Security

Qualaby ("we," "our," or "us") handles real financial data, and we take the security of that data seriously. This page describes the technical measures that protect your information at https://app.qualaby.com. For details on what we collect and how we use it, see our Privacy Policy.

All data is encrypted in transit using TLS 1.2 or higher, and encrypted at rest using AES-256. This applies to your account information, linked financial account metadata, and transaction history.

Qualaby is built on infrastructure providers that maintain independent, audited certifications: • Supabase (database and authentication) is SOC 2 Type 2 compliant, assessed annually. • Vercel (hosting and deployment) holds SOC 2 Type 2, ISO/IEC 27001:2022, and PCI DSS v4.0 certifications. • Plaid (financial data connectivity) holds SOC 2 Type 2, ISO 27001, and ISO 27701 certifications. These certifications cover the infrastructure Qualaby runs on. See "Our Own Security Practices" below for what this does and doesn't mean about Qualaby itself.

When you link a financial institution, you connect through Plaid's secure Link interface, not through a form on our site. Qualaby never sees or stores your online banking username, password, or multi-factor codes — those are handled exclusively by Plaid. We store only the access token and account metadata Plaid returns, which we use solely to retrieve your transaction data on your behalf. You can revoke this access at any time, either from within Qualaby or directly at https://my.plaid.com.

Your financial data is protected by row-level security policies enforced at the database layer. Access is scoped to your account by the database itself, not just by application logic — another user cannot query or view your data without your explicit authorization.

Your data is stored on Supabase's managed database infrastructure, which includes automated backups as part of the underlying platform. Qualaby's application is deployed on Vercel's infrastructure, which is built for high availability.

The certifications listed above apply to our infrastructure providers — they are not a substitute for an independent audit of Qualaby itself, and we want to be upfront about that distinction. As a small, growing company, Qualaby has not yet completed its own third-party security audit. Building on certified, audited infrastructure is the foundation we start from, and pursuing our own audit is on our roadmap as we grow. If this matters to your decision to use Qualaby, we're glad to talk about it directly — see the contact information below.

If you believe you've found a security vulnerability in Qualaby, please contact us directly at support@qualaby.com rather than filing a public report. We'll respond as quickly as we can and keep you updated as we investigate.

We may update this page as our infrastructure or practices change. When we do, we'll update the "Last updated" date at the top.

For any security-related questions or concerns, contact us at: support@qualaby.com