Trust begins with restraint.

Approved users may connect an institution through Plaid. Plaid access tokens stay server-side and encrypted; mobile clients receive only bounded display data and opaque references.

Ask uses a server-side AI service with bounded context and structured responses. API keys remain server-only, requests disable provider-side response storage, and model output cannot authorize a database write, invent canonical financial facts, or bypass explicit confirmation.

Covarify uses TLS/HTTPS in transit, owner-scoped authorization, encrypted session state, signed actions, and data minimization. Financial writes are re-resolved against current user-owned records and validated deterministically.

To report a security concern, contact security@covarify.com.