All data is encrypted in transit (TLS 1.2+) and at rest. Bank connections are made through regulated aggregators (Flinks, Plaid) — Index never sees or stores your bank credentials.

Production data is stored in AWS ca-central-1 (Montreal). Your books stay in Canada.

Every organization's data is isolated with database-level row security. Authentication is handled by Auth0 with support for strong passwords and session protection. Every change to your books is captured in an append-only audit trail.

Found a vulnerability? Email hello@indexlibro.ai and we'll respond quickly. We appreciate coordinated disclosure.