Security

Salli handles real financial data, so security isn't an afterthought: it's part of how the product is designed. This page describes the main protections in place today.

1. Deterministic money, not AI guesswork

The single biggest risk in an “AI finance app” is a language model quietly getting arithmetic wrong. Salli is built so that never happens: every number you see (tax payable, net worth, FIRE score) comes from a deterministic rules engine, never from the AI. The assistant can read and explain your ledger, but it cannot compute or alter a monetary figure. Any action it proposes that would write to your ledger requires your explicit approval first.

2. Encryption

All traffic between your browser, our servers, and our infrastructure providers is encrypted in transit using TLS. Data at rest, including your ledger, account details, and uploaded documents, is encrypted at rest by our infrastructure providers.

3. Authentication

Accounts are authenticated using signed, verifiable tokens (JWTs) issued by our authentication provider, including support for Google and Apple sign-in. Sessions are verified on every request; we don't roll our own password-storage or session logic.

4. Data isolation

Your ledger, documents, and account data are scoped to your account. Database access policies enforce that a request can only read or write data belonging to the authenticated user making it.

5. Infrastructure

Salli runs on established, managed infrastructure providers for our database, authentication, storage, application hosting, and web hosting, rather than self-managed servers. This means security patching, network protection, and physical security are handled by providers whose core business is operating that infrastructure securely.

6. Payments

We never see or store your card details. Paid subscriptions are handled by a licensed payment processor acting as merchant of record, who manages payment data under their own compliance obligations (including PCI-DSS for card processing).

7. Application security practices

• Dependencies are kept up to date and monitored for known vulnerabilities;
• Infrastructure changes go through automated, auditable deployment pipelines rather than manual production access;
• Secrets and credentials are stored in dedicated secret management, never in source code.

8. Reporting a security issue

If you believe you've found a security vulnerability in Salli, please tell us before disclosing it publicly. Email hello@salli.lkwith the subject line “Security” and as much detail as you can share. We take reports seriously and will respond promptly.

9. Sub-processors

For a list of the infrastructure and service providers we rely on to run Salli, see our Privacy Policy.