Security

Security is the foundation of Mr. Fino. We hold sensitive financial details about you, and we treat that responsibility seriously. This page summarises the controls in place today and where we're headed next.

Every connection between your browser, our servers and our database is encrypted with TLS 1.2+. The site is served exclusively over HTTPS; plain HTTP requests are upgraded automatically.

Account and assessment data lives in MongoDB Atlas with encryption at rest enabled at the storage layer. Backups inherit the same encryption.

We never store your password in plain text. Passwords are hashed with bcrypt using a cost factor of 12, which makes offline brute-force attacks impractical. Even our own engineers cannot read your password.

Web authentication is handled by NextAuth using signed JSON Web Tokens delivered as HttpOnly, Secure cookies. The token is invisible to client-side JavaScript, which mitigates the impact of any XSS bug. The mobile app authenticates with signed bearer tokens kept in the device's secure enclave storage (Keychain on iOS, Keystore on Android) and revoked on sign-out — which also de-registers the device's push-notification token. Password reset works via single-use, time-limited email links or a WhatsApp one-time passcode to your verified number.

Every API endpoint validates the request body against a strict Zod schema before any business logic runs. Dynamic route parameters that reference database records are validated as Mongo ObjectIds to prevent injection attacks.

Paid-plan payments are processed end-to-end by Razorpay, a PCI-DSS-compliant payment processor. Card, UPI and banking credentials go directly from your device to Razorpay and never transit or rest on our servers — we store only the payment reference, amount and status needed to activate your plan and issue an invoice.

Every authenticated request scopes its database queries to the signed-in user's ID. Administrative tooling runs as a separate, access-controlled application on its own domain — the product surface exposes no admin endpoints — and direct database access is restricted to a small on-call rotation.

You can delete your assessments, personal details, or your entire account from /my/settings at any time — the Danger Zone at the bottom of that page (and of the app’s Settings screen) does it without going through support. Account deletion is confirmed with a one-time code sent to your registered email, then runs immediately and cannot be undone. It removes data from primary storage at once; encrypted backups are rotated out within 30 days. Paid invoices are retained for tax purposes with your account reference stripped, and we keep a single name/email/phone record of the deletion itself so we can evidence that it happened.

Found a vulnerability? Please report it to security@mrfino.com before disclosing publicly. Include reproduction steps and any proof-of-concept code.

We aim to acknowledge reports within 48 hours and resolve verified critical issues within 14 days. We won't pursue legal action against good-faith researchers who follow this process.

• Two-factor authentication for all accounts.
• Annual third-party penetration test.
• Public security.txt and bug-bounty programme.

Security questions, audit requests or vendor questionnaires? Reach out — we're happy to help.