Bank connections
Contamos connects to financial institutions through Plaid. When you link a bank, you sign in on Plaid's screen, and your credentials go to Plaid and your bank, not to us. Plaid gives our servers an access credential for that connection, which is stored server-side and used only by our backend functions to import accounts and transactions. It's never sent to the App or to other household members.
The access is read-only: Contamos can't move money, make payments or change anything at your bank. Disconnecting an institution revokes the connection at Plaid and deletes our credential for it.
Who can reach your data
- Row-level security on every table. Our database enforces access rules on each request, so a signed-in person can only read or change data in households they belong to, within the limits of their role.
- Sensitive actions run on the server. Changing household membership, roles and bank connections happens in server functions that check who's asking before they act.
- Least privilege for our team. Production access is limited to the people who need it to run the Service, and administrative keys never ship in the App.
- Card photos stay on your iPhone. A card photo can show the full number, so the App keeps it on your device and never uploads it.
Encryption
All traffic between the App, the Site and our servers uses TLS (HTTPS). Our database and file storage are encrypted at rest by our cloud provider using AES-256. The Site is served only over HTTPS with HTTP Strict Transport Security.
On your iPhone
The App doesn't include advertising, attribution or third-party analytics libraries, and it doesn't track you across other companies' apps and websites. Card photos you add stay on the device.
This website
getcontamos.com is a static site with no accounts, cookies, analytics or third-party scripts. It's served with a strict Content Security Policy that only allows its own files, along with headers that block framing, MIME sniffing and unneeded browser features.
How we work
Contamos is in active development, and we treat security as ongoing work rather than a finished checklist. Changes to database access rules are written as reviewed migrations and tested against attack scenarios before they're applied to production. We keep dependencies current and monitor our providers' security advisories. If an incident affects your personal information, we'll notify you and regulators as the law requires.
Responsible disclosure
If you believe you've found a security vulnerability in Contamos, please tell us at security@getcontamos.com. Include what you found, steps to reproduce it, and its potential impact. We'll acknowledge your report within three business days, keep you updated, and let you know when it's fixed.
Please
- test only against accounts and households you own or have explicit permission to use;
- stop and tell us as soon as you reach anyone else's data, and don't keep, share or change it;
- avoid privacy violations, service disruption and data destruction, and don't run denial-of-service, spam or social-engineering tests;
- don't test Plaid's or Apple's systems through Contamos (report those to them directly); and
- give us a reasonable time to fix the issue before disclosing it publicly.
Safe harbor
If you make a good-faith effort to follow this policy, we won't pursue legal action against you or ask law enforcement to investigate you for your research, and we'll consider it authorized under our Terms of Service. If a third party brings legal action over activity that followed this policy, we'll make it known that your actions were authorized.
We don't currently run a paid bug bounty, but we're grateful for every report and happy to credit you if you'd like.
Our security.txt lists the same contact details.