Last Updated: April 29, 2026

Your financial data is among the most sensitive information you can share with any software. We take that responsibility seriously and have built security into every layer of how Moninsight works — from how data moves between your device and our servers, to how our own team accesses internal systems.

This page explains the measures we have in place today. We believe in being transparent about what we do, and equally about what we haven't done yet.

Data Encryption

In Transit: All communication between your device and Moninsight is encrypted using HTTPS with TLS 1.2 or higher. This means any data traveling over the internet — your login, your transaction data, your reports — is protected from interception.

At Rest: Sensitive data stored in our databases is encrypted using AES-256, the same standard used by financial institutions and government agencies. This includes personal identifiers, financial records, and any documents you upload. Even in the unlikely event of unauthorized access to our storage infrastructure, your data would be unreadable without the proper decryption keys.

Access Controls

Access to your data within our internal systems is governed by the principle of least privilege — team members only have access to what they need to do their job, and nothing more.

Two-Factor Authentication (2FA): Required for all Moninsight team members accessing production systems.
Role-Based Access Controls (RBAC): Engineers, support staff, and other team members have clearly scoped permissions. Someone working on a general product feature does not have access to user financial records.
Access Logging: Access to sensitive data is logged and auditable. Any access to production data is recorded with a timestamp and identity.
Confidentiality Obligations: All team members and contractors are bound by confidentiality agreements and receive privacy and security training.

Application Security

Moninsight's application itself includes features designed to protect your account:

Automatic Session Timeout: Your session expires after a period of inactivity, so leaving the app open on an unattended device does not leave your account exposed.
New Device Alerts: You are notified when your account is accessed from a new device or location, so you can quickly identify any unauthorized access.
Secure Password Handling: Passwords are never stored in plain text. We use strong one-way hashing with salting to store credentials.
CSRF Protection: The application includes protections against cross-site request forgery attacks to prevent unauthorized actions from being triggered on your behalf.

Infrastructure and Network Security

Moninsight is hosted on reputable enterprise-grade cloud infrastructure with a strong security track record. Our infrastructure benefits from:

Firewalls and Network Monitoring: Our servers are protected by firewalls that restrict unauthorized inbound traffic. We monitor network activity continuously for anomalies or intrusion attempts.
Regular Software Updates: We apply security patches and dependency updates promptly to address known vulnerabilities in our stack.
Data Backups: We perform regular encrypted backups of critical data. Backup data is stored securely and separately from production systems, and we have tested restore procedures to recover in case of hardware failure or other incidents.

Third-Party Security

Some of Moninsight's core features rely on trusted third-party providers. We select partners with strong security reputations and hold them to the same standards we hold ourselves.

Plaid (Bank Connections): Your bank login credentials are never seen or stored by Moninsight. Plaid, a leader in secure financial data connectivity, handles all authentication with your bank and provides us with a tokenized, read-only connection. Plaid maintains its own robust security program and compliance certifications.
Google OAuth (Gmail & Drive Integrations): Connecting your Google account uses Google's standard OAuth 2.0 protocol. Moninsight never sees your Google password and only requests the specific access scopes required for the features you enable.
Payment Processing: Subscription payments are processed by a PCI DSS-compliant payment processor. Moninsight does not store your full card number, CVV, or bank account number. Payment credentials are handled entirely within the payment processor's secure environment.

Security Testing

We take a proactive approach to finding and fixing vulnerabilities before they become problems:

Periodic Security Reviews: We conduct internal security reviews of our codebase, infrastructure configuration, and access controls on a regular basis.
Third-Party Penetration Testing: We engage external security professionals to perform penetration tests and identify vulnerabilities we may have missed internally. Findings are triaged by severity and resolved promptly.
Dependency Scanning: We use automated tooling to monitor our software dependencies for known security vulnerabilities and patch them as updates become available.

Incident Response

Despite every precaution, no system can guarantee perfect security. We have a documented incident response plan so that if something goes wrong, we can act quickly:

Detection: Automated monitoring alerts our team to abnormal activity or suspected breaches as they occur.
Containment: We immediately isolate affected systems to prevent further exposure.
Investigation: We investigate the scope, root cause, and affected data.
Notification: If your personal data is affected, we will notify you promptly and report to the appropriate regulatory authorities as required by law.
Remediation: We resolve the underlying issue, restore normal operations, and document lessons learned to strengthen our defenses.

If you suspect a security issue with your account specifically (such as unauthorized access), please contact us immediately at support@moninsight.com.

Reporting a Security Vulnerability

If you discover a potential security vulnerability in Moninsight, we ask that you report it to us responsibly rather than disclosing it publicly. Please email security@moninsight.com with a description of what you found and steps to reproduce it. We will acknowledge your report within 2 business days, investigate promptly, and work to resolve valid issues. We appreciate the security research community's help in keeping Moninsight safe.

What We Are Working Toward

We believe in being transparent about where we are, not just where we want to be:

Formal Security Certification: We are actively working toward obtaining a formal third-party security audit and certification (such as SOC 2 Type I) as our company matures. We do not currently hold such a certification, and we will not claim otherwise. When we achieve it, we will update this page.
Expanded Access Controls: We are building more granular permission systems to give users greater control over who in their organization (if applicable) can view or edit specific data.

Your Role in Security

Security is a shared responsibility. Here is what you can do on your end:

Use a strong, unique password for your Moninsight account — ideally generated by a password manager.
Enable two-factor authentication on your account if available.
Do not share your login credentials with others. If a team member or accountant needs access, use the sharing features built into the app.
Log out of Moninsight when using shared or public computers.
Keep your email account secure, as it is used for account recovery and security notifications.

If you have questions about our security practices, please contact us at security@moninsight.com.