> ## Documentation Index > Fetch the complete documentation index at: https://recontrol.money/docs/llms.txt > Use this file to discover all available pages before exploring further. # Security > How Recontrol protects your data in transit, at rest, and on your device. *Last updated 22 October 2026.* ## Protections in place | Layer | Measure | | - | - | | **Data in transit** | All traffic is encrypted over TLS/HTTPS | | **Data at rest** | Database encrypted at rest using AES-256, provided by AWS | | **Integration tokens** | Access tokens for connected banks/brokers (Plaid, Zerodha) are additionally encrypted at rest with AES-256-GCM before storage | | **Telemetry** | Sensitive fields are stripped at the source, before any monitoring data leaves our systems | | **Webhooks** | Incoming webhooks from Plaid and our billing provider are verified cryptographically as well as by a shared secret | | **Device storage** | On the phone, authentication tokens are stored in iOS Keychain / Android Keystore via Expo Secure Store | | **Web sessions** | On the web, your sign-in is sealed and encrypted in a `Secure`, `HttpOnly`, `SameSite=Strict` cookie that page scripts can't read; the short-lived access token is held in memory only. You're signed out after an hour without activity, and asked to sign in again a day after you signed in | | **App lock** | Optional biometric app lock (Face ID / fingerprint), verified on-device by your operating system | | **API authentication** | All requests require a signed JSON Web Token (JWT) | | **Access control** | Collaborative spaces enforce granular role-based permissions | | **Input validation** | All API requests are validated using Protocol Buffer schema validation (protovalidate) | For our full security programme, see the [Information Security Policy](https://recontrol.money/docs/legal/security.md) and the [Access Controls Policy](https://recontrol.money/docs/legal/access.md). ## Connected accounts When you connect a bank (via Plaid) or your Zerodha account, we **never** receive your login credentials — authentication happens directly with the provider. We store only an access token, encrypted with AES-256-GCM, which you can revoke at any time by disconnecting. See [What we store](https://recontrol.money/docs/data/storing.md). ## Payments Purchases happen entirely inside the Apple App Store or Google Play. **We never see your card number, billing address, or payment details.** What reaches us is only whether an active subscription exists and when it expires. See [Pricing and subscription](https://recontrol.money/docs/features/subscription.md). ## Telemetry Our server-side monitoring is instrumented with **OpenTelemetry** and forwarded to Grafana Cloud through a collector we run ourselves — nothing in the app pushes telemetry directly to a vendor. Sensitive fields are removed **at the source**, before anything is exported, using a deny-by-default allowlist: only an explicitly permitted set of technical fields may be emitted, so a new field added later cannot silently start leaking. Names, amounts, balances, email addresses, tokens and free text are never on that list. Crash reports from the app are stripped the same way — the error type and code locations are kept, the message and any runtime values are not. ## What we do not do * We never see your Google or Apple password, and a password your Recontrol account has is stored only as a one-way hash * We do not receive or store your bank or brokerage login credentials * We do not receive or store your card or payment details * We do not have access to your authentication tokens after they are issued to your device * We do not receive your biometric data — the app lock is handled entirely by your device * We do not record or transmit audio — voice questions are transcribed by your device's or browser's own speech recognition * We do not send your financial data (balances, transactions, holdings), name, or email to our analytics tool (PostHog); it only records pseudonymous usage events and stripped crash reports, and you can turn it off in Settings * We do not store Chat answers or conversation history on our servers * We do not use any advertising SDK or cross-app tracking ## Limitations No system is perfectly secure. Transmission over the internet carries inherent risk. If you discover or suspect a security issue, contact us immediately at [support@recontrol.money](mailto:support@recontrol.money). See [Reporting a security issue](https://recontrol.money/docs/trust/disclosure.md). ## Data breach notification In the event of a personal data breach, we will notify affected users and the relevant authorities under the laws that apply to them — the **Data Protection Board of India** under the Digital Personal Data Protection Act, 2023 and its Rules, 2025; state authorities and affected residents in the **United States** under applicable state breach-notification laws; and the **Office of the Privacy Commissioner of Canada** (and the Commission d'accès à l'information for Quebec) where a breach creates a real risk of significant harm. Our incident-response process is described in the [Information Security Policy](https://recontrol.money/docs/legal/security.md). ## Storage location > [!NOTE] > > **Changed 29 July 2026.** Our database moved from AWS ap-south-1 (Mumbai, India) to AWS us-east-1 (Northern Virginia, United States), putting the database in the same country as the API server that reads it. Your data is **stored at rest in AWS us-east-1 (Northern Virginia, United States)**. There is no secondary copy or offsite backup in another region. Our **API server is also hosted in the United States** (Railway), so your data is stored and processed in the same country. The web app at app.recontrol.money is served by **Vercel**, which handles the web's requests, including IP addresses, and data passing through the web app's own server. If you use Recontrol from **outside the United States** — including Canada, India, or elsewhere — your data is stored and processed in the United States. See the [Privacy Policy](https://recontrol.money/docs/legal/privacy.md#8-data-storage-location-and-international-data-transfers) for the cross-border disclosure and your regional rights. If you connect a bank using **Plaid**, your banking data is processed by Plaid in the **United States** before reaching us — this only happens if you choose to use the bank-connection feature. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.