Security at Coast
Coast exists to move one number — your cash position — to the people who need it. Protecting that number is our first engineering priority. Here is exactly how.
Read-only, credential-free
- Bank connections run through Plaid; you authenticate directly with your institution and your credentials never touch Coast.
- We retrieve account names, masked numbers, and balances only — no transactions.
- There is no code path that can initiate a payment or transfer. Read-only isn't a setting; it's the architecture.
Encryption everywhere
- TLS 1.2+ for all traffic in transit; encryption at rest for all stored data.
- Financial provider tokens (Plaid, Slack) get a second layer of application-level envelope encryption with rotatable keys.
- Session and device tokens are stored only as one-way hashes — a database leak cannot reconstruct a usable login.
Tenant isolation, enforced by the database
- Every customer's rows are guarded by PostgreSQL Row-Level Security — isolation is enforced in the database engine, not just in application code.
- The app connects as a least-privilege role that cannot bypass RLS; every boot verifies this and refuses to start otherwise.
- Cross-tenant admin reads go through narrow, audited database functions that never expose balances.
Strong authentication
- Passwordless magic-link sign-in — no password database to breach.
- TOTP two-factor authentication, with step-up required for sensitive areas and recovery codes for lockout.
- Sessions expire after 12 idle hours and 7 days absolute; trusted devices re-challenge on new devices or network changes.
Accountable operations
- Administrative access is tiered (support vs. super-admin) and every action lands in an append-only audit log.
- Support "view as customer" access is read-only, time-boxed to 30 minutes, visibly bannered, and logged with the operator's identity.
- Strict security headers and CSP, request rate limiting, and CSRF protection on every mutation.
Your data, your exit
- Cancel or delete anytime: production data is permanently deleted within 30 days; encrypted backups age out on a fixed schedule.
- Disconnecting a bank revokes its token at Plaid immediately.
- We never sell your data and never use financial data for advertising. Sub-processor list: Privacy Policy · processor terms: DPA.
Infrastructure & development practices
Coast runs on SOC 2 Type II–attested infrastructure (Supabase for data and authentication, Render for compute); payments are handled by Stripe, so card numbers never touch our systems. Changes to sensitive code paths receive adversarial security review before release, dependencies are scanned for known vulnerabilities in CI, and secrets live in the host platform's secret store — never in code.
Report a vulnerability
We welcome good-faith security research. Report suspected vulnerabilities to support@coastflow.io and we'll acknowledge within 2 business days. Please avoid accessing other customers' data; we won't pursue good-faith researchers who follow that rule.