Security and privacy
Your household is its own vault: isolation enforced by the database, encryption with your own key, two-factor on every sign-in and an audit trail.
Every record belongs to one household. The database itself refuses to show one household's rows to another, and every release is tested from a stranger's account before it goes live.
Documents, bank tokens and sign-in secrets are encrypted with a key unique to your household. Download links expire in minutes.
A password alone never opens your account. Every sign-in needs a second factor: an email or text code, an authenticator app, or a passkey (Face ID, Touch ID, Windows Hello or a security key). After 5 wrong passwords the account pauses for 15 minutes.
You're signed out after 15 minutes without activity. Settings › Sessions shows everywhere you're signed in; revoke anything you don't recognize.
Sign-ins, approvals, shares and changes are written to a hash-chained audit log that owners can check under Activity › Audit log.
Your chief of staff answers only from your own household's records and never moves money. This Help chat is separate: signed out, it knows only these help articles; signed in, it sees only your own account's plan and connection status.
Where to find it: Security architecture · Second factor · Sessions
Still stuck? Ask your chief of staff in the Help chat, or send us a message.