​

Security

​

Data Protection

​

Encryption at Rest

• Algorithm: AES-256-CBC
• Key Storage: Environment variables (never committed to code)
• Unique IV per encryption
• Tokens encrypted before database storage
• Decrypted only when needed for API calls

• Algorithm: SHA-256 hashing (one-way)
• Cannot be reversed or retrieved
• Stored as hashes only
• Validated by re-hashing incoming tokens

​

Encryption in Transit

• TLS 1.2+ for all connections
• HTTPS only - no unencrypted HTTP
• Certificate validation enforced
• Perfect Forward Secrecy (PFS) enabled

​

What We Store

​

✅ Data We Store

​

❌ Data We NEVER Store

• ❌ Account balances
• ❌ Transaction details
• ❌ Banking credentials
• ❌ Account numbers
• ❌ Routing numbers
• ❌ SSN or Tax IDs
• ❌ Unencrypted tokens

​

Plaid Partnership

​

Bank-Level Security

• SOC 2 Type II certified infrastructure
• 256-bit encryption for data transmission
• Multi-factor authentication support
• OAuth-based bank authentication
• Read-only access to financial data

​

How Plaid Works

You → Plaid (enter bank credentials) → Your Bank
       ↓
    Plaid issues access token
       ↓
    Haptic stores encrypted token
       ↓
    Uses token to fetch data when needed

• Haptic never sees your bank username/password
• Plaid connects directly to your bank
• Access tokens are read-only (cannot move money)
• Tokens can be revoked anytime via Plaid or your bank

​

Authentication Security

​

OAuth 2.0 (Claude Desktop, ChatGPT)

• No manual token copying
• Short-lived authorization codes
• Automatic token rotation
• Scoped permissions
• User consent required

1. AI requests authorization
2. User redirects to Haptic
3. User signs in via Clerk
4. User authorizes specific permissions
5. Haptic issues code
6. AI exchanges code for access

​

Manual Tokens (Custom AI)

• Prefixed with hap_ for easy identification
• 256-bit randomness (crypto.randomBytes)
• Hashed with SHA-256 before storage
• Per-user token isolation
• Revocable from dashboard

​

Infrastructure Security

​

Database (Supabase)

• PostgreSQL with row-level security (RLS)
• Encrypted at rest with AES-256
• Automatic backups with point-in-time recovery
• Network isolation with VPC
• Access control via service role keys only

​

Hosting (Railway)

• SOC 2 Type II compliance
• Auto-scaling infrastructure
• DDoS protection
• Private networking
• Secrets management via environment variables

​

Application

• Express.js with security middleware
• CORS restricted to haptic.sh domains
• Helmet.js for HTTP headers
• Rate limiting (future)
• Request validation on all endpoints

​

Access Control

​

User Isolation

// All queries filter by user_id
const { data } = await supabase
  .from('plaid_accounts')
  .select('*')
  .eq('user_id', clerkId);

​

Subscription Gating

• Checked on every request
• Validated via Polar API
• No access without payment

​

Admin Access

• X-Internal-Secret header (64-char random secret)
• Only accessible from Haptic website backend
• Never exposed to public internet
• Separate authentication from user tokens

​

Compliance & Certifications

​

Current Status

• HTTPS/TLS: ✅ Enforced
• Data Encryption: ✅ AES-256-CBC + SHA-256
• Access Controls: ✅ User isolation + RBAC
• Audit Logging: ⚠️ Partial (MCP requests logged)
• GDPR Compliance: ⚠️ In progress
• SOC 2: ❌ Not yet (infrastructure partners are certified)

​

Third-Party Security

​

Vulnerability Reporting

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Your contact information (for follow-up)

• Acknowledge within 48 hours
• Provide status updates every 7 days
• Credit you in our security advisories (if desired)
• Not pursue legal action for good-faith reports

​

Security Roadmap

• Rate limiting per user and IP
• Audit logging for all MCP requests
• 2FA support for Haptic accounts
• Token expiration with automatic rotation
• IP allowlisting for enterprise users
• SOC 2 Type II certification
• Penetration testing by third-party firm

​

FAQs

​

Next Steps