Security & privacy

How your data is protected, where Ember runs, and what it does not have.

Ember holds a picture of your money, so this page states how that picture is protected, who can reach it, and what Ember does not have. Your bank credentials never reach Ember, and your data is used to show you your own finances and nothing else.

Your bank credentials never reach Ember

Bank connections go through Plaid, the service behind many major finance apps. Ember never sees, transmits, or stores your banking password.

Where you type that password depends on your bank:

Banks that support OAuth, which now includes most large US institutions, send you to their own website to sign in. Your credentials go to your bank, and your bank then authorizes Ember to receive account data.
Banks that do not take your credentials inside Plaid's window. Plaid holds them, and Ember still never receives them.

Either way Ember receives a scoped access token for reading account data, not a password, and you can revoke it from Ember or from your bank.

Plaid is in the path in both cases. OAuth changes where your password goes. It does not remove the intermediary. If you would rather use no intermediary, Ember imports CSV files you download from your bank yourself, and that path involves no third party.

Encryption

Traffic between your browser and Ember uses TLS, and plain HTTP requests are redirected to HTTPS. The disk holding the database is encrypted at rest.

How your account is protected

Passwords are hashed with Argon2id, and are never stored or logged in readable form.
Passkeys are supported for sign-in and for two-factor authentication. A passkey cannot be phished or replayed on a fake site.
Sessions use signed, HttpOnly, SameSite cookies, marked Secure in production, with bounded lifetimes. Changing or resetting your password signs out every other session.
Sign-in attempts are throttled twice: per-IP rate limiting on login and registration, plus per-account lockout after repeated failures.
Every state-changing request requires a CSRF token, and security headers are stamped on every response.
Every record is scoped to its owner. Data access is filtered by your identity at the query layer, so there is no path to another person's data through the API.
Invites, sign-ins, and password changes are recorded in an audit log.

Invite-only while in beta

Accounts exist only when you are sent an invite: single-use, time-bound, and optionally locked to your email address. This is a security property as much as a product one. The number of people who can reach the system is small and known.

AI features are off until you turn them on

Ember can use a language model for three optional things: matching merchant names, summarizing what you bought, and naming a group of charges. Each has its own switch and each is off by default, because each sends different information. Nothing reaches a model until you opt in, and no model output changes your ledger without your confirmation.

Where Ember runs

Ember runs on Fly.io, on hardware in data centers certified to ISO 27001. Fly.io is independently audited under SOC 2 Type II.

That accreditation belongs to the infrastructure Ember runs on, not to Ember itself. The distinction is worth stating: the floor is audited, and what the application does on top of it is described everywhere else on this page.

Backups

The database runs on a managed Postgres service that takes continuous backups and can restore it to a point in time. A self-hosted instance on SQLite takes a snapshot before any schema change, and the app refuses to apply the change if that snapshot fails.

Your data is used only for you

Your financial data has one job: showing you your own finances. It is not used for advertising, it is not sold, and it is not part of any data partnership.

There is no self-service delete yet. To remove your financial records or close your account, write to the address below. Ember removes both within 30 days and revokes every bank connection.

What Ember does not have

Everything above is something Ember does. These are the things it does not. A security page that lists only strengths is not much use.

Ember holds no compliance certification of its own. The SOC 2 and ISO 27001 above belong to the infrastructure provider. Ember has not been audited against either.
No third-party penetration test has been performed.
There is no bug bounty program.
Ember is operated by one person. There is no 24/7 on-call rotation. Reports are read and acted on, but not within minutes at any hour.

If you need a vendor with an audited compliance program today, Ember is not one yet. This page will say so when that changes.

Reporting a security issue

Email security@emberfinance.app with what you found and how to reproduce it.

Please do not test against other people's accounts, and do not run automated scans against the live service. If you need an account to test with, ask.

For privacy questions, including a request to see or delete your data, email privacy@emberfinance.app.