What protects your account, and what does not yet

Sessions are encrypted and their cookies are restricted to HTTPS, so a session cannot be read or replayed by anything sitting between you and us.

• Sign-in history. Every sign-in is recorded with the time, the network it came from and the browser it used, and you can read the list.
• New-device alerts. A sign-in from a device we have not seen raises its own alert rather than being folded into a digest you might skim.
• Sign out everywhere. One button ends every session on your account, including the one you are using. A device that has been revoked is signed out on its very next request, not the next time it happens to load a guarded page.

These are yours alone. Signing out everywhere ends your sessions and leaves your partner’s untouched.

The privacy boundary is enforced on the server, in the queries. A private line is never loaded for the other person — so there is no interface state to get wrong, no filter to forget, and nothing a modified request can ask for and receive.

A shared total is built from the lines you are allowed to see, rather than from the real total with private ones subtracted. The second kind leaves a difference that can be worked backwards; this one leaves nothing over.

Our own support tools can see your name, your email address, your plan, and whether an import succeeded. They cannot see a transaction, an allocation, an account balance, a budget line, a goal, a debt or a report — the queries behind those screens do not select those columns.

Every administrative action an operator takes on an account is written to an audit trail that the operator cannot edit or delete, and that outlives the account it was about.

The site is served over HTTPS with certificates renewed automatically. The database is backed up every night, each snapshot encrypted to a key the server itself does not hold — it can seal a backup and cannot open one — and the restore is rehearsed weekly rather than assumed to work.

Uploaded receipts and documents are kept on private storage and served only through a request we have checked, so a file URL on its own gets nobody anything.

Inkece never holds your banking credentials, because it never connects to your bank. It never sees your card number either; subscription payments are entered on Paystack’s own checkout.

A security page without this section is a marketing page. These are true today and will be corrected here when they change.

• The live database is not encrypted on disk. Backup snapshots are; the running database is protected by the server’s own access controls rather than by encryption at rest.
• There has been no independent security audit and no penetration test by a third party. What is described above is our own work, reviewed by us.
• Nothing is deleted on a schedule. Records stay until you remove them or close your account. There is no automatic minimisation sweep.
• There is no bug bounty programme — but see below, because we very much want to hear from you.

If you have found something, write to admin@inkece.co.za with enough detail to reproduce it. We will confirm we have it within one working day, keep you posted while it is being fixed, and credit you if you would like to be credited.

We will not threaten anybody who reports a genuine issue in good faith. Please do not test against another person’s account or household — tell us instead and we will reproduce it ourselves.

What we hold and who we share it with is on the privacy page.