Security & Vulnerability Disclosure
How CaliMoney protects your account and how to report a security vulnerability
How your data is protected
- In transit: every connection to CaliMoney and to Firebase uses HTTPS (TLS).
- At rest: data is stored in Google Cloud Firestore in the EU (
europe-west8), encrypted at rest by Google. With end-to-end encryption turned on, the details of your movements are also encrypted on your device with a key only you hold. - Access control: Firestore security rules let each account read and write only its own documents. Server-only records (rate limits, recovery tokens, notification logs, feedback) cannot be read by any client.
- Account protection: optional two-factor authentication (TOTP), rate limits on sensitive endpoints, and automatic lock after 15 minutes of inactivity when encryption is on. Optional biometric unlock keeps the key sealed on the device under a passkey that needs your face, fingerprint or PIN.
- AI features: requests to AI providers use zero data retention — prompts and outputs are not stored and not used for training.
- Updates: CaliMoney is a web app. Security fixes reach every user on the next page load, with nothing to install; dependencies are audited automatically on every change.
Reporting a vulnerability
If you believe you have found a security vulnerability, please email support@calimoney.it with the subject "Security" and include:
- a description of the issue and its impact,
- the steps to reproduce it (URLs, requests, screenshots),
- whether you believe it is being actively exploited.
What to expect:
- an acknowledgement within 5 business days;
- updates while we investigate and fix;
- credit in the fix announcement if you want it.
Please test only with your own account, do not access or modify other users' data, avoid degrading the service, and give us reasonable time to fix the issue before disclosing it publicly. We will not pursue good-faith research that follows these rules.
The machine-readable contact file is published at /.well-known/security.txt.
If something goes wrong
If a personal data breach is likely to put your rights at risk, we will notify the Italian Data Protection Authority (Garante) within 72 hours and inform affected users without undue delay, as required by the GDPR (Articles 33–34).