Security

1. Overview

At ShowMyXpense, we take the security of your financial data seriously. This page describes the measures we implement to protect your information and the practices we follow to maintain a secure environment.

2. Authentication & Access Control

• Accounts are protected with email and password authentication, with optional Google OAuth sign-in.
• Password reset and email verification flows are managed by the Base44 platform's authentication system.
• Each user can only access their own data. Your financial records are isolated and not visible to other users.
• Administrative access to user accounts is restricted to authorized platform administrators.

3. Data Encryption

• In transit: All communication between your browser and our servers is encrypted using HTTPS/TLS.
• At rest: Data stored in the database is managed by the Base44 platform, which provides encryption at rest for stored data.

4. Infrastructure

ShowMyXpense is hosted on the Base44 platform, which provides managed infrastructure including database hosting, authentication, file storage, and API services. Base44 handles infrastructure security, including patching, monitoring, and access controls.

5. AI Provider Security

We use reputable AI providers to power intelligent features:

• Anthropic (Claude): Used for PDF bank statement extraction. Anthropic maintains enterprise-grade security practices. See Anthropic's Security.
• Google (Gemini): Used for exchange rate queries. Google processes only the currency query, not your financial transaction data.

Data sent to AI providers is limited to what is necessary to perform the requested feature.

6. File Handling

Uploaded PDFs are transmitted over encrypted connections and stored in Base44's secure file storage during processing. The file URL is not persisted in our application database. File references are cleared from your browser session after extraction completes.

7. Incident Response

If we become aware of a security breach affecting your data, we will take steps to investigate, mitigate, and notify affected users in accordance with applicable laws. If you believe your account has been compromised, please contact us immediately.

8. User Responsibilities

• Use a strong, unique password for your account.
• Do not share your login credentials with anyone.
• Log out of shared or public computers after use.
• Review imported transactions for accuracy, as AI extraction may occasionally produce errors.

9. Contact

If you have security questions or wish to report a vulnerability, please contact us at support@savyre.com.