Document status: Version 2.0 · Effective July 26, 2026 · Owner: Tekinno Software LTD · Review cadence: at least every six months and after any material change.

This is the information security policy for EnoughLine, a multi-tenant personal-finance service operated by Tekinno Software LTD. It defines the security controls that are operational in the service, the procedures that govern them, and how the policy is maintained. Wherever possible, controls are implemented and enforced directly in the software rather than by manual process, and verified automatically before every release.

Scope and roles

This policy covers the EnoughLine application, its data stores, and the third-party platforms it depends on (hosting, database and authentication, bank and brokerage connectivity, AI processing, and payments). Tekinno Software LTD operates the service and is responsible for implementing, enforcing, and reviewing these controls. Customers are responsible for their own credentials, devices, and for who they invite into their workspace.

Governance and continuous improvement

• Every change is checked. An automated suite of structural security checks runs before every deployment; a build that would expose a secret, disable row-level security, or introduce a money-movement code path fails and is not shipped.
• Dependencies are monitored for known vulnerabilities, and updates are applied as they are identified.
• This policy is reviewed at least every six months and after any material change to the service or its data handling. The version and effective date above are updated on each review.

Data protection

In transit

All traffic is served over HTTPS using TLS 1.2 or better, with HSTS enforced. There is no unencrypted transport path to the service.

At rest

All data is encrypted at rest by the database provider. In addition, access tokens for connected financial institutions are separately encrypted at the application layer with AES-256-GCM (authenticated encryption) before they are written to the database, using a key held only in the server runtime environment. A database compromise alone therefore does not expose usable tokens.

Tenant isolation

Every row of customer data is bound to its workspace, and row-level security is enforced by the database itself: a signed-in user can only ever read the rows of the workspace they belong to. Isolation does not depend on application code remembering to filter — the database refuses cross-tenant reads outright, and the pre-deployment checks verify row-level security stays enabled on every user-scoped table.

Identity and access management

• Two-factor authentication (TOTP) is required to sign in.
• Role-based, least-privilege access. The database uses separate roles for anonymous, authenticated, and administrative access. The administrative key is never exposed to the browser, and the encrypted-token column is not readable by client roles at all.
• Workspace roles. Only a workspace's owner can invite or remove members, manage billing, or delete the workspace; these checks are enforced server-side on every request, not in the interface.
• Operator access to the underlying platforms (hosting, database, source control, payments) is limited to the personnel who need it and protected by two-factor authentication.

Application security

• A strict Content-Security-Policy restricts script and connection sources; framing of the application is disabled to prevent clickjacking.
• The service is read-only with respect to your money. It has no code path capable of initiating a payment, transfer, or trade — verified automatically before each release. Subscription payments happen on Stripe-hosted pages; card details never touch our servers.
• Secrets are never committed to source control and never included in the browser bundle; both are checked automatically.
• Payment webhooks are cryptographically verified (signed, replay-bound) before any effect is applied.

Subprocessor security

The providers listed in our Privacy Policy each maintain their own audited security programs (including SOC 2 and/or ISO 27001 attestations at Plaid, Stripe, Supabase, and Vercel). Each receives only the data its role requires, and connectivity providers are used in read-only mode.

Data retention and deletion policy

• Disconnecting an institution immediately and permanently deletes its stored access token and all associated accounts, balances, and synced transactions, and revokes the authorization at the connectivity provider so no further data is retrieved.
• Exporting your data is available to every customer from Settings at any time.
• Deleting your account from Settings revokes all institution authorizations upstream, permanently deletes the workspace's financial data and the sign-in account, and is not reversible. Billing records required by law are retained only as long as the law requires.

Vulnerability management

Dependencies are monitored for known vulnerabilities, and the automated pre-deployment checks described above run on every change. Reports from external researchers are welcome at the address below and are triaged with priority.

Incident response procedure

If a security incident is suspected — unauthorized access, a leaked secret, or a compromised dependency — we follow this procedure:

• Contain: rotate the affected credential or encryption key and, if necessary, take the service offline.
• Revoke: invalidate active sessions and, for any affected financial connection, revoke it at the data provider so no further data can be retrieved.
• Assess and remediate: determine what data and which customers were affected, fix the underlying cause, and extend the automated checks to cover it going forward.
• Notify: affected customers are notified without undue delay with what happened, what data was involved, and what we and they should do next. Where a breach creates a real risk of significant harm, we also report to the Office of the Privacy Commissioner of Canada and any other regulator the law requires, within the required timelines.

Reporting

Security concerns and vulnerability reports: support@enoughline.com