Security

Your finances deserve real protection

GetGild is built on a zero-knowledge architecture. We cannot read your financial data even if we wanted to. Your encryption key never leaves your device.

Hosted in ISO 27001-certified UK data centres: your data never leaves the UK
🔐
Encryption
AES-256-GCM
🏦
Open Banking
FCA Regulated
🔑
Session Tokens
15-min TTL
🌍
Data Residency
UK Only
Data Protection

Encrypted at every layer

Separate encryption keys for live data, backups, and disaster recovery, all managed with dedicated, customer-controlled keys stored in a hardware-backed key management service.

🔒

Encryption in Transit

All traffic is encrypted with TLS 1.2 or higher. TLS 1.0 and 1.1 are not supported. HSTS is enforced with a one-year max-age including subdomains.

💾

Encryption at Rest

All databases use AES-256 with dedicated, customer-managed keys: separate keys for live data, backups, and disaster recovery. Audit log storage is WORM-protected (write-once-read-many) to prevent tampering.

🗂️

Data Classification

  • Restricted: transactions, bank credentials (envelope encryption + access logged)
  • Confidential: profiles, balances (envelope encryption + RBAC)
  • Internal: logs (encrypted, no PII)
  • Public: static assets
🧹

No PII in Logs

Our logging policy prohibits recording passwords, JWT contents, financial amounts, names, or addresses. Logs reference resource IDs only, keeping your personal data out of operational systems.

🛡️

Non-Production Data

Zero real production data in dev or staging. Staging uses masked snapshots: emails replaced, transaction amounts randomised ±20%. Masking runs in an isolated environment with no internet access.

⏱️

Backups & Recovery

Automated daily backups with 35-day retention. Weekly cross-region replication with a separate encryption key. Manual snapshots are taken before every major deployment.

Authentication & Access

Identity you can trust

Short-lived tokens, strict role separation, and hardware-enforced MFA for all privileged access.

🪪

Short-Lived Tokens

JWT access tokens expire in 15 minutes, signed with RS256 using a private key stored in a hardware-backed secrets vault. Refresh tokens (7-day TTL) are stored as httpOnly, Secure, SameSite=Strict cookies and can be server-side revoked.

👥

Role-Based Access

Every account uses four roles: Owner, Admin, Editor, Viewer. These are enforced at both the API layer and at the database level using PostgreSQL Row-Level Security. Queries are always scoped to the authenticated user.

🔑

Secrets Management

Zero secrets in source code or environment variables. All credentials are fetched from a hardware-backed secrets vault at runtime. Database passwords rotate automatically every 90 days. CI pipelines are scanned for accidentally committed secrets on every build.

🚨

Break-Glass Access

Emergency database access requires dual approval (CTO or Head of Security), issues a time-limited role for up to 4 hours, and logs every action to an immutable audit trail. A post-incident review is mandatory after every activation.

📱

MFA Everywhere

All privileged infrastructure access requires MFA (hardware TOTP or WebAuthn preferred). CI/CD pipelines use short-lived federated credentials instead of long-lived static keys. The break-glass role requires MFA plus out-of-band approval.

🧱

Least Privilege Access

Every service, function, and engineer has only the permissions they need. Access policies are scoped to specific resources, never wildcards. Peer review is required for all access policy changes.

Open Banking

Bank connections via FCA-regulated infrastructure

GetGild uses TrueLayer, an FCA-authorised Payment Institution, for all Open Banking connections. Your bank credentials are never shared with GetGild.

OAuth tokens are encrypted with your personal encryption key and stored as ciphertext. During a sync, the token is decrypted transiently in an isolated serverless function and discarded immediately after use. It is never persisted in plaintext.

  • TrueLayer holds FCA authorisation: regulated bank access
  • OAuth tokens encrypted with your key, not ours
  • Tokens decrypted transiently in isolated compute, never stored plain
  • Webhook signatures validated via HMAC before processing
  • Webhook sources restricted to TrueLayer IP allowlist
  • Bank connection revoked instantly on account unlink
Open Banking Data Flow
1. You grant consent via TrueLayer's FCA-regulated OAuth flow
↓ OAuth token returned
2. Token encrypted with your key on-device and stored as ciphertext
↓ Ciphertext only stored
3. At sync time, an isolated serverless function decrypts the token, fetches data, discards the token
↓ Encrypted transactions stored
4. Encrypted transaction data stored, readable only on your device
Monitoring & Response

Continuous detection, fast response

Every API call, infrastructure change, and network flow is logged. Automated alerts fire within minutes of anomalous activity.

📋

Comprehensive Audit Trail

Every infrastructure API call is captured with identity, timestamp, and IP, retained for 1 year with cryptographic log file validation. Application audit logs record every write operation. Audit log storage is WORM-protected to prevent tampering.

🚨

Automated Alerts

  • Failed login spike: >10 failures in 5 minutes
  • Critical CVE found in deployed container image
  • Encryption key usage outside normal patterns
  • Database connection count anomaly
  • WAF SQL injection pattern detected
🌊

Network Visibility

Network flow logs capture source IP, destination, port, protocol, bytes, and allow/deny decision for all traffic, retained for 90 days online and 1 year in cold storage. Threat intelligence signals are correlated continuously against network flow data.

Compliance

Privacy by design, not afterthought

Our zero-knowledge architecture directly satisfies the technical measures required by UK GDPR Article 32. Encrypted data in a breach is not personal data in any meaningful sense.

🇬🇧

UK GDPR

Data is hosted exclusively in ISO 27001-certified UK data centres. Our architecture implements Article 25 (Privacy by Design) and Article 32 (appropriate technical measures). We hold a formal data classification policy and processing register.

🗑️

Right to Erasure

Account deletion triggers a hard delete across all tables within 30 days: users, linked accounts, transactions, assets, and tax records. Audit logs retain pseudonymous tombstone IDs only for up to 7 years for fraud and compliance purposes.

🔁

Data Minimisation

We log resource IDs, never contents. Financial amounts, names, and addresses never appear in operational logs. Our open banking integration stores OAuth tokens as encrypted blobs. GetGild staff cannot read your bank data.

Vulnerability Disclosure

Found a security issue?

We welcome responsible disclosure from the security research community. If you've discovered a vulnerability, please contact us before public disclosure so we can investigate and remediate.

We aim to acknowledge reports within 2 business days and resolve critical issues within 14 days. We will not take legal action against researchers who act in good faith.

✉   Report a vulnerability

What to include

To help us triage quickly, please include:

  • A clear description of the vulnerability
  • Steps to reproduce (proof of concept if possible)
  • The potential impact or attack scenario
  • Any affected URLs, endpoints, or components

Please do not access, modify, or delete data belonging to other users. Testing should be limited to your own account.