Security

• Your financial data is yours. We never sell it, and never share it for advertising.
• Private by default. No other user, and no member of our team, can casually browse your records.
• AI works for you, not on you. Prism Intelligence never trains models on your data.

Every table in PrismLab enforces row-level security. The database itself checks that a record can only be read or written by the account that owns it. This is not just a check in the app that could be bypassed; it is enforced at the data layer, on every request.

Access to the app is protected by short-lived, cryptographically signed sessions, so a stale or stolen token cannot be reused indefinitely.

• In transit: all traffic is served over HTTPS with TLS.
• At rest: your data is stored in an encrypted, managed PostgreSQL database.
• Extra protection for your vault: the most sensitive Family Vault fields are additionally encrypted at the application layer (AES-256) before they reach the database.
• Secrets such as API keys and tokens are stored as protected environment secrets and never committed to source code.

Beyond isolating your data, we harden the app itself against common web attacks:

• A strict content-security policy limits what can run on the page, reducing the impact of injected or third-party scripts.
• HTTPS is enforced (HSTS), and the app cannot be embedded in a hidden frame — protecting against clickjacking.
• Browsers are told not to guess file types, and uploads are validated by their actual file signature, not just their name.

When you use quick entry, the bill reader, statement import or your monthly summary, the relevant content is sent securely to our AI provider to generate a result for you.

• It is used only to produce your result, and is not used to train AI models.
• Documents and statements are processed to extract structured data, then returned to you.
• You stay in control: AI output is always a suggestion you can review, edit or discard before anything is saved.

• Sharing is explicit and granular. You choose which sections a person can see, and whether they can view or edit.
• You can revoke someone's access at any time.
• Internally, access follows the principle of least privilege, and sign-ins and sensitive actions are logged.

We rely on a small set of reputable providers to run the service, each bound by a data-processing agreement and using your data only as needed to deliver PrismLab:

• Supabase — managed database, authentication and file storage (Singapore).
• Vercel — application hosting and global edge network (United States and edge locations).
• Anthropic — the AI engine behind Prism Intelligence (United States).
• Cloudflare — DNS and email routing.
• Resend — transactional email.
• Our payment provider — subscription billing.

Running the service means your data is processed in Singapore and the United States, and may pass through global edge locations. Where data crosses borders, we rely on our providers' contractual safeguards.

• Active-account data is kept while your account is open; after you close it, personal data is deleted within about 30 days, except records we must keep by law.
• Billing and tax records are retained for up to 7 years; backups roll over within about 30 days; technical logs within about 90 days.
• You can export your records and reports to PDF, CSV or Excel at any time.
• You can ask us to access, correct or delete your account and personal data.

The full detail — sub-processors, cross-border transfers, your rights by country and how we handle a data breach — is in our Privacy policy.

No system is perfectly secure, and we do not pretend otherwise. If you believe you have found a vulnerability, please tell us at admin@prismlab.app and we will respond quickly. General privacy questions can go to the same address.

This page describes our current practices and will evolve as PrismLab grows.