Security
How we protect your financial data
You trust Netted with sensitive financial information. We take that seriously. This page outlines the technical and organizational measures we use to keep your data safe.
Encryption Everywhere
All data is encrypted in transit with TLS 1.2+ and at rest with AES-256. Database connections use SSL certificates.
Row-Level Access
Your financial data is isolated at the database level. No other user (not even workspace admins) can access your records.
Read-Only Bank Access
Bank sync through Plaid is strictly read-only. We never have access to your bank login credentials or the ability to move money.
SOC 2 Infrastructure
Our hosting providers maintain SOC 2 Type II compliance. Infrastructure is monitored 24/7 with automated alerting.
Authentication
Netted authenticates through Slack's OAuth 2.0 flow. We never store passwords. Access tokens are encrypted at rest and scoped to the minimum permissions required.
Minimal Permissions
We request only the Slack scopes we need:
app_mentions:read: Respond when you @mention Netted in channels.chat:write: Send DM responses to you.commands: Register slash commands.users:read: Look up your display name and profile.im:history, im:read, im:write: Converse with you in DMs.files:read: Process receipts and documents you share.
We do not access public channels, private channels, or other users' messages.
Data Retention
Your data is retained as long as your account is active. When you delete your account, all associated data is permanently removed within 30 days. Backups containing deleted data are purged within 90 days.
Incident Response
In the event of a security incident that affects your data, we will notify impacted users via Slack DM and email within 72 hours, in accordance with applicable data breach notification laws.
Vulnerability Reporting
If you discover a security vulnerability, please report it responsibly to [email protected]. We appreciate the security research community and will acknowledge your report within 48 hours.
Questions
For security-related inquiries, contact [email protected].