Security you can verify, not just trust

A credential we never collect is a credential that cannot leak, cannot be phished, and cannot be sold. There is simply nothing there to steal.

1. 1. People you invite.Family members see only what your permission grid allows — 15 features × create, read, update, and delete.
2. 2. Us. A small team can access account data for support and abuse prevention; admin access to accounts is logged. AI chats are stored with your account and reviewable by us to keep Piggy accurate.
3. 3. Service providers. The eight vendors listed below, each with a named purpose. Nobody else.

We never sell data — to anyone.

That rule lives one layer below the application — a backstop, not a slogan, and the same backstop the self-serve export runs through.

Encrypted in transit: TLS everywhere, HSTS enforced. Encrypted at rest: by our infrastructure providers (Supabase-managed Postgres, Vercel) — the industry baseline, not bank-level encryption.

A Permissions-Policy response header sets camera=(), microphone=(), geolocation=() — an empty allow-list, which means “no one, not even us.” You can read it in your browser’s developer tools under the Network tab.

There are no push notifications — we’ll never ping you — and no advertising SDKs anywhere on the site.

Supabase

Database and sign-in

Vercel

Hosting and bot protection

Stripe

Billing and payments

Anthropic

AI answers for Pro users, and paystub scanning on every plan

Mailgun

Transactional email — verification, receipts, invites

Google Analytics

Site analytics. Ad-personalization signals are disabled, and choosing Decline in the cookie banner turns analytics off.

Axiom

Server logs, to debug and catch failures

Google reCAPTCHA

Spam protection on the contact form

Nobody else — and we don’t sell your data to any of them, or to anyone.

Piggy runs on Anthropic’s Claude. When you ask a question, the relevant figures from your account — or, if you scan a paystub (available on every plan), that image, which is read once and never stored — are sent to Anthropic’s API to generate the reply. Anthropic’s commercial API terms prohibit training their models on this data.

You can turn the AI assistant off entirely in Settings. Your chats are stored with your account and are reviewable by our team so we can keep Piggy accurate. Piggy can answer questions and file a support ticket for you, but it can’t change your financial data.

The account owner can permanently delete the entire account — every financial record, every member login — from Settings with a typed confirmation. No support ticket, no exit interview. Two honest footnotes: only the owner can do this (spouses and children can’t nuke the household), and billing identifiers are retained about 7 years because tax law requires it.

You can also take your data with you. Settings → Your Data has a self-serve export that downloads everything your family has entered as a .zip. It’s available on the Free plan, for the owner or spouse; child accounts are blocked. Here is the entire archive:

How to reach us. Send the report through our contact form and start the subject with “Security.” We don’t run a security@ mailbox yet, so the contact form is the fastest path to the right person. Our machine-readable security.txt (the RFC 9116 contact file) points here too.

What to include.The affected URL or feature, the steps to reproduce it, and what you were able to access or change. A short proof-of-concept helps us confirm it fast. Please don’t access, modify, or delete another person’s data — use your own test account, and stop as soon as you’ve confirmed the issue.

What we’ll do.We aim to acknowledge your report within three business days and to keep you updated as we investigate and fix it. We’re a small US team, so we can’t promise a payout, but we’re glad to credit you once a fix ships if you’d like the mention.

Our commitment to you. If you report in good faith, follow this page, and give us reasonable time to fix the issue before disclosing it, we will not pursue or support legal action against you for your research. Denial-of-service, spam, social-engineering of our team or users, and physical attacks are out of scope.

Neither was hired and neither was asked — they’re security people who couldn’t sign up for a finance app without testing it first. Both went straight at the thing that actually protects your data: the database-level access rules (row-level security). Across roughly two dozen tables and paired two-account tests, the reviews found no way to read or write another account’s financial data. Both also confirmed that the only Supabase key in our browser code is the public “anon” key — the correct setup, with no privileged key exposed.

Two medium-severity issues were found — both in our application logic, not the data boundary — and both fixed on 24 July 2026:

1. 1. Signing up didn’t prove you owned the email you used. In the worst case that could let someone accept a family-sharing invite meant for an address they didn’t control. Fixed: accepting a family invite now requires the secret token from the invitation email and a confirmed email address, so only the real recipient can accept.
2. 2. A referral-partner earnings field was writable from the browser. A signed-in user could set their own earnings balance directly. Fixed: that write path is gone — those fields can only be set by our server, enforced by the database rather than trusted from the browser.

To be straight about what this is: two informal peer reviews at a point in time, not a formal certification — which is the same reason this page shows you mechanisms instead of a badge. We’re sharing them because the review was unprompted, and because we fixed both issues within a day of hearing about them.

Two-factor authentication: available now in Settings → Security, free on every plan. It’s authenticator-app codes (TOTP) with one-time backup codes, not text-message codes, because SIM-swap attacks make SMS weak. You can also review your recent sign-in activity — when, roughly where, and how each sign-in happened. And if you sign in with Google or Apple, your sign-in also inherits that provider’s two-factor protection.

Passkeys:you can also sign in without a password at all. Add one from Settings → Security, then sign in with Touch ID, Windows Hello, or a security key — no password typed, no code to enter. A passkey works side by side with your password, so adding one doesn’t take the password option away. And because a passkey already proves who you are and that you hold the device, signing in with one skips the two-factor code step.

We also email you when something security-sensitive changes on your account — a sign-in from an unfamiliar device or location, a password change, or a change to your two-factor setup. And changing your password automatically signs out every other session, so a stolen session can’t outlive the password it stole.

Whichever way you sign in, password sign-up is rate-limited — five tries per fifteen minutes, per IP address — and disposable-email domains are blocked.

One more honest note: we don’t wave around a SOC 2 or ISO badge. We’re a small US team, and instead of a logo this page shows you the actual mechanisms and the settings you can check.

• Open your browser’s developer tools, go to the Network tab, reload, and read the response headers. You’ll see Strict-Transport-Security (HSTS) and Permissions-Policy: camera=(), microphone=(), geolocation=().
• Read our vulnerability-disclosure policy above, or fetch the machine-readable /.well-known/security.txt (RFC 9116) that points to it.
• Inside the app: run the self-serve export from Settings, or walk right up to the delete-account flow — it asks you to type a confirmation before anything happens.
• Also inside the app: open Settings → Security, switch on two-factor authentication, save your backup codes, add a passkey, and read your recent sign-ins under Login History.