Security

SomedayFund is built around the principle of minimal exposure — we only collect what's needed, we protect it at every layer, and we give you full control over your data. This page describes our security practices at a high level.

Encryption at rest

Sensitive fields in your account — including merchant names, transaction notes, bank names, card details, phone number, and savings goal labels — are encrypted before being written to the database. This means that even a full database compromise does not expose the most sensitive parts of your financial history in readable form.

Encryption keys are stored separately from the data they protect, in a dedicated secrets management system. Access to encryption keys is strictly controlled and audited.

Encryption in transit

All communication between your browser and SomedayFund's servers is encrypted via TLS (HTTPS). We enforce HTTPS and reject unencrypted connections.

Passwords

Passwords are never stored in any recoverable form. We store only a one-way hash derived from your password using a strong hashing algorithm with a high work factor. Even SomedayFund staff cannot recover your password.

Session tokens

Authentication session tokens are hashed before storage. Raw tokens are never written to the database. Logging out immediately invalidates your session — it cannot be reused even if intercepted.

Two-factor authentication

SomedayFund supports time-based two-factor authentication (2FA) via any standard authenticator app (Google Authenticator, Authy, and others). We strongly recommend enabling 2FA on your account.

When 2FA is enabled, logging in requires both your password and a time-sensitive code from your authenticator app. Backup codes are provided at setup for account recovery if you lose access to your device.

Rate limiting

Login attempts, registration, password reset requests, and other sensitive actions are rate-limited to prevent automated brute-force attacks. Repeated failed attempts will result in temporary lockouts.

Session management

You can be signed in on multiple devices simultaneously. Each device has an independent session. Changing your password or logging out of a specific session immediately invalidates that session's credentials.

Cookie security

Authentication cookies are set with HttpOnly (not accessible to JavaScript), SameSite=Strict (not sent on cross-site requests), and Secure (HTTPS only). This protects against common web attacks including cross-site request forgery (CSRF) and cross-site scripting (XSS) token theft.

Access controls

Access to production systems and user data is restricted to a minimal number of authorised personnel. No SomedayFund team member has routine access to individual user transaction data. The administrative interface exposes only aggregate statistics — not individual user records.

Infrastructure

SomedayFund is hosted on reputable cloud infrastructure with industry-standard physical and network security controls. Our database server is not publicly accessible — it accepts connections only from the application server on a private network.

Security headers

SomedayFund enforces a strict set of HTTP security headers including Content-Security-Policy, HTTP Strict Transport Security (HSTS), X-Frame-Options, and others to protect users from common web vulnerabilities.

Audit logging

Security-relevant events — including logins, failed login attempts, password changes, and 2FA activity — are logged with timestamps and IP addresses. You can view your own activity log in Settings → Danger zone → Activity log.

Dependency management

We monitor our software dependencies for known security vulnerabilities and apply security updates promptly.

Security is a shared responsibility. Here's what you can do to keep your account secure:

• Enable two-factor authentication — it's the single most effective step you can take
• Use a strong, unique password — don't reuse passwords across services. A password manager makes this easy
• Save your backup codes — store them in your password manager, not in a photo on your phone
• Log out on shared devices — always log out when using a shared or public computer
• Review your activity log — check Settings → Activity log periodically for any logins you don't recognise
• Report suspicious activity — if you see anything unexpected, contact us immediately

If you discover a security vulnerability in SomedayFund, we ask that you report it to us privately before disclosing it publicly. This gives us time to investigate and fix the issue before it can be exploited.

We ask that you:

• Do not access, modify, or delete user data beyond what is necessary to demonstrate the vulnerability
• Do not perform denial-of-service attacks or disrupt the service
• Do not disclose the vulnerability publicly until we have had a reasonable opportunity to address it

We will not pursue legal action against researchers who follow these guidelines in good faith. We genuinely appreciate responsible security research and will acknowledge your contribution.

For security questions, vulnerability reports, or concerns about the security of your account: