Plot uses precise, layered safeguards for sign-in, sessions, sensitive secrets, and per-budget access.
Passwords
Hashed with Argon2id · the memory-hard algorithm recommended by OWASP · with a unique salt per user. We can't see your password, and a leaked hash is impractical to reverse.
Passkeys
Optional passkeys let you sign in with your device, Face ID, Touch ID, Windows Hello, or a hardware security key. Plot verifies a phishing-resistant public-key signature bound to our exact web address. Plot never receives your private key or biometric data; your passkey provider may securely sync the passkey across your devices.
Encryption at rest
Sensitive secrets such as your two-factor seed and optional Plaid access tokens use authenticated Fernet encryption before they touch the database.
Two-factor authentication
Optional TOTP (Google Authenticator, 1Password, Authy) plus one-time backup codes stored only as hashes. Turn it on in Account & Security.
Sessions & cookies
Sessions are random 256-bit tokens; only their SHA-256 hash is stored. Cookies are HttpOnly and SameSite=Lax, are revocable, and rotate on password change.
Optional bank sync
Bank connections are handled through Plaid and are never required to use Plot. Connection tokens are encrypted, sync work is serialized to prevent competing updates, and imported transactions wait in your review Inbox. Possible duplicates are matched rather than blindly created, while bank edits and removals require an explicit decision before they change approved Plot history.
You can repair or disconnect a connection at any time. Disconnecting stops future synchronization but does not erase transactions you already approved.
Defense in depth
- Account lockout after repeated failed logins; login responses are enumeration-safe.
- Passkey challenges are high-entropy, expire after five minutes, and can be used only once.
- A strict Content-Security-Policy and hardened headers (X-Frame-Options, nosniff, Referrer-Policy).
- Strict per-budget data isolation enforced in the application and tenant-aware database access layer.
Responsible disclosure
Found a vulnerability? Email [email protected]. We appreciate and credit responsible reports.