Security
Security built into every step.
The specific protections behind every NOVARA account.
Practices
How we protect your account
- PasskeysSign in with Face ID, Touch ID, Windows Hello, or a security key. Passkeys can't be phished or reused.
- Two-factor authenticationAdd an authenticator app so a password alone is never enough. Backup codes keep you from getting locked out.
- Step-up verificationRevealing card details, adding a payee, and changing security settings ask you to confirm it's you again.
- App lockThe installed app locks after inactivity and blurs balances in the app switcher.
- Device and session managementSee every signed-in device, sign any of them out, and get an alert for new sign-ins.
- Encryption in transitEvery connection uses HTTPS with HSTS. Pages can't be framed by other sites.
- Encrypted sensitive fieldsCard numbers and external account numbers are encrypted at rest. Card details you enter for funding go straight to Stripe.
- Least-privilege accessStaff permissions are set by role, and sensitive values stay masked unless a role needs them.
- Append-only ledgerLedger entries can't be changed or deleted. The database refuses it. Corrections are new, visible entries.
- Tamper-evident audit logEvery staff and security action is chained with a cryptographic hash, so altering history is detectable.
Responsible disclosure
Report a vulnerability
If you believe you've found a security issue, email us with the details and steps to reproduce. Please don't access other people's data or disrupt the service while testing.
Be among the first to use NOVARA.
Open your account in a few minutes. All you need is an email address.
Open an account