Security
Security at Horizons
Your financial data is among the most sensitive information you will ever entrust to a product. Here is how we protect it — in plain terms, with no hand-waving.
Encryption at rest + in transit
TLS 1.2+ on every request; HSTS + upgrade-insecure-requests enforced. Sensitive fields (Plaid access tokens, payout routing numbers) are additionally wrapped with Fernet field-level encryption using a server-side key rotated on a fixed cadence. Database encryption at rest is handled by the managed Postgres provider.
Authentication + session security
Short-lived JWT access tokens (15 min) held in memory, paired with rotating refresh tokens in httpOnly cookies. Refresh-token families detect reuse and revoke the entire family on replay. Login uses account lockout (5 failures → exponential backoff up to 24h). Password policy is zxcvbn ≥ 3, minimum 12 characters.
TOTP two-factor authentication
Time-based 2FA available to every seat, and required for any seat with access beyond a single household. Authenticator-app compatible (Google Authenticator, 1Password, Authy). Recovery codes are generated at setup and single-use.
Backend hardened against the OWASP Top-10
An internal review against the full OWASP Top-10 was completed before launch, and its findings drove what ships today: rate-limited per-route (Redis sliding-window), CSRF-protected on every mutating request, strict Content-Security-Policy with per-request nonces, mass-assignment protection with explicit allow-lists on user-editable models. To be precise about what that is and isn't: this was our own engineering review, not an independent third-party penetration test. That test is planned alongside SOC 2 — see /trust/soc2 for the honest current state.
No ad trackers. No data selling.
We use PostHog for product analytics and Sentry for error monitoring — both self-hostable, both contractually prohibited from reselling your data. We never sell or share raw financial data with any third party. If you link a bank via Plaid, Plaid is the data-access layer; we receive transactions and balances only.
Audit logging + compliance
Every mutation to a user's financial entities is audit-logged with actor, action, entity type, and before/after snapshots. Logs are append-only and retained for compliance review. Advisor-facing actions carry additional compliance context per M9h3 (legal review checklist).
Certifications + roadmap
Horizons is pre-SOC 2. We are running our Type I readiness assessment in 2026 Q2 with a Type II observation window to follow. The controls we ship against today already align to the SOC 2 trust-services criteria (security, availability, confidentiality, privacy, and processing integrity).
We do not claim certifications we do not hold. This page is updated when certifications advance; the last update was on launch day.
Reporting a vulnerability
If you believe you have found a security issue, please email us directly before disclosing publicly. We aim to acknowledge reports within 48 hours and we thank and credit researchers who report responsibly.
contact@chartyourhorizons.comRunning a vendor security review?
Enterprise and family-office clients can request our security due-diligence packet — SIG, CAIQ, or your own questionnaire. Tell us your format and timeline and we'll follow up within 5 business days.
Request a due-diligence packetLearn more about how we handle your data in our Privacy Policy and Cookie Policy.