Security

Bank authentication is handled through Plaid. Tranxacty does not receive or store your bank login username or password.

When you approve a connection, Tranxacty receives the account and transaction data needed to provide bookkeeping features.

• Tranxacty is served over HTTPS to protect data in transit.
• Plaid access tokens are encrypted before storage using an application-level encryption key.
• Passwords are stored as secure hashes, not plaintext passwords.
• Tranxacty also relies on trusted infrastructure providers that support encryption at rest, backups, and operational security controls.

Users must authenticate before accessing dashboards, books, transactions, connected accounts, analytics, billing, and team settings.

Book invitations are scoped to a specific book when selected, so a user can be granted access to one book without automatically seeing every book in an account.

Tranxacty records activity for important account events including sign in, sign out, password changes, account deletion, team invitations, financial account connection, financial account disconnection, and bookkeeping syncs.

Sensitive API actions such as Plaid connection, Plaid exchange, Plaid disconnection, and team invitations use rate limits to help reduce abuse.

• Use a strong, unique password.
• Limit invited users to people who need access.
• Remove access when a partner, employee, or adviser leaves.
• Disconnect accounts you no longer want synced.
• Contact us promptly if you suspect unauthorized access.

If you believe you found a vulnerability or account-security issue, contact us at tranxacty@gmail.com. Please do not include full bank account numbers, credentials, or sensitive financial data in email.

See also our Privacy Policy and Data Deletion Policy.