Security

Public summary. Last reviewed 2026-08-24.

Pencil In is built by a single operator, which shapes how security works: there is no staff to provision, so the controls are about keeping systems locked to one identity, keeping secrets out of reach, and making deletion complete.

Bank credentials

We never handle them. Bank login happens inside Plaid Link, and for institutions that support it, on the bank's own OAuth page. We receive a read-only token.

Encryption

Plaid access tokens are encrypted at rest with AES-256-GCM. Each row has its own data key, wrapped by a hardware key in AWS KMS; the wrapping key never leaves the HSM. Database storage (Neon Postgres) and backups are encrypted at rest by the provider. All traffic is TLS 1.2 or later.

Access control

Every production system (GitHub, Railway, Neon, AWS, Clerk, Plaid, Apple Developer, Cloudflare) is behind a single owner identity with multi-factor authentication. Secrets are held in a password manager and in each platform's secret store; they are never committed to source. Keys are rotated on a schedule and immediately on any suspected exposure.

Authentication

Users sign in with Sign in with Apple, which requires Apple two-factor authentication. Sessions are short-lived signed tokens issued by Clerk and verified on every request.

Vulnerability management

Dependencies are scanned automatically (Dependabot) on every repository. Security updates are applied within 7 days for critical severity and 30 days otherwise. End-of-life runtimes and libraries are tracked and replaced before support ends.

Deletion

Disconnecting a bank revokes the Plaid item and deletes its data. Deleting an account removes every server-side record, the identity provider record, and the Apple sign-in grant in one step. Full policy in the privacy policy.

Reporting a problem

If you believe you've found a security issue, email [email protected]. We'll acknowledge within 2 business days.