How we protect your financial data
Connections to Stewardfi use HTTPS with TLS 1.2 or 1.3 — older versions are refused. Our database provider, Supabase, encrypts stored data with AES-256.
We connect to your accounts through Plaid with read-only access to balances and transactions. We can never move your money or initiate transactions.
You enter your bank username and password with Plaid, not with us. We never see or store them.
The tokens that let us read your accounts are encrypted in Supabase Vault. Our database keeps only a reference to each one.
Database access rules (PostgreSQL row-level security) let each client reach only their own household's data. Your CPA can see your data — that is the service.
The Stewardfi admin account — the one your CPA uses to reach client data — requires a code from an authenticator app at every sign-in. Two-step sign-in for client accounts is coming.
Error reports never include session recordings, IP addresses, or cookies, and credentials in them are masked. We do not write balances, transaction details, passwords, or access tokens to our logs.
CPA-Delivered statements are a consulting engagement under AICPA CS Section 100. They are not audited, reviewed, or compiled, and no assurance is provided on them. Our CPA maintains continuing professional education requirements.
Hosted on Vercel and Supabase, both with SOC 2 Type II reports. Payments by Stripe (PCI DSS Level 1). Bank connections by Plaid (SOC 2 Type II report). Every provider that handles client data is listed in our Privacy Policy.
How we collect, share, keep, and delete your information is in our Privacy Policy. Questions about our security practices? Contact us at security@stewardfi.ai.
© 2026 Stewardfi LLC. All rights reserved.