How your data is protected

The Poindex holds things people don't share lightly: bank transactions, debts, what they earn. This page says plainly how it is built to keep that private. It describes what exists today, not what we hope to build.

Your bank login never reaches us

Connecting a bank happens in a window run by Plaid, a company that connects apps to banks for thousands of financial products. You type your bank username and password there. Plaid gives The Poindex an access key that can read your accounts and transactions. It cannot move money.

That key is encrypted, and tied to you

Before the access key is stored, it is encrypted (AES-256-GCM). The encryption key is held in a separate secrets store, never in the database and never in our code. Each encrypted key is also bound to its owner and its record, so moving it to a different record, even inside the database, makes it unreadable.

You can only ever reach your own records

Most breaches in apps like this aren't someone breaking the sign-in. They're a signed-in person asking for a record number that isn't theirs, and the app forgetting to check. The Poindex is built so that forgetting is hard: every query goes through one piece of code that adds "and it belongs to this person" by itself, and the database refuses to link one person's record to another's.

It's tested on every change. A second test account asks for every record belonging to the first, through every door the app has, and must get the same "not found" it would get for a record that doesn't exist.

Your email: read, never written to

If you connect your mailbox, The Poindex reads the last day of your inbox each weekday morning to sort it and draft your replies. Google's permission screen is where you grant that, and disconnecting inside the app revokes it with Google straight away.

It reads. It does not write. Nothing is archived, labelled, changed or deleted in your mailbox, and no reply is sent until you press Send on a draft you have read.

What is stored afterwards is the part you see on the page: who wrote, the subject, when it arrived, the identifiers needed to reply in the same conversation, a one-sentence summary, and an excerpt of the message. The full text is held only for as long as it takes to work that out, and is then dropped. There is no copy of your mailbox.

The key that lets us read and send is encrypted the same way the bank key is: AES-256-GCM, the encryption key in a separate secrets store, and each encrypted key bound to its owner and its record so it is unreadable anywhere else.

Every change is written down

Each change to your data is recorded with who made it and when. The log can only be added to; the database refuses edits and deletions.

Sections can't see each other's data

Each section of The Poindex keeps its data in its own database, which only that section can open. Today, the page that brings your day together, asks each section for your items the same way you would, as you. It never opens another section's database.

Sign-in

You sign in with Google. The Poindex never sees your Google password. Your session is a random key in a secure cookie; only a one-way fingerprint of it is stored.

Reviewed before it opens to everyone

Two reviews stand between The Poindex and general use, and both come before launch rather than after it. An independent security professional reviews the whole system before anyone outside the founder's household can connect a bank. Reading Gmail is what Google calls a restricted permission, so it also requires Google's own app review and an annual security assessment by an assessor Google designates, carried out every year for as long as the feature exists.