Security

Ahorradito holds a detailed picture of your finances. This page describes how that information is protected and how to tell us if you find a problem.

The biggest protection is structural

Ahorradito never asks for your bank credentials and never connects to your bank. There is no stored banking login to steal, and no third-party aggregator holding access to your accounts. Everything in Ahorradito is what you typed in.

Your account

Passwords are hashed with bcrypt before storage. We cannot read your password, and neither can anyone who obtains a copy of the database.

Sign-in is rate limited both per account and per IP address, so repeated guessing is throttled rather than merely logged. Password recovery requests are rate limited the same way.

Sign-in takes the same amount of work whether or not the email address exists, so the response cannot be used to discover who has an account.

Invitations are rate limited per person, so the invite-by-email feature cannot be used to test which addresses are registered.

Your data

Traffic between your browser and Ahorradito is served over HTTPS.

Access to a financial space is explicit: a space is private until you invite someone, and each member has a role that determines what they may do. You can change a role or revoke access at any time, and the change takes effect immediately.

Reporting a vulnerability

If you believe you have found a security problem, please tell us before telling anyone else, and give us a reasonable chance to fix it. Report it through the contact page with enough detail to reproduce the issue.

Please do not run automated scanners against the live service, access or modify data belonging to other people, or degrade the service for others while testing.

We will confirm we received your report, keep you informed while we investigate, and credit you when the fix ships if you would like us to.

What we are still working on

Ahorradito does not yet support two-factor authentication. It is on the roadmap. We would rather say so here than let this page imply a protection that is not there.