Security & privacy at HomeAccounting
Trust is the product. Here is exactly how your money is handled — and how to verify it yourself.
Encrypted at rest
Bank credentials and tokens are encrypted at rest — never stored in plaintext.
Self-host = your server
Run it entirely on your own machine; your data never has to touch our servers.
Open source (AGPL)
The whole thing is auditable. Read the code, verify the claims, or fork it.
A real disclosure route
Private vulnerability reporting on every repository, a published security contact, and coordinated disclosure.
Responsible disclosure
Found a vulnerability? Report it privately — through GitHub’s private vulnerability reporting on any of our repositories, or by email to security@homeaccounting.com. We acknowledge within 3 business days and coordinate disclosure with you.
SECURITY.md & disclosure policy →