Encryption
- In transit: every connection uses TLS (HTTPS). The site sends HTTP Strict Transport Security, so browsers refuse to connect over plain HTTP.
- At rest: your data is stored in Supabase (PostgreSQL), which encrypts data at rest with AES-256.
- Integration credentials: access tokens for connected services are envelope-encrypted before they are stored — each credential has its own AES-256-GCM data key, which is itself encrypted with a separate key-encryption key. If that key is not configured, we refuse to store credentials rather than keep them in plain text.
Tenant isolation and access
- User and business data is protected by PostgreSQL row-level security (RLS): the database itself only returns rows that belong to your account or to an organisation you are a member of.
- Business ledgers are authorised on the server for every request from your organisation role; read-only roles cannot post, close a period or approve.
- Personal and Business workspaces are kept separate. Business figures are never mixed into personal cash flow.
- Statement and portfolio imports are read-only. Capitallytics cannot move money or execute trades on your accounts.
Account security
- Two-factor authentication with an authenticator app (TOTP) — turn it on in Profile → Security.
- Sign out of all other devices at any time from the same page.
- Session cookies are Secure and SameSite=Lax; state-changing API requests from other websites are rejected.
- A Content-Security-Policy limits which scripts can run on the site, and third-party analytics never load on signed-in finance pages.
Hosting
The application runs on Vercel. The database, authentication and file storage run on Supabase, which is hosted on Amazon Web Services (AWS).
Sub-processors
Service providers that process personal data on our behalf:
| Provider | Purpose | Data involved |
|---|---|---|
| Vercel Inc. | Application hosting and content delivery | All requests to www.capitallytics.com pass through Vercel |
| Supabase Inc. (on AWS) | Database, authentication and file storage | Account, workspace and financial data you store in Capitallytics |
| Anthropic | Generates AI CFO answers (Claude) | Your question and the financial context needed to answer it, with personal identifiers removed |
| Razorpay | Subscription payments | Payment details are entered on Razorpay's checkout; we receive payment status, not card numbers |
| Optional Google sign-in; Google Analytics / Tag Manager on marketing pages only, after cookie consent | Name and email for Google sign-in; page-usage data only if you accept analytics cookies | |
| Resend | Transactional email (when enabled) | Your email address and the message content |
Market and reference data sources
Our servers fetch publicly available market data from these providers. They do not receive your personal or financial data — only requests for prices and rates. Market data from third-party sources may be delayed and is for information only; it is not an official or exchange feed.
- Frankfurter (European Central Bank reference rates) — Currency exchange rates
- Yahoo Finance — Stock, ETF and index quotes and market headlines
- CoinGecko — Cryptocurrency prices
- MFAPI.in — Indian mutual fund NAVs
Services you connect yourself (for example Stripe or Google Sheets in the Business workspace) receive only what you authorise in their own consent screen, and you can disconnect them at any time.
Your rights and grievance contact (DPDP Act, 2023)
Under India's Digital Personal Data Protection Act, 2023 you may ask to access, correct or erase your personal data, withdraw consent, and raise a grievance. Portfolio data can be exported as CSV from the app at any time; for anything else, contact us below.
Grievances and data-protection requests: teamcapitallytics@capitallytics.com. Please write from your registered email address so we can verify the request. See also our Privacy Policy.
Reporting a vulnerability
If you believe you have found a security issue, email teamcapitallytics@capitallytics.com with steps to reproduce. Please do not access other users' data or degrade the service while testing. Our security.txt follows RFC 9116.