Security

Last updated: November 24, 2025

Your Security is Our Priority

TallyCrew is built with security at its core. We implement industry-standard security practices to protect your data and ensure your privacy.

1. Security Overview

Overall Security Posture: EXCELLENT ✅

TallyCrew has undergone comprehensive security audits and implements enterprise-grade security measures to protect your data.

Security Audit Status: Our most recent security audit was completed on November 19, 2025, with no critical vulnerabilities found. TallyCrew is production-ready and safe for use.

We are committed to:

  • Protecting your personal information with bank-level security
  • Maintaining transparency about our security practices
  • Conducting regular security audits and updates
  • Responding promptly to security concerns
  • Following industry best practices and compliance standards

2. Website Security (TallyCrewWeb)

Our website is designed with security and privacy in mind.

The TallyCrew website is a static landing page with minimal security concerns:

  • ✅ No user data collection or storage
  • ✅ No cookies or tracking technologies
  • ✅ HTTPS encryption for all connections
  • ✅ No forms that submit sensitive information
  • ✅ Regular security updates and monitoring
  • ✅ No known vulnerabilities

For more information about our website privacy practices, see our Cookie Policy.

3. Mobile App Security (TallyCrew App)

The TallyCrew mobile application implements comprehensive security measures to protect your financial data and personal information.

3.1 Authentication Security

JWT-Based Authentication

We use industry-standard JSON Web Tokens (JWT) for secure authentication:

  • All API requests require a valid authentication token
  • Tokens are issued by Supabase Auth with secure signing
  • Automatic token refresh prevents session expiration
  • Tokens are securely stored on your device (AsyncStorage)
  • HTTPS-only transmission of authentication credentials
  • Token verification on every request

Strong Password Requirements

Your password must meet the following criteria:

  • Minimum 8 characters in length
  • Must contain both letters (a-z, A-Z) and numbers (0-9)
  • Case-sensitive for added security
  • Passwords are hashed using bcrypt (never stored in plaintext)
  • Client and server-side validation

Secure Session Management

  • Sessions are encrypted and stored securely on your device
  • Automatic session refresh at 50% of token lifetime
  • Logout immediately clears all session data
  • Session validation on app start
  • Support for multiple concurrent sessions across devices
  • No session information stored in URLs

OAuth Integration

We support secure OAuth authentication with Google, using industry-standard OAuth 2.0 protocols with proper redirect URI validation and session verification.

3.2 Data Encryption

Bank-Level Encryption

All your data is protected with the same encryption standards used by financial institutions.

Encryption in Transit

  • All data transmitted over HTTPS with TLS 1.3 encryption
  • End-to-end encryption between your device and our servers
  • Certificate pinning prevents man-in-the-middle attacks
  • No data transmitted over unencrypted connections

Encryption at Rest

  • Database encryption provided by Supabase (PostgreSQL)
  • Local data on your device encrypted by the operating system
  • AsyncStorage data automatically encrypted on modern devices
  • Passwords hashed with bcrypt (never stored in plaintext)

3.3 Database Security

Row Level Security (RLS)

Every database table is protected by PostgreSQL Row Level Security policies:

  • Users can only access data they own or have permission to view
  • Group members can only access their own groups and expenses
  • Individual debts are only visible to the involved parties
  • Friend relationships are properly isolated
  • Automatic permission checks on every database operation

SQL Injection Prevention

  • All queries use parameterized statements
  • No raw SQL concatenation in application code
  • Input validation and sanitization on all user data
  • Supabase client handles query parameterization automatically

Database Functions Security

  • SECURITY DEFINER functions with search path protection
  • Prevents search path manipulation attacks
  • Functions validate user identity with auth.uid()
  • Comprehensive testing of all security policies

3.4 API Security

Multi-Layer API Protection

Our API is protected by multiple security layers to prevent unauthorized access.

Security Layers

  • Network Layer: HTTPS only (TLS 1.3), Supabase API gateway, DDoS protection
  • Authentication Layer: JWT verification, token expiration checks, invalid token rejection
  • Authorization Layer: Row Level Security (RLS), policy evaluation per query, user context isolation
  • Application Layer: Input validation, SQL injection prevention, XSS protection

External API Access

While our API endpoints are technically accessible (as with any REST API), they are fully protected:

  • ❌ Unauthenticated requests are blocked by RLS policies
  • ❌ Valid users cannot access other users' data
  • ✅ Only properly authenticated and authorized requests succeed

3.5 Access Control

TallyCrew implements strict access control policies:

Personal Data

  • You can only view and modify your own profile information
  • Other users cannot access your personal data without permission
  • Profile visibility is controlled by your privacy settings

Group Expenses

  • Only group members can view group expenses
  • Group creators can manage group settings and members
  • All group members can add expenses
  • Expense modifications are tracked and auditable

Individual Debts

  • Only the two parties involved can see individual debts
  • Debt records are completely private
  • No third-party access to your debt information

3.6 Third-Party Security

TallyCrew integrates with trusted third-party services that maintain their own security standards:

Supabase (Database & Authentication)

  • Enterprise-grade security and compliance
  • SOC 2 Type II certified
  • GDPR and CCPA compliant
  • Regular security audits and penetration testing
  • 99.9% uptime SLA
  • Learn more: Supabase Security

PayPal (Payment Processing)

  • Industry-leading payment security
  • PCI DSS compliant
  • Buyer and seller protection
  • TallyCrew never stores your payment information
  • All transactions processed directly by PayPal
  • Learn more: PayPal Security

No Analytics or Tracking

We do NOT use Google Analytics, Facebook Pixel, or any other third-party tracking or advertising services. Your activity is private.

4. Security Best Practices

We follow industry best practices to maintain a secure application:

Regular Security Audits

  • Comprehensive security audits performed regularly
  • Most recent audit: November 19, 2025 (no critical issues found)
  • Continuous monitoring for security vulnerabilities
  • Prompt response to any identified issues

Dependency Management

  • Regular dependency vulnerability scanning
  • Automated security updates for dependencies
  • Current status: 0 known vulnerabilities
  • Use of trusted, well-maintained libraries

Secure Development

  • No sensitive data in source code
  • Environment variables properly protected
  • Build exclusions for sensitive files
  • Code review process for all changes
  • Automated testing including security tests

5. Data Protection Measures

What Data We Collect

We collect only the minimum data necessary to provide our service:

  • Account information (email, name, optional profile picture)
  • Expense records (amounts, descriptions, dates)
  • Group information (names, members)
  • Individual debt records

For complete details, see our Privacy Policy.

How Data is Stored

  • All data encrypted in transit (HTTPS/TLS)
  • All data encrypted at rest (database encryption)
  • Stored on secure Supabase servers
  • Regular backups with encryption
  • Geographic redundancy for reliability

Who Can Access Your Data

  • Only you can access your personal data
  • Group members can see shared group expenses
  • Individual debts are only visible to the two parties involved
  • TallyCrew staff cannot access your data without proper authorization
  • We never sell or share your data with third parties

Data Retention & Deletion

  • Your data is retained while your account is active
  • You can delete your account at any time
  • Account deletion permanently removes your personal data
  • Some shared expense records may remain visible to other group members
  • Deletion is immediate and cannot be undone

6. Vulnerability Reporting

Responsible Disclosure

We appreciate security researchers and users who help us maintain the security of TallyCrew.

How to Report Security Issues

If you discover a security vulnerability, please report it to us responsibly:

  • Email us at support@confirm.tallycrew.com with "Security Vulnerability" in the subject line
  • Provide detailed information about the vulnerability
  • Include steps to reproduce the issue if possible
  • Do not publicly disclose the vulnerability until we've addressed it
  • Allow us reasonable time to fix the issue before disclosure

Our Commitment

  • We will acknowledge your report within 48 hours
  • We will provide regular updates on our progress
  • We will credit you for the discovery (if desired)
  • We will not take legal action against responsible disclosure
  • We will work to fix verified vulnerabilities promptly

7. Security Certifications & Compliance

Regulatory Compliance

  • GDPR: General Data Protection Regulation (EU) compliant
  • CCPA: California Consumer Privacy Act compliant
  • User rights to access, modify, and delete data
  • Transparent data collection and usage policies
  • Data protection by design and by default

Industry Standards

  • HTTPS/TLS encryption (TLS 1.3)
  • OAuth 2.0 for third-party authentication
  • JWT (JSON Web Tokens) for session management
  • Bcrypt for password hashing
  • Row Level Security (RLS) for database access control

Regular Updates

  • Security patches applied promptly
  • Regular dependency updates
  • Continuous monitoring for new vulnerabilities
  • Proactive security improvements

8. Security Features for Users

TallyCrew provides you with tools to protect your account and data:

Account Security

  • Strong Passwords: Required minimum 8 characters with letters and numbers
  • Secure Logout: Immediately clears all session data
  • Session Management: Automatic logout after extended inactivity
  • OAuth Options: Sign in securely with Google

Data Control

  • View Your Data: Access all your information in the app
  • Export Data: Request a copy of your data at any time
  • Delete Account: Permanently delete your account and data
  • Modify Information: Update or correct your data anytime

Privacy Controls

  • Control who can see your profile information
  • Manage group memberships and visibility
  • Choose what information to share with friends
  • Opt out of optional features

9. Incident Response

Security Monitoring

  • 24/7 monitoring of system security and performance
  • Automated alerts for suspicious activity
  • Regular security log reviews
  • Proactive threat detection

Incident Response Procedures

In the event of a security incident, we follow a structured response process:

  • Detection: Identify and verify the security incident
  • Containment: Isolate affected systems to prevent spread
  • Investigation: Analyze the incident to understand scope and impact
  • Remediation: Fix vulnerabilities and restore normal operations
  • Notification: Inform affected users as required by law
  • Review: Conduct post-incident analysis and improve processes

User Notification Policy

If a security incident affects your data, we will:

  • Notify you promptly via email
  • Explain what happened and what data was affected
  • Describe the steps we're taking to address the issue
  • Provide guidance on protecting your account
  • Answer your questions and concerns

Continuous Improvement

  • Learn from security incidents and near-misses
  • Update security policies and procedures
  • Implement additional safeguards as needed
  • Share lessons learned with the security community

10. Contact Information

For security-related questions, concerns, or to report vulnerabilities:

Security Contact

Email: support@confirm.tallycrew.com

For security vulnerabilities: Include "Security Vulnerability" in the subject line.

For security questions: Include "Security Question" in the subject line.

For account security issues: Include "Account Security" in the subject line.

Response Times:

  • • Security vulnerabilities: Within 24 hours
  • • Account security issues: Within 24 hours
  • • General security questions: Within 48 hours

11. Additional Resources

For more information about how we protect your data and privacy:

Thank You for Trusting TallyCrew

Security is a continuous journey, not a destination. We are committed to maintaining the highest security standards and protecting your data. If you have any security concerns or questions, please don't hesitate to contact us.

Your trust is our most valuable asset, and we work hard every day to earn it.