Squadly handles shared finances between real people, so we treat security as a baseline requirement, not an afterthought. Here's what that means in practice — described plainly, and kept accurate to what we actually do rather than generic promises.
Authentication
Passwords are hashed with bcrypt and never stored in plain text. Sessions use short-lived access tokens plus a rotating refresh token in an httpOnly cookie — reusing a rotated token is treated as theft and revokes the session. Login attempts are rate-limited.
Encryption
All traffic is served over HTTPS/TLS, with HTTP requests redirected automatically. Data at rest is encrypted by our database provider.
Authorization
Every request is checked server-side against who's actually allowed to see or change it — a squad's expenses, for instance, are only visible to that squad's members, regardless of what the client asks for.
Ongoing practices
Dependencies are scanned continuously and updated when vulnerabilities are found. Every code change runs through an automated test and security-header check before it ships.
Payments
Squadly does not currently take payments and never asks for a card number. If paid plans are introduced later, card details will be handled by a PCI-DSS-certified payment processor and will not pass through or be stored on our systems.
What's private vs. shared
Expenses, chores, and itineraries you add to a squad or trip are visible to that squad or trip's other members — that's the point of the feature. Your personal finance data (income, debts, goals, property) is never shared with anyone else, by anyone else's request or by default.
Report a vulnerability
If you find a security issue, we want to hear about it before anyone else does. Email security@squadlyclub.com with steps to reproduce it. Please don't publicly disclose an issue before we've had a reasonable chance to fix it, and please don't access, modify, or delete data that isn't yours while testing. We aim to acknowledge reports within 72 hours. See also our security.txt.
This page summarizes our practices for users; it isn't a compliance certification or an exhaustive technical audit.