Security
Last updated July 25, 2026
Cerneiq exists to show you your whole financial picture in one place, which means the bar for how we protect it has to be higher than a typical app. Here's what that actually looks like under the hood.
Two-factor authentication
You can enable TOTP-based two-factor authentication (works with any authenticator app) from Settings → Security. Once enabled, every new session must complete a code challenge before it can reach your financial data or any data-export endpoint — not just the pages you see in the browser. Turning 2FA off, and changing your password, both require re-entering your current credentials at the moment of the change, not just an already-unlocked session. We also notify you in-app whenever either of those happens, and that notification can't be turned off.
Your data is isolated at the database level
Every table is protected by row-level security policies enforced by Postgres itself — not just application code — so a bug in a page or API route can't leak another user's data. Access to your account's data requires being an authenticated member of that account, checked on every single query.
Connected accounts
Bank and brokerage connections go through Plaid. Your bank login credentials are entered directly into Plaid's interface — they never pass through or get stored on Cerneiq's servers. The access token Plaid issues afterward is stored in an encrypted secrets vault, not in a plain database column.
Billing
Payments are handled entirely by Stripe. We never see or store your full card number.
Encryption and infrastructure
All traffic to Cerneiq is encrypted in transit (HTTPS/TLS). Data at rest is encrypted by our database provider. We apply standard security headers to every response and rate-limit authentication and two-factor endpoints to slow down brute-force attempts.
Monitoring
Security-relevant actions on your account — sign-ins, password changes, two-factor changes, and data exports — are logged so we can investigate suspicious activity.
Reporting a vulnerability
If you find a security issue, please email hello@cerneiq.com with details before disclosing it publicly. We take these reports seriously and will respond promptly.