Security at Owdyn

Encryption in transit

All communication between your browser and Owdyn uses HTTPS with TLS 1.2+ encryption. This protects your data as it travels across the internet.

Encryption at rest

Your data is stored in a PostgreSQL database. Our database provider (Neon) implements AES-256 disk-level encryption at rest to protect stored data from unauthorized access.

Application-layer encryption

For the most sensitive fields, we go further — encrypting data within Owdyn itself using AES-256-GCM authenticated encryption before it is written to the database. This means even at the database layer, the values are unreadable without Owdyn's encryption key.

Fields protected by application-layer encryption:

• Two-factor authentication (2FA) secrets — the TOTP seed used to verify your authenticator app codes
• Bank OAuth access tokens — the credentials used to connect to your bank via Akahu (Plus and Wise)

Each encrypted value uses a fresh random IV (initialization vector) and includes a GCM authentication tag, which means any tampering is detected automatically.

How you sign in

• Email & Password: Your password is hashed using bcrypt (not stored in plain text)
• Google OAuth: Sign in with your Google account (we never see your Google password)
• Two-Factor Authentication (2FA): Optional extra security layer you can enable in Settings

Session management

• Secure session tokens with 24-hour expiration
• Trusted device management (30 days) to reduce 2FA prompts on your regular devices
• Manual logout available at any time
• Session invalidation on logout

Rate limiting

Authentication endpoints are rate-limited to protect your account from brute-force attacks. Excessive failed login or 2FA attempts are automatically blocked for a cooldown period. Rate limits are enforced via Upstash Redis and apply globally across all devices and IPs.

Where your data lives

Owdyn is hosted on Vercel with database on Neon (PostgreSQL). Your data is stored in the AWS Sydney region (Australia).

Data isolation

All database queries are filtered by your user ID. This means you can only access your own accounts, transactions, and budgets—never another user's data. Data isolation is enforced at the application level.

SQL injection protection

We use Prisma ORM which uses parameterized queries to prevent SQL injection attacks. This protects against malicious database queries.

Credential management

Database credentials and API keys are stored as environment variables (not in code). When deployed to Vercel, these are encrypted and secured by the hosting platform.

If a breach occurs

In the unlikely event of a security breach affecting your data, we will:

• Investigate immediately to determine the scope and impact
• Notify you as soon as reasonably practicable (as required by the NZ Privacy Act 2020) — we target within 72 hours where possible
• Explain what happened: What data was affected, how it occurred, and what we're doing to fix it
• Provide guidance on steps you should take to protect yourself
• Report to the NZ Privacy Commissioner if the breach is likely to cause serious harm, as required by Part 6 of the Privacy Act 2020

If our AI provider has a breach

If Anthropic notifies us of a security breach affecting transaction data you submitted:

• We'll notify you as soon as possible after we are made aware and have assessed the impact
• We'll explain what transaction data may have been affected
• We'll provide guidance on next steps