Security Policy

Vercel (Hosting Platform). ZhanPlan is hosted on Vercel, which operates on SOC 2 Type II certified infrastructure with 99.99% uptime SLA, DDoS protection, global CDN, and automated HTTPS enforcement. All web traffic to ZhanPlan is served over HTTPS only — we enforce HTTP Strict Transport Security (HSTS) so browsers will never connect to us without encryption.

Supabase (Database and Authentication). All user data — accounts, financial entries, goals, budgets, and activity logs — is stored in Supabase, which holds SOC 2 Type II and ISO 27001 certifications. Supabase encrypts all data at rest using AES-256 and provides point-in-time recovery, automated backups, and network isolation. Supabase operates on AWS infrastructure and maintains independent security audits. Their full security documentation is available at supabase.com/security.

Cloudflare (Network Security and DDoS Protection). All traffic to zhanplan.com is routed through Cloudflare's global network before reaching our servers. Cloudflare provides: enterprise-grade DDoS mitigation, bot detection and blocking (including AI crawler blocking), Web Application Firewall (WAF), Full Strict SSL/TLS encryption enforcement, and origin server IP masking. This means that even if an attacker identifies our hosting provider, they cannot reach our servers directly — all traffic must pass through Cloudflare's security layer. Cloudflare processes data under SOC 2 Type II certification and does not store your financial data.

Geographic Isolation. All primary data storage occurs in United States data centers. We do not store personal financial data outside the United States in primary storage.

Row-Level Security (RLS). Our Supabase database enforces Row-Level Security policies on every table containing user data. This means every database query is automatically filtered to return only records belonging to your authenticated account. It is not possible for one user’s authenticated session to read another user’s financial data — even if a bug existed at the application layer, the database would reject the query.

Group Accounts. ZhanPlan supports family/partner shared accounts through an explicit invite system. Data sharing only occurs when a user actively invites another user and that invitation is accepted. Invitations are tied to specific email addresses and expire after a set period.

Staff Access. ZhanPlan personnel access to production data is: (a) limited to the minimum necessary for support or maintenance tasks; (b) logged and auditable; (c) subject to internal access control policies; and (d) conducted only with legitimate business justification. We do not browse user financial data as a routine practice.

API Authentication. All API routes in ZhanPlan require valid authenticated sessions. Unauthenticated requests to protected endpoints are rejected with a 401 response. Session tokens have defined expiry and are automatically rotated.

Encrypted API Calls. When you use AI features (chat coach, receipt scanner, transaction categorization, PDF import), data is transmitted to OpenAI’s API over encrypted HTTPS connections (TLS 1.3).

No AI Training on Your Data. Per OpenAI’s API data usage policy, data submitted through the API is not used to train or improve OpenAI’s models. Your financial data processed by OpenAI is used only to generate a response to your specific request and is not retained by OpenAI for training.

Minimal Data Transmission. We transmit the minimum data necessary for each AI request. For the chat coach, we send financial summaries — not raw database exports. For categorization, we send merchant names only — not amounts, dates, or account identifiers. For receipts and PDFs, we process the image/document in real-time and do not permanently store the originals.

Fully Optional. All AI features are opt-in. If you choose not to use AI features, no data is ever sent to OpenAI.

7.1 Detection and Containment. Upon discovering or being notified of a potential security incident, we will immediately: (a) assess the scope and nature of the incident; (b) isolate affected systems to prevent further unauthorized access; (c) engage security professionals to investigate the root cause; and (d) preserve evidence for forensic analysis.

7.2 User Notification Timeline. We will notify affected users: (a) within 30 days of discovering the breach for California residents (as required by the California Consumer Privacy Act) and Florida residents (as required by the Florida Digital Bill of Rights); (b) within 72 hours of becoming aware for users in the European Economic Area (as required by GDPR); and (c) within timeframes required by other applicable laws for users in other jurisdictions.

7.3 Notification Content. Our breach notification will include: (a) a description of the type of personal information involved; (b) the approximate date(s) the breach occurred or was discovered; (c) the steps ZhanPlan is taking to investigate, contain, and remediate the breach; (d) steps you can take to protect yourself (such as changing your password or monitoring for suspicious activity); and (e) contact information for questions.

7.4 Regulatory Notification. Where required by law, we will also notify the appropriate regulatory authorities (such as the California Attorney General for breaches affecting 500+ California residents, or the relevant EU/UK Data Protection Authority under GDPR/UK GDPR).

7.5 Remediation. After containing a breach, we will conduct a thorough post-incident review, remediate the root cause, update our security practices as needed, and communicate the outcome to affected users.

Despite our extensive security measures, no system connected to the internet can be guaranteed to be 100% secure. ZhanPlan cannot guarantee that unauthorized parties will never defeat our security measures or improperly access your information. By using the Services, you acknowledge and accept this inherent risk of using internet-based services.

Limitation of Liability. To the maximum extent permitted by applicable law, ZhanPlan LLC’s liability for any security incident or data breach is limited as described in our Terms of Service. ZhanPlan LLC is not liable for security incidents that originate from the infrastructure of our certified third-party platform providers (Supabase, Cloudflare, Vercel, Stripe, Resend) — events that are outside our direct control and governed by those providers’ own security certifications, contracts, and liability frameworks.

By using the Services, you acknowledge that: (a) your data is secured by a stack of enterprise-certified platforms; (b) no internet-connected system can be guaranteed 100% secure; and (c) ZhanPlan’s responsibility is limited to the application-layer security controls described in this Policy, while infrastructure-layer security is maintained by our certified platform partners.