Security
Splits is a demo product: every account holds fake seeded data, demo accounts are purged daily, and bank linking runs against Plaid's sandbox only — no real bank credentials are accepted and no real financial data enters the system. There are no SLAs and no compliance program. What follows describes how the system is designed: the code treats the data as if it were real.
Found a vulnerability? Email hello@splitshq.com.
Database-level access rules
Every record is scoped to its owner at the database layer, so a query made on one user's session can never read another user's rows. Sensitive writes — notifications, friend requests, group membership — go through audited database functions that re-verify who is asking. Every server request also re-checks the session before touching the database, so the database rules are defense in depth rather than the only gate.
Bank linking
Bank access is read-only: Splits can see transactions to detect shared recurring bills, and it can never move money. The access token issued after a (sandbox) bank link is encrypted at rest with authenticated 256-bit encryption before it touches the database, decrypted only at the moment of use, and never logged or returned from an API.
Webhook verification
Incoming bank-data notifications are cryptographically verified — the signature is checked against the provider's published keys, the message body is checked against its hash, and anything older than five minutes is rejected. Unverified requests are dropped.
Step-up second factor
When a second factor is enrolled, sensitive actions — connecting a bank, changing payment handles, rotating a password, deleting the account — require a fresh second-factor challenge rather than trusting the login session. Accounts without a factor pass through, so the demo stays friction-free. The device that cleared the most recent challenge is remembered for 30 days via a signed token. An authenticator-app (TOTP) factor is available in Settings.
Reporting
The fastest way to report a security issue (or anything else) is to email hello@splitshq.com. Since all data in the system is fake, there is no user data at risk, but reports are still appreciated and read.