Security

Last updated: September 1, 2026

TillJotter holds your bookkeeping records — income, expenses, bank activity, and the numbers you file taxes on. This page describes, in plain English, how that data is protected and what we do and don't claim. No jargon, no badges we haven't earned.

Encryption

• In transit — all traffic between your browser and our servers is encrypted with TLS 1.2 or higher. The app is served over HTTPS only, and browsers are instructed to refuse an unencrypted connection.
• At rest — your database is encrypted at rest with AES-256 by our infrastructure provider.
• Bank tokens — the access tokens that let us fetch your transactions get a second layer of AES-256-GCM encryption at the application level, with a key held outside the database. A copy of the database alone does not yield working bank access.

Credentials we never see

• Your bank login is entered directly into Plaid, never into TillJotter. We never receive, store, or have any way to read it.
• Your card details are entered on Stripe's hosted checkout. Card numbers never touch our servers, so there is no card data here to lose.
• Your password is stored only as a salted hash by our authentication provider. Nobody — including us — can read it.

What the AI features send

Three features send data to an AI provider, and only at the moment you use them: categorization suggestions, the "Ask about your books" assistant, and receipt scanning. The first two send the transaction descriptions and amounts relevant to your question. Receipt scanning sends the image you upload, which typically shows the business you paid and the card's last four digits.

Nothing is sent in the background, and nothing is sent if you don't use these features — you can type receipt details in by hand, and the ledger, reports and Schedule C summary never involve them. The provider is named in the Privacy Policy.

Separation between accounts

Every table holding customer data is protected by row-level security enforced by the database itself, not just by application code. Each query is constrained to the rows belonging to the authenticated user. A bug in the interface cannot expose another customer's books, because the isolation is applied one layer below the application.

When you share your books with an accountant, that access is explicit, scoped, and revocable by you at any time.

Account security

• Sign-in requires a verified email address and a password.
• Changing your email or password requires re-entering your current password — so someone at an unlocked screen cannot quietly take the account over.
• Changing your password signs out every other device immediately.
• You are emailed automatically whenever your password or email address changes, so an unexpected change is visible to you within seconds.
• On desktop, sessions end automatically after 15 minutes of inactivity.

Application hardening

• A Content Security Policy restricts what the page is permitted to load or execute.
• The app refuses to be embedded in a frame, blocking clickjacking.
• Browsers are told not to guess content types, and referrer information is limited.
• Server-side limits cap AI, receipt, and bank usage per account, so a single account cannot exhaust shared resources.
• Error monitoring. When the app fails, a diagnostic report goes to our monitoring provider so we notice before you have to tell us. Amounts, transaction dates, account names, email addresses and identifiers that could identify you are stripped out first, and the contents of your books are never included.

Where your data lives

The application is hosted on Vercel. Your data is stored in a managed Postgres database on Supabase, running on AWS infrastructure in the United States (Oregon, us-west-2). Our subprocessors are listed in the Privacy Policy.

Backups and retention

• Daily backups. The database is backed up automatically once a day, with seven days of retention, by our database provider. Backups are encrypted at rest, like the database itself.
• No point-in-time recovery. We can restore from a daily backup, but we cannot currently rewind the database to an arbitrary moment. If that changes, this page changes with it.
• If you cancel. Your subscription ends and your account moves to the Free plan. Your books stay where they are and stay readable. We do not delete your data because you stopped paying.
• If you delete your account. The deletion is immediate, permanent, and something you do yourself from inside the app. It is not a request queued for us to action. Copies held in the backup window age out within seven days.

Worth being clear about what backups are for: they protect against our failures, not yours. A daily backup will not bring back a transaction you deleted last week. That is what your own exports are for, which is why they are one click and never restricted by plan.

Your data stays yours

• Export everything, any time — including on the free plan. One click produces a complete file of your accounts, transactions, rules, reconciliations, mileage, and settings. Your ledger and reports also export to CSV for use in any spreadsheet.
• Delete everything, any time — you can permanently delete your account and all associated data from within the app.
• We do not sell your data, and we do not use your financial records to advertise to you.

What we don't claim

We think being straight about the boundaries matters more than looking impressive:

• We are not a bank, and we do not move money. TillJotter reads transactions and records them; it cannot initiate a payment or transfer.
• TillJotter is bookkeeping software, not tax or legal advice. Confirm anything consequential with your accountant.