, or retirement accounts — everything in your plan is information you type in.

If you use the Claude connector, the plan Claude works on is held separately from the plans in your account. Claude edits a working copy, and nothing reaches your account until you tell it to publish. Those working copies live on our servers under the same protections as everything else we store, and clearing your data erases them too. The connector also records which parts of a plan Claude has loaded, so it can tell when it is reasoning from stale context — that record holds no part of your conversation and expires after 30 days.

Passwordless sign-in. FinZot has no passwords to guess, leak, or reuse. You sign in by entering your email and then the 8-digit code we email you. Codes are single-use and expire quickly.

No third-party account linking. We don't use "Sign in with Google/Apple/Facebook" and we don't link your account to outside identity providers.

Connecting Claude. Authorizing the Claude connector creates a credential that lets Claude reach your plans on your behalf. It is not a password, and it does not sign Claude in as you — it grants one narrow permission, which the consent screen spells out before you agree to it. The credential Claude sends with each request expires every hour, and the longer-lived one behind it dies after 90 days unused, so a connector you stop using goes dead on its own. You can revoke it immediately from Settings → Claude, or by removing the connector in Claude. It is also revoked automatically if we ever see a renewal credential replayed. Signing out of FinZot signs you out on every device but leaves the connector in place — to cut Claude off, disconnect it from Settings or in Claude.

Internal access. Administrative access on our side is limited to authorized personnel and scoped to what's needed to operate the service.

Connections to FinZot use HTTPS with TLS, so data is encrypted in transit between your browser and our servers. We enforce HTTPS everywhere and send HSTS headers so browsers refuse to connect any other way.

Data we store on your behalf is encrypted at rest with AES-256.

Your browser also keeps a local copy of your plan, encrypted at rest. For signed-in accounts the key that unlocks it is delivered per-session and never persisted to disk. In guest mode the key is created by your browser and stored on your device beside the data — it never reaches our servers, which is what keeps a guest's plan fully local; protecting it from someone with access to the device itself is the job of your operating system's disk encryption (FileVault, BitLocker, and their mobile equivalents).

The app is locked down so your browser will only run FinZot's own code and only communicate with FinZot's own servers — closing off a common path by which web vulnerabilities get exploited.

FinZot runs on Amazon Web Services, in data centers located in the United States.

AWS maintains independent, third-party audits and certifications for that platform, including SOC 1, SOC 2, and SOC 3 reports and ISO 27001. These cover AWS's own infrastructure — the foundation we run on — and are not an audit or certification of FinZot's application itself.

We never sell your data, and we never share your planning data for advertising or marketing — ever.

The only outside parties that ever touch your data are the service providers we rely on to run FinZot: Amazon Web Services (hosting and email) and Stripe (payments). The one exception is our optional AI features: if you choose to use them, your data is also processed by Anthropic — see AI features below. We don't share it with anyone else.

Subscriptions are processed by Stripe on its own secure checkout. Card entry happens entirely on Stripe's side — your card number never touches FinZot's systems. The only billing detail we store in our own database is the opaque customer reference described above; your name and address live in Stripe, not in FinZot's records.

FinZot's planning engine — projections, tax and cashflow calculations, charts, and exports — runs entirely without AI and never sends your data to any AI provider. AI is not part of the core product, and most of what FinZot does never touches it.

AI features are optional and off by default. The Claude connector, free for a limited time with a FinZot account, lets you connect Claude — Anthropic's AI assistant — to your FinZot account from claude.ai. Nothing is sent to an AI provider unless you connect Claude yourself and ask it to work on your plan. You approve the connection on a consent screen that lists exactly what Claude will be able to do, and you can disconnect it at any time.

How your plan reaches Anthropic — not from us. We hold no Anthropic account that your plan is fed into, and our servers never push your data to Anthropic. The connector runs the other way around: Claude, working inside your own Claude account, asks our servers for the parts of your plan it needs, and we answer. What Claude reads then becomes part of your Claude conversation, just as it would if you had typed it into the chat yourself.

So Anthropic is not a sub-processor handling your data on our behalf, the way Amazon Web Services and Stripe are. That data sits in your Claude account, governed by that account's terms and privacy settings — including whatever you have chosen there about whether your conversations are used to train Anthropic's models. We cannot see or change those settings, so if the question matters to you, check them in Claude. Switching the connector off in Claude, or disconnecting it here, stops anything further from being requested — it does not reach into your Claude account and delete conversations that already happened. Only you can do that, from Claude.

You can wipe your data at any time from within the app. Clearing your data permanently deletes your plans from our live systems — including every prior version we've stored — and removes the copy held locally in your browser. It revokes any Claude connector grant first, before erasing anything, so nothing can write into the account while it is being emptied, and it deletes the connector's working copies along with the plans they came from.

Our routine disaster-recovery backups are the one exception, and we don't keep those indefinitely: any residual copy ages out of the backup rotation within 60 days, after which it can no longer be restored.

What we can erase is what we hold. If you have used the Claude connector, the conversations themselves live in your Claude account rather than ours, so deleting those is something only you can do, from Claude.

This keeps your account and billing relationship intact (so you stay signed in with a clean slate) while removing the financial data itself. We may retain limited records where required for billing, tax, or legal purposes.

Found a security issue? We want to hear about it. Email security@finzot.com with the details and we'll respond as quickly as we can.

This page does not authorize security testing against FinZot's systems or accounts you don't own. We don't currently run a paid bug-bounty program, but we genuinely appreciate good-faith reports and will credit you if you'd like.

If we ever discover unauthorized access to your data, we investigate, contain the issue, and notify affected users as required by law.