Security & Trust

Read-only connections, minimal retention, clear deletion.

Effective July 21, 2026Basel Systems, Inc.

Basel handles business financial data, so the product is designed around a simple security principle: collect less, retain less, and keep sensitive connection credentials away from the browser.

Important: Basel never receives bank credentials, never initiates payments, and cannot open cards. Plaid monitoring is read-only. Basel retains the Plaid access token only in sealed form so it can refresh transactions, and users can disconnect or delete their data from Profile. No system is perfectly secure; this page describes the controls implemented in the application and the operational work still required.

Trust model

Basel is a read-only rewards analysis tool. It is not a bank, card issuer, broker, lender, payment processor, or money transmitter. The website lets you import transaction history, run the analysis, and delete the local result.

This page describes the website-side controls currently implemented. Internal company security controls, vendor reviews, employee-device management, vulnerability scanning, and incident-response processes must be maintained operationally by Basel Systems, Inc.; a website page cannot truthfully create those controls by itself.

Data handling summary

CSV uploads

Parsed in the browser. The raw file is not uploaded to Basel servers.

Plaid imports

The server exchanges the short-lived public token, uses the resulting access token to import transactions, seals the access token, and keeps the read-only Item active for monitoring until the user disconnects.

Transaction analysis

Stored in the user's authenticated Supabase workspace, with ownership checks and row-level access controls. Some presentation state may also be cached in the browser.

Credentials

Bank credentials go to Plaid. Basel does not receive or store them.

Technical logs

Hosting and infrastructure logs may include standard request metadata needed for security, debugging, and reliability.

Connected account controls

Plaid Link is opened only after the user confirms data-access consent.
Bank and QuickBooks credentials are collected by Plaid or Intuit, not by Basel.
Plaid and QuickBooks access tokens are server-side only and are never returned to the browser.
Plaid tokens are retained only in sealed form; QuickBooks tokens are discarded after the one-time import.
Plaid webhook signatures are verified before an update is accepted.
The import is read-only and limited to transaction data needed for the analysis.
Users can revoke a connection through their bank, Plaid Portal, or QuickBooks settings.

Encryption and transport

The hosted Service is served over HTTPS. Plaid credentials and token-encryption keys are read from server environment variables and never sent to the client. Retained Plaid access tokens are sealed before database storage with AES-256-GCM, a random nonce, and workspace-bound authenticated data. The encryption key is stored separately from the database and supports controlled rotation. Supabase Auth stores the session in browser cookies, and protected routes verify the signed-in user and workspace ownership.

Access controls

Supabase Auth verifies each user's email and password before the product workspace renders. Protected page requests are redirected on the server, and financial-data handlers independently verify the user with Supabase. Monitoring tables are not exposed to anonymous or authenticated browser roles; server routes use narrowly scoped ownership checks before operating on them. Scheduled jobs require a long bearer secret. Basel does not store plain-text passwords. Administrators and systems that can access production secrets or financial data should use MFA.

Retention

Workspace transactions, analysis, alerts, and preferences persist until the user deletes them, subject to documented legal and backup exceptions.
The sealed Plaid access token persists while monitoring is active and is deleted from the active connection record on disconnect. A failed provider revocation moves it to a service-only encrypted retry queue until removal is confirmed.
QuickBooks access tokens are limited to the one-time import request.
Technical logs should be retained only as long as needed for security, reliability, and legal compliance.

See the Privacy Policy retention section for the user-facing retention policy.

User deletion controls

Users can open Profile to disconnect Plaid while retaining existing reports, opt out of monitoring emails, or delete workspace data. The deletion flow removes or securely queues removal of active Plaid Items, deletes the user's database workspaces and monitoring records, clears Basel browser storage, and signs the user out. It does not by itself cancel billing or delete the login account. Privacy requests can also be handled by email.

Current limitations

The following are not solved by adding legal pages and consent UI. They require operational work by the company:

A documented information security policy and risk-management process.
Administrative MFA for all critical systems and production assets.
Formal vulnerability scanning and patch management for employee devices and production infrastructure.
Incident-response, vendor-management, and access-review procedures.
Legal review of privacy, terms, retention, and deletion practices.

Report a security or privacy issue

Security reports can be sent to [email protected]. Privacy requests can be sent to [email protected].