Skip to content
Money OSBeta
Back to Support Center

Security & Data Protection

How we isolate, encrypt, and audit your financial records.

Database Tenant Isolation

Every database query strictly scopes results by verified tenant identifier. All financial transactions, accounts, and project records are logically partitioned, completely eliminating multi-tenant cross-talk.

Production Identity & Clerk Auth

Authentication is powered by Clerk with verified session tokens, Just-In-Time MongoDB identity bridging, and custom-branded embedded flows that protect user credentials at the edge proxy.

RBAC & Workforce Hierarchy

Granular role authorization with Workspace Admin and Member assignments, privilege escalation defenses, last-admin protection, and support for billable-only contractors without portal seats.

AES-256-GCM Credential Vault

Tenant-stored payment secrets (e.g. Razorpay keys) are encrypted at rest with AES-256-GCM via a dedicated master key. Webhooks verify HMAC-SHA256 signatures with strict idempotency guards.

Security Best Practices

Enforce strong passphrases and multi-factor authentication

Configure multi-factor authentication (MFA) on your Clerk user account and enforce strong passphrases for all workspace members.

Apply the principle of least privilege

Reserve the Workspace Admin role for organization owners. Assign contributors standard Member access, and track external consultants as billable-only resources.

Inspect immutable audit logs

Regularly audit workspace operations in the Audit Center to monitor role changes, expense approvals, ledger edits, and data exports.

Compliance & Integrity Standards

Money OS is built from the ground up to align with modern security and financial compliance frameworks:

  • Double-Entry & Derived Balance Integrity: Balances are derived dynamically from verified ledger credits and debits to prevent accounting drift.
  • Account Referential Integrity: Strict guards prevent orphaning ledger transactions or deleting active accounts.
  • Fail-Closed Production Security: The application refuses to boot in production without verified database URIs, signing secrets, and admin hashes.

Security FAQ & Reporting

How do I report a security vulnerability?

If you detect a security issue or vulnerability, email platform operations directly at support@moneyos.tech. We review and deploy hotfixes within 24 hours.

Does Money OS store raw bank login credentials?

No. Money OS never requests or stores bank online-banking credentials. Ledger entries are recorded manually, populated via approved expenses/invoices, or reconciled via verified payment gateway webhooks.