Security

Access

The XPENSES Team does not access or interact with customers’ data as part of normal operations. There are cases where a customer requests that XPENSES access their information, or where required by law. All data is access-controlled, accompanied by customer approval, and carries with it documentation surrounding the reason for access and the access start and end time. A XPENSES Team member’s violation of our customer data access policy will result in immediate dismissal.

(We do analyze anonymous, aggregate data for internal business purposes. See our privacy policy for details.)

Your XPENSES account password is one-way salted and hashed using multiple iterations of a key derivation function for passwords. (Those sound like made up words, but these are best practices!) Even if someone were to steal the XPENSES database of passwords, they would not know your password and would be forced to (very slowly!) guess every possible password in order to find it.

We prevent brute force password attacks (where an attacker attempts to guess the password for an account many times in a row). We also help you choose stronger passwords by 1) requiring that passwords be eight characters or longer, and 2) specifically preventing you from using the top 2,085 most commonly used passwords. (It’s quite an interesting list, should you choose to Google it.)

Your data is encrypted at rest when stored on our servers. That means that even IF someone could break in and steal the hard drives where your data is stored, they couldn’t read it. Also, should you (sadly) choose to delete your XPENSES account, all of your financial data is completely and irreversibly removed from the XPENSES database. We do not simply mark your account as inactive. We completely destroy all account data. (To be clear, you explicitly request this nuclear deletion. If you happen to let your account lapse accidentally, we don’t assume you mean DESTROY ALL MY DATA. That’d be a horrible assumption.)

Data Retention

We retain account data for a period of time after an account expires, whether through trial expiration or subscription expiration, unless you delete your account as described above.

Once an account has become inactive beyond the period of time described below, we will delete its budget data – if you don’t need XPENSES, we don’t need your account data, and you probably don’t want us to have it. (Keep in mind that if you cancel your account, it remains active until the end of your subscription. The timeline below doesn’t start until that subscription expires.)

We will delete accounts and their data:

  • For an expired trial, a minimum of one hundred-twenty (120) days after the expiration of the trial;
  • For an expired subscription, a minimum of three years after the expiration of the subscription.

PCI

PCI is an arduous security standard that companies must adhere to when processing credit cards. We use a PCI certified payment provider ( Stripe) to process our credit cards, and have engineered our payment forms in such a way that your payment details are sent directly to Stripe’s systems rather than ours, further increasing security.

Traffic

All data sent between your computer and XPENSES is bank-grade or better encryption. XPENSES forces your browser to use an encrypted connection and won’t let your computer talk to our servers unless that connection is secure.

Specifically around the traffic encryption, we use 128-bit encryption (AES_128_GCM). This provides an extremely high level of encryption, considered industry standard.

We take advantage of a new security feature in your browser called “ Content Security Policy” settings. This makes certain types of attacks against XPENSES impossible.

Social Engineering Security

This massive technical feat resulting in a moat of fire-breathing space dragons surrounding your data is useless if someone cons you into handing them your username and password.

  1. No XPENSES Team member will ever initiate communication with you and ask for your username or password. If someone asks you for either of those, it’s not us. Only provide your username and password when logging into XPENSES.
  2. XPENSES will always use https://app.xpenses.app as the domain name. Always look for this when logging into XPENSES, or following any link clicked from a bookmark or email.

Further reading

If you need to get our attention about anything else security related, please do so at security@xpenses.app. To learn more about how we protect your data from a legal standpoint, we spell all of that out in our privacy policy. For even lighter reading, take a look at our Terms of Service.