Last updated: July 2026
This page summarizes the security and privacy controls CozyBudget has in place so partners such as Plaid can review our attestations. Each item below maps to a requirement in our partner diligence questionnaires and links to the detailed policy on our Information Security Policy page.
The following attestations are due January 22, 2027. They are maintained by CozyBudget and reflect our current operational controls.
Dedicated access_reviews table records every quarterly review (reviewer, date, findings). Admin-only via the has_role() security-definer function. Immutable audit_log table records role grants and revokes automatically via a database trigger (audit_user_roles_changes). Policy: Security §4 & §11.
Published SLA — Critical: 24h · High: 7d · Medium: 30d · Low: 90d — in SECURITY.md at the repository root and Security §8. Findings are tracked in our issue tracker to resolution.
GitHub Actions workflow .github/workflows/security.yml runs an EOL check against endoflife.date on every push and weekly. Dependency updates land through normal PR review before runtime EOL dates.
Same workflow runs bun audit, a backup npm audit, and GitHub CodeQL static analysis on every push, pull request, and weekly. Lovable's built-in dependency and security scanners also run against the lockfile.
User deletion cascades through every user-owned table via ON DELETE CASCADE foreign keys, revokes the auth session, and writes a account.deleted entry to audit_log. Users can self-serve from Account Security → Danger zone. Role changes trigger the same automatic audit-log entry.
Every request is authenticated by a short-lived JWT and authorized by row-level security on every table (verified by the Supabase linter). Sensitive routes — bank connections, business finances, account security — are gated by our MFAGate component and require a fresh TOTP challenge. Secrets are stored outside source in Lovable Cloud.
All traffic is TLS-terminated by Cloudflare. User sessions use JWTs issued by Supabase Auth. Third-party integrations use OAuth access tokens (Plaid) and signed webhooks verified with HMAC-SHA256 in constant time (see src/routes/api/public/plaid-webhook.ts). No long-lived secrets are shipped to the browser.
Documented on the Information Security Policy page (§4 access control, §3 roles, §11 review cadence). Enforced in code by row-level-security policies on every table, the has_role() function, and the MFAGate component. Reviewed at least annually.
.github/workflows/security.yml — automated vulnerability, EOL, and static analysis scansSECURITY.md — vulnerability disclosure process and remediation SLApublic.audit_log — immutable audit trail (admin-only reads)public.access_reviews — quarterly access review recordspublic.user_roles + has_role() — role-based access controlMFAGate component + Account Security — MFA enrollment, recovery codes, session revocation, self-service account deletionWhen a partner such as Plaid requests diligence information, we answer based on the controls and policies described here. If a question is not covered by our public documentation, we review it internally before submitting any attestation.
This Compliance Center and the underlying Information Security Policy are reviewed at least once per year and whenever there is a material change to our technology, vendors, or risk profile. The last review date is shown at the top of this page.
Questions about compliance or partner diligence? Email us at info@aalbertmemories.com or reach us through the in-app support option in Settings.