Security Overview

This page explains the security controls that are actually in place in The Ultimate Bill Organizer™ today, in language you can verify against how the product behaves. It is a transparency document, not a certification.

We do not claim SOC 2, ISO 27001, PCI DSS, HIPAA, or any other audit or certification. If we ever complete one, we will say so here with the report date and auditor.

• Accounts are created with an email address and password, or with Google sign-in.
• Passwords are never stored in the application database in readable form; authentication is handled by our managed authentication provider.
• Sessions use short-lived access tokens that are refreshed automatically, so a stolen token has a limited useful life.
• Signing out clears the session on the device and discards the cached view of your data.

Roles are stored in a dedicated roles table, separate from user profiles, and are checked on the server for every administrative request.

• Ordinary accounts can only reach their own financial data.
• Administrative surfaces (platform health, backup rehearsal, executive and conversion reporting, and the Trust Center manager) are restricted to founder/admin roles.
• Those checks run on the server. Hiding a link in the interface is never the security control.
• Administrative reporting is built from aggregates and never displays another user's financial records.

Every table that holds customer information has row-level security enabled, with policies that scope reads and writes to the signed-in account.

• Bills, payments, income, expenses, goals, documents, credit records, disputes, plans, and Orion conversations are all owner-scoped.
• Requests are executed as the signed-in user, so the database — not just the application — enforces the boundary.
• Published Trust Center documents are the only records intentionally readable by the public.

• Uploaded statements and receipts go to a private storage bucket. There is no public URL for your files.
• Files are served through short-lived signed links generated only for the owner's session.
• Extraction results are written to your own rows and are visible only to you.

• All traffic between your browser, Orion, and our providers is encrypted in transit with TLS.
• Data at rest is encrypted by our managed database and storage providers.
• We do not offer end-to-end encryption: Orion has to read your financial records to organize and analyze them.

• The managed platform takes automated database backups on our behalf.
• We maintain a written restoration runbook and periodically rehearse recovery in a non-destructive way.
• Recovery rehearsals are logged internally so we can see when the process was last exercised.

Backups are a platform capability, not a guarantee. Export your own records periodically if a copy outside Orion matters to you.

• We run an internal platform health review that checks access rules, storage privacy, authentication configuration, and error activity.
• Findings are tracked to resolution internally. Diagnostic detail is never published.

• Secrets, API keys, and credentials of any kind.
• Internal infrastructure identifiers, hostnames, or private administrative URLs.
• Open findings, scan output, or customer information.

• Use a strong, unique password and protect the email account that can reset it.
• Sign out on shared devices.
• Report anything suspicious to security@ultimatebillorganizer.com right away.

Security questions and vulnerability reports: security@ultimatebillorganizer.com. See the Responsible Disclosure page for how reports are handled.