Security

Nummbas takes the security of your financial data seriously. Here is how we protect your information.

Data Encryption

• All data is encrypted in transit and at rest
• Connections to third-party platforms use secure protocols

Authentication

• OAuth connections - most integrations use OAuth, which means Nummbas never sees or stores your platform passwords. You authorize access directly through each platform.
• API keys - for integrations that use API keys (Stripe, ShipStation, Recharge), keys are stored securely and encrypted at rest. We recommend using restricted or read-only keys.
• Two-factor authentication - enabled by default for all accounts using email verification codes. Users can switch to an authenticator app (such as Google Authenticator or Authy) in Settings for stronger security. Backup codes are provided when MFA is set up.

Access Control

• Role-based access - team members have different levels of access based on their role. Owners control billing and account deletion. Admins manage integrations, team, and settings. Members have read-only dashboard access. See Team Members for the full permissions table.
• Password confirmation - actions like rebuilding data, deleting accounts, and transferring ownership require password re-entry
• Session management - secure sign-in sessions with automatic expiration

Data Sharing

• Nummbas does not sell your data
• Nummbas shares data with service providers only when needed to provide the service you choose. See the Privacy Policy for details
• The Data Sharing feature creates time-limited, optionally password-protected links that you control
• Share links can be revoked at any time
• Recipients get read-only access only

Integration Security

• Nummbas only requests read access to your platforms - it will never create, modify, or delete data on your connected services
• Plaid handles secure bank sign-in, and Nummbas does not receive your bank password
• Platform access can be revoked at any time by disconnecting the integration
• Each integration can be disconnected or rebuilt on its own

Data Retention

• Your data is retained as long as your account is active
• If you delete your account, data is retained for a limited period before permanent deletion
• Owners and admins can rebuild synced data from Settings when needed

Questions