Security

Independent verification

Maxint is SOC 2 Type II verified: an independent CPA firm has examined our security controls and tested that they operated effectively over a period of time. You can check our current status, and request our latest report under a confidentiality agreement, in the Maxint trust center.

Encryption

• In transit: data sent between your devices and our servers is encrypted with TLS 1.3.
• At rest: our databases, document storage and backups are encrypted with AES-256.
• Documents: receipts and statements you upload are processed in isolated environments and stored encrypted. If you provide a password for a protected statement, we use it only to open that statement.

Signing in with passkeys

• No password to steal: you sign in with a passkey (the FIDO2 / WebAuthn standard) instead of a password or SMS code. Passkeys use public-key cryptography bound to our domain, which makes them resistant to phishing and to reuse of stolen credentials.
• Biometrics stay on your device: Face ID, Touch ID or Windows Hello checks happen in your device’s secure hardware. Your biometric data is never sent to us; we store only the public key needed to verify your sign-in.
• You control your devices: you can review and revoke the passkeys registered to your account at any time in your account security settings.

Connecting your accounts

• Read-only: accounts connect read-only through Maxint Link, Stripe, Plaid or GoCardless. Maxint cannot move money from connected accounts.
• Tokens, not passwords: wherever a financial institution supports it, your banking credentials are exchanged for a secure access token and are not stored.
• When credentials must be kept: some institutions do not issue tokens that keep a connection working over time. For those institutions only, Maxint Link stores your credentials encrypted, uses them only to refresh your connection, and deletes them when you disconnect the account or close your Maxint account.
• Card payments: subscription payments are handled by payment processors and app stores that are certified to the PCI DSS standard. Maxint never receives your full card number.

Finsight and AI providers

• No training of public models: your transactions, ledger entries, documents and Finsight conversations are not used to train public or foundational AI models, by us or by the AI providers we use.
• Provider agreements: requests to the model providers we use, such as Google, Anthropic and Groq, are processed under agreements that prohibit them from training on your requests. Providers may keep requests for a limited period, generally no more than 30 days, for reliability and to detect misuse, and longer only if a request is flagged as violating their usage policies.
• Separation: each workspace’s data is kept separate, and Finsight requests include only the data needed to answer them.
• Integrations you authorize: tools that connect through the Model Context Protocol require your explicit consent through OAuth, receive only the permissions you grant, and can be revoked at any time.

Infrastructure and operations

• Protected network edge: the Service runs behind Cloudflare’s global network, including DDoS mitigation.
• Monitoring: automated monitoring, anomaly detection and regular vulnerability scanning.
• Least-privilege access: internal access to production systems is limited by role, requires hardware security keys, and is logged.
• Resilience: data is replicated and backed up, and we test our ability to recover it.
• Incident response: we maintain an incident response process. If a security incident affects your personal information, we will notify you and the relevant authorities as required by law.

Notes by service

• Scope: the measures on this page apply across Maxint’s services. The services covered by our SOC 2 Type II report are shown in the trust center.
• Maxint Work, self-hosted: when an organization runs Work on its own infrastructure, it is responsible for securing, backing up and updating that deployment, and its content stays there. The cloud service is protected as described on this page.
• Orca: Orca validates purchases and tracks entitlements; it does not collect end users’ full card numbers or banking credentials. Payments themselves are handled by the app stores and payment providers.

On your devices

Home screen widgets read balance information from an encrypted, sandboxed container on your device, so they can show an overview without exposing your full records.

What you can do

• Keep your devices up to date and protected with a passcode or biometrics.
• Revoke the passkey on any device you lose or replace.
• Give people you invite only the access they need, and review it from time to time.
• Revoke integrations and AI tools you no longer use.
• Be wary of messages asking you to sign in or share codes. Maxint will never ask you for your banking password by email, phone or chat.

Reporting a vulnerability

We welcome reports from security researchers. If you believe you have found a vulnerability in Maxint, email security@maxint.com with a description, the steps to reproduce it, and its potential impact.

When researching, please:

• test only against accounts you own or have permission to use, and access no more data than needed to demonstrate the issue;
• not run denial-of-service tests, social engineering, physical attacks, or automated scans that degrade the Service;
• not view, change, keep or share other users’ data, and stop and tell us right away if you encounter it;
• give us reasonable time to fix the issue before disclosing it publicly.

We will acknowledge your report promptly, keep you informed as we investigate and fix it, and credit you if you wish. If you make a good-faith effort to follow these guidelines, we will consider your research authorized, will not pursue legal action against you for it, and will not ask law enforcement to do so.

Contact

Security questions, audit requests and compliance inquiries: security@maxint.com. For how we handle personal information, see our Privacy Policy.