SECURITY

Practical controls, not certification theater.

SpendWindow treats account access, tenant isolation, billing boundaries, source integrity and customer workflow data as security-sensitive.

Last updated September 21, 2026

Current security baseline

  • Server-side tenant authorization. Customer-owned records are scoped to an organization and protected by server-side authorization checks.
  • Managed authentication. Authentication is handled through a maintained authentication provider rather than custom password cryptography.
  • Secret isolation. Credentials and provider secrets are intended to live in environment-specific secret management and are not committed to the repository.
  • Database change control. Schema changes use reviewed migrations and are exercised in CI against disposable PostgreSQL.
  • Tenant-isolation testing. CI includes a two-customer isolation test designed to catch cross-organization access failures.
  • Access and billing guard tests. Protected account and billing boundaries are part of the validation pipeline.
  • Source provenance. Evidence links and source context are retained so intelligence can be reviewed rather than trusted blindly.
  • Fail-closed production modes. Production data and billing paths are designed to require explicit provider configuration rather than silently falling back to demo behavior.

What we do not claim

SpendWindow does not currently claim SOC 2, ISO 27001, FedRAMP, PCI DSS certification, or another third-party security certification unless and until that certification has actually been completed. Payment-card processing, when enabled, is handled through a specialized payment provider; that does not make every part of SpendWindow independently PCI certified.

Vulnerability reporting

If you believe you found a security vulnerability, please do not publish it or open a public issue. Email hello@getspendwindow.com with reproduction steps, affected URL or workflow, and the potential impact.

Please do not include passwords, API keys, session tokens, database credentials, payment information, or unrelated personal data in a vulnerability report.

Security reviews for customers

Business customers with a legitimate security-review need may contact us for additional information. Security questionnaires, data-processing terms, or contractual security commitments may be handled separately and should not be inferred from this public summary.