Security Policy

How we protect your financial data — what we do, how we do it, and what to do if you find a vulnerability.

Last updated: 11 July 2026

1. Authentication

All user authentication is handled by Clerk, an industry-standard authentication platform with SOC 2 Type II certification. We do not build or manage our own password system.

• Sign-in is available via Google, Microsoft, or email magic link — no passwords to remember or leak.
• Multi-factor authentication (MFA) is available and strongly recommended.
• Session tokens are short-lived and expire automatically. Signing out on one device does not automatically end sessions on others; you can manage active sessions from Account Settings.
• We never store passwords. Clerk manages credential storage using industry-standard hashing and salting.

2. Data Encryption

3. Data Isolation

Every table in our database uses Row-Level Security (RLS). This means your data is invisible to all other users — not just by convention, but enforced at the database level. Even a bug in our application code cannot expose one user's records to another.

The RLS policy ties every row to your Clerk user ID, verified via a signed JWT on each request.

4. How CSV Import Works

Tonic Pro imports your transactions from CSV files you download from your bank. This is deliberate — it is the most secure approach to bank data:

• Your CSV file is processed entirely in your browser. The raw file is parsed locally using JavaScript (PapaParse) and is never uploaded to our servers.
• Only the parsed transaction records (date, amount, description, type) are sent to our database over an encrypted connection.
• We never request, store, or see your online banking username, password, or one-time codes.
• We do not use Open Banking APIs or any third-party financial data aggregator.

5. Infrastructure Security

6. Access Controls

• Access to production systems is restricted to authorised personnel only, protected by MFA.
• Our application uses a service-role database key only on the server side — it is never exposed to the browser.
• All secrets (API keys, database credentials) are stored as encrypted environment variables in Vercel, never in source code.
• Dependencies are regularly reviewed for known vulnerabilities.

7. Incident Response

In the event of a security incident affecting your personal data:

• We will notify affected users by email within 72 hours of becoming aware of the breach.
• We will report to the Information Commissioner's Office (ICO) where required by UK GDPR.
• We will take immediate steps to contain the incident, assess the scope, and remediate the root cause.
• We will provide a post-incident summary to affected users once our investigation is complete.

8. Responsible Disclosure

If you discover a security vulnerability in Tonic Pro, we ask you to report it to us privately before disclosing it publicly.

Please email: security@gettonic.co.uk

We ask that you:

• Describe the vulnerability and the potential impact clearly
• Do not exploit the vulnerability or access data belonging to other users
• Give us a reasonable amount of time (we aim to acknowledge within 2 business days and respond fully within 14 days) before public disclosure
• Do not use automated scanners against our production environment without prior agreement

We are grateful to security researchers who help keep Tonic Pro safe. We will acknowledge your contribution (with your permission) once the issue is resolved.

9. Your Own Security Practices

You can also help protect your account:

• Enable MFA on your Tonic Pro account via Account Settings.
• Use a strong, unique password (or use Google/Microsoft sign-in to avoid passwords entirely).
• Sign out on shared or public devices after each session.
• Check your active sessionsin Account Settings and revoke any you don't recognise.
• Download CSV files only from your official bank website and keep them in a secure location on your device.

10. Contact

For security concerns: security@gettonic.co.uk
For general queries: hello@gettonic.co.uk