Security Overview
Last Updated: October 10, 2026
1. In Transit
Every connection to Poiiints uses HTTPS, and plain HTTP is redirected to it.
2. Access to Your Data
Every request is tied to your signed-in session, and the server reads only the data that belongs to your account.
3. Sign-In
Poiiints has no passwords. You sign in with a one-time code sent to your email. We store only a one-way hash of each code, and codes expire.
4. Read-Only Access
Poiiints asks Plaid only for transactions. It can read them; it cannot move money.
5. Service Providers
Our server and database run on Railway, and the website runs on Vercel. Sign-in codes are sent through Resend, and Plaid provides bank connections. Chat is answered through OpenRouter, which passes your message to a provider that runs the AI model (currently Claude Haiku 5.5, made by Anthropic); we set OpenRouter to use only providers that don't store or train on your data. We send chat data only to OpenRouter.
6. Deleting Your Data
Delete your account in Settings, or by email, and your data is removed.