Tresi · security

Security

Last updated 8 August 2026

Tresi holds a connection to your bank, so this page describes what protects it, in enough detail to be checkable rather than reassuring.

Your bank credentials

We never see them. Linking a bank happens on Plaid's own hosted page, opened in your system browser rather than inside the app, so your username and password go from you to Plaid without passing through Tresi at any point. There is no field in our app that accepts them and no code path that could store them.

Bank access tokens

What we do hold is a Plaid access token per connected institution, which lets us read transactions. Each one is envelope encrypted at rest: a unique key encrypts that connection's token, and that key is itself encrypted under a master key held outside the database. A stolen copy of the database, on its own, does not yield a usable token.

Your transaction data

• Encrypted in transit with TLS, everywhere, with HSTS enforced.
• Encrypted at rest at the storage layer.
• The database is not reachable from the public internet. Only the application can talk to it.

Receipt photographs

They never leave your device. The photo is read on the hardware that took it, and only the fields you confirm are uploaded: merchant, total, tax, date, line items, and a content hash used to spot duplicates. There is no photo storage on our side, so there is no bucket of other people's receipts to leak, and the hash cannot be reversed into an image.

No third party AI

No transaction of yours is ever sent to an external AI or LLM provider. Categorisation is a local cascade of your own rules, your own past corrections, cross user consensus that requires at least five unrelated users to independently agree before it says anything, Plaid's own classification, and a small model we host ourselves. If that ever changes, it will be self hosted and disclosed here before it ships.

Signing in

Sign in is a one time code emailed to you. There is no password, so there is no password of yours for us to store badly, and nothing to reuse against you on another site if we were breached. You can see every signed in device and sign any one of them out individually.

Messages from Plaid

Every webhook Plaid sends us is verified before we act on it: the signature is checked against Plaid's published keys, the timestamp must be recent, and the hash of the body must match the one in the signed claim. Anything that fails is rejected rather than processed.

This website

These pages run no JavaScript at all and load nothing from any other host. No fonts, no analytics, no tag manager, no trackers. That is enforced by a content security policy rather than left to good intentions.

Reporting a vulnerability

Please report it privately to rortiz@tresi.app before disclosing it anywhere else. In return:

• We will acknowledge your report within three business days.
• We will tell you our assessment and our intended fix, and keep you updated until it ships.
• We will credit you if you want the credit, and stay quiet about you if you do not.
• We will not pursue legal action over good faith research that avoids other people's data, avoids degrading the service, and gives us a reasonable chance to fix the problem first.

There is no paid bug bounty. Tresi is one person, and pretending otherwise would waste your time.

If something does go wrong

No system is perfectly secure. If there is ever a breach affecting your data, we will tell you and the relevant authorities as required by law, and the notice will say what actually happened rather than that your privacy is important to us.