Security

MaxMyPoints reads your card transactions in order to tell you which card you should have used. That is sensitive data, and this page describes the controls that are actually in place to protect it — not aspirations. Where something is handled by a provider rather than by us, we say so and name them.

Bank and card connections

Card connections go through Plaid, the bank-data provider used by a large share of consumer financial apps. You authenticate with Plaid or directly with your institution — never with us.

• We never see your username, password or security answers. They are not transmitted to us, and there is nowhere in our system they could be stored.
• Read-only, and narrow. We request transaction data only: date, merchant description, amount and category, plus the account identifiers needed to attribute a charge to the right card. We do not request the ability to initiate payments or transfers. We do not collect deposit or investment balances, income, employment history, or your credit report.
• The connection key never touches your browser. Plaid issues a long-lived access token when you link an account. It is held server-side, in a table that no signed-in user — including you — can read: that table has row-level security enabled with no read policy at all, so it is reachable only by our server functions. It is never sent to the browser, never placed in a URL, and never written to a log.
• Messages from Plaid are cryptographically verified. Plaid signs each webhook it sends us, and the signature is bound to the exact message body. We verify every one before acting on it and discard anything that fails, so a forged message cannot cause us to fetch or expose data.
• You can stop it, and the two ways of stopping differ. In Statements, Pause takes a card out of your audit but leaves the connection open and still receiving data, so resuming restores a complete history — it stops the scoring, not the retrieval. Disconnect is the one that stops retrieval: the card and the transactions imported from it are deleted, and once no other card on that bank login remains connected we revoke the connection at Plaid and your institution stops sharing with us. One login can carry several cards on a single authorisation, so while another of them is still connected that authorisation stays open — nothing from the disconnected card is stored either way. Deleting your account removes your data as described below.

Plaid's own handling of your information is governed by its End User Privacy Policy.

What we never store

• Bank or issuer login credentials — see above.
• Full card numbers. We hold the last four digits, for display, and nothing more. The card you pay us with lives at Stripe; we store only Stripe's identifier for it.
• Uploaded statement files. If you upload a statement, the file is deleted from storage once the transaction fields have been extracted from it — including when the extraction fails partway. We keep the transactions, not the document.
• Anything sent to an AI provider. Our automated catalogue checks read publicly published card terms from issuer websites. No customer data is included in those requests, and your transaction data is never used to train anyone's model.

Two-factor authentication

You can turn on two-factor authentication from your account settings, using any authenticator app. With it on, signing in asks for a six-digit code as well as your password, so someone who learns your password still cannot reach your transaction data.

We offer it rather than requiring it. If you lose your authenticator we have no way to verify who you are and let you back in — we hold no identity documents and run no support desk that could safely do it — so being locked out of an audit you paid for is a real cost, and the choice is yours. We do ask before you connect a bank account, because that is the point where it starts to matter.

Once you turn it on, a session that has only passed the password step cannot read your data — that rule is enforced by the database, not just by the app, so it holds even for a request that bypasses our website entirely.

Separation between accounts

Every table holding customer data — cards, transactions, audits, uploads, tool data — carries a row-level security policy tying each row to the account that owns it. That check runs inside the database on every single query, so it holds even if application code is wrong: a request for someone else's row returns nothing rather than returning their data.

Records that a customer should be able to read but never alter — subscriptions, computed audits, imported transactions, statement records — are additionally read-only to the browser. Write permission on them was revoked outright, and they are modified only by server functions. Uploaded receipts are held in a private storage bucket partitioned per account, with no public URLs.

Encryption

All traffic to the site and to our server functions runs over HTTPS (TLS 1.2 or higher); the site is served with HTTP Strict Transport Security. Data at rest — the database, file storage and backups — is encrypted by our infrastructure provider. Third-party credentials, including our Plaid and Stripe keys, are held in a managed secret store, injected into server functions at runtime, and are not present in our source repository.

Payments

Checkout and billing run entirely on Stripe's own hosted, PCI-DSS-certified pages. Your card number is entered on Stripe's page and never passes through our servers. Stripe's notifications to us are signature-verified in the same way Plaid's are, and a notification that fails verification is rejected.

Access to production

• Administrative access is limited to named staff accounts, held to the smallest number of people that can run the service.
• Signing in to the administrative panel requires a second factor, and is additionally restricted to an allow-listed set of network addresses. Both checks are enforced server-side; neither can be bypassed by the browser.
• Privileged actions are logged — who did what, when, and what the value was before the change — and a support view of a customer's account is recorded as one of them.
• Support staff never learn your password. Passwords are set and stored by our authentication provider in hashed form; we cannot read them, and neither can anyone here.

The providers behind the service

We share your information only with providers who process it on our instructions, under contract, and only as needed to run the service. We do not sell personal information and we do not share it for advertising. We run no advertising, analytics or tracking pixels on this site.

Customer data is processed in the United States. A full account of what each provider receives, and why, is in our Privacy Policy.

Keeping data only as long as it is needed

You can delete a card, a statement or your entire account yourself, at any time, without asking us — and the underlying data goes with it. We retain afterwards only what the law requires, principally billing records and proof of consent. The full schedule is in Section 10 of the Privacy Policy.

How the service is built

Every database change ships as a reviewed, version-controlled migration; nothing is hand-edited in production. Server functions are deployed from source in the repository. Customer-supplied text — merchant names on an imported transaction, for instance — is rendered as text and never as markup, so a crafted merchant description cannot execute in anyone's browser. Access to the source repository and to each provider console requires multi-factor authentication.

Certifications, stated plainly

MaxMyPoints is an independent company, and we do not hold a SOC 2 or ISO 27001 certification of our own. We would rather say that than imply otherwise. The infrastructure we build on is independently audited — Supabase, Vercel, Plaid and Stripe each maintain SOC 2 Type II attestations, and Stripe is certified to PCI DSS Level 1 — and the controls described on this page are the ones actually implemented in the product.

Reporting a vulnerability

If you believe you have found a security problem, please tell us at support@maxmypoints.app. We aim to acknowledge a report within three business days and to keep you updated until it is resolved.

If a breach affects your personal information, we will notify you and the relevant regulators as the law requires. Our broader commitment on what happens when the software gets something wrong is in the Privacy Policy.