Security Architecture & Account Safety

Last Updated: August 10, 2026 • Enterprise-Grade Protection Standard

At MyFinanceSheet, protecting your trading data, broker connection tokens, trade history, and personal privacy is our highest priority. We employ defense-in-depth security principles, AES-256 military-grade encryption, and zero-trust authentication protocols across every layer of our platform.

1. Browser DevTools & Self-XSS Protection

STOP! Beware of Self-XSS Scams

Opening your browser's Developer Tools Console (F12 or Ctrl+Shift+I) exposes an execution environment intended strictly for software developers. If someone tells you to copy and paste JavaScript code into your browser console to "unlock PRO features", "bypass paywalls", or "view hidden trade data", it is a malicious SCAM designed to steal your authentication session token and hijack your MyFinanceSheet account.

How Self-XSS (Self Cross-Site Scripting) Attacks Work:

  • Scammers create fake video tutorials or social media posts promising free upgrades or automated trade scripts.
  • They ask victims to open the browser console and paste a script snippet.
  • Once executed, the script reads your session tokens from memory and silently transmits them to an attacker's remote server.

Our Defense System: MyFinanceSheet embeds automatic console monitoring (`logger.js`) that detects when DevTools are opened and outputs clear red warnings. Furthermore, session tokens are protected via HTTPS-only cookies, Web Crypto Nonce verification, and strict Content Security Policy (CSP) directives preventing unauthorized script execution.

2. Data Encryption & Database Security

Your trading ledgers, execution statistics, and account settings are safeguarded using industry-leading cryptographic standards:

AES-256-GCM Encryption

Sensitive user credentials, custom API tokens, and broker secrets are encrypted at rest using AES-256-GCM with unique initialization vectors.

TLS 1.3 Transits

All network communications between your browser, Vercel Edge CDN nodes, and database servers are enforced over TLS 1.3 with HSTS headers.

Row-Level Security (RLS)

Our Supabase PostgreSQL database enforces strict tenant isolation using Row-Level Security policies. Users can strictly query their own user ID rows.

Zero Plaintext Passwords

Passwords are hashed using argon2/bcrypt algorithms. MyFinanceSheet staff and system administrators can never read your account password.

3. Broker Connection & Read-Only Trade Sync

MyFinanceSheet integrates with India's leading stockbrokers (Zerodha, Dhan, Fyers, Angel One, Upstox, 5Paisa, ICICI Direct) using official OAuth 2.0 and API gateway protocols:

  • Read-Only Journal Ledger Access: Broker connections are strictly restricted to reading completed order books and trade executions. MyFinanceSheet never requests or holds withdrawal, fund transfer, or order placement credentials.
  • No Trading Credentials Stored: You authenticate directly on your broker's official login portal. MyFinanceSheet only receives temporary OAuth session tokens.
  • Client-Side Local Processing: Automated CSV parsing and ledger normalization run locally in your browser sandbox.

4. Device Session Limits & Idle App Locks

To prevent unauthorized access on shared or public computers:

  • Tiered Device Session Limits: Free & Lite plans limit active concurrent device sessions (1 to 2 sessions max). Subsequent logins automatically terminate older active session tokens.
  • PIN & Password App Lock: You can configure an automatic screen lock in Settings, requiring a 4-digit PIN or password after configurable minutes of inactivity.
  • Instant Token Revocation: Clicking Log Out instantly invalidates your session token across all connected CDN servers.

5. DPDP Act 2023 & GDPR Compliance

MyFinanceSheet strictly complies with India's Digital Personal Data Protection (DPDP) Act 2023 and European GDPR standards:

  • Decoupled Account Deletion: If you request account deletion, your personal profile (`email`, `username`, `phone`, `password`) is permanently purged.
  • Tax Audit Ledger Retention: In compliance with CGST Act 2017 Section 36 and Income Tax rules, sales invoice snapshots are retained for 72 months (6 years) with `user_id` set to `NULL` to decouple personal identifiers.
  • Anonymized Deletions Audit Log: Usage totals are transferred to `[Deleted User - Historical]` for transparent operational accounting.

6. Vulnerability Disclosure & White-Hat Reporting

We welcome security researchers and ethical hackers to disclose potential vulnerabilities responsibly. If you discover a security issue or bug on MyFinanceSheet:

  • Please report it immediately via email to [email protected].
  • Include detailed steps, request payloads, or proof-of-concept scripts to reproduce the issue.
  • Allow reasonable time for our engineering team to patch the issue before public disclosure.