Your password is never stored in plain text. When you create a password, it's put through bcrypt hashing — a one-way transformation that scrambles it into an unreadable string. Even with full database access, nobody can reverse it back to your actual password.

We apply a 12-round salt, meaning each password is processed 4,096 times before storage. This makes automated guessing attacks computationally infeasible — each guess takes significant computing time, not milliseconds.

When logging in from a new or unrecognized device, you'll be sent a 6-digit code to your email. Even if someone obtains your password, they cannot access your account without also controlling your inbox.

Each code expires in 10 minutes and can only be used once. Devices you recognize are remembered, so you won't be prompted on every login from the same device.

After login, we issue a JWT (JSON Web Token) stored in an httpOnly cookie. This means no JavaScript running on the page can read or steal it — protecting you against cross-site scripting (XSS) attacks, which are among the most common web vulnerabilities.

Tokens automatically expire after 24 hours. Logging out from the Security Center instantly invalidates all sessions across all of your devices.

All communication between your browser and our servers uses TLS (Transport Layer Security) — the same technology that protects online banking and credit card transactions. This prevents anyone from intercepting your data in transit.

Your financial data is stored in MongoDB Atlas, which encrypts everything at rest using AES-256 — the encryption standard used by the US government for classified information.

Your data lives in MongoDB Atlas, a cloud database platform built for enterprise-grade security. Atlas provides:

• End-to-end encryption for all stored data (AES-256)
• Automated daily backups with point-in-time recovery
• Network isolation — your data is not reachable from the public internet
• Compliance with SOC 2 Type 2, ISO 27001, and GDPR requirements
• 24/7 automated threat monitoring and anomaly detection

After 5 failed login attempts, your account is automatically locked for 15 minutes. This stops automated programs from "brute-forcing" your password by trying thousands of combinations per second.

You receive an email notification any time your account is locked, so you'll know immediately if someone is trying unauthorized access — even while you're asleep.

Your financial data is yours alone. We do not sell, rent, share, or trade your personal or financial information with any third party — ever. No advertisers. No data brokers. No anonymized stats sold to research firms.

Our only revenue comes from subscription fees. Our business model is aligned with your interests, not an advertiser's. If you stop paying, we have no incentive to hold your data — you can export everything and leave at any time.

If you spot a security vulnerability or notice suspicious activity on your account, please contact us immediately:

• Email: CommonwealthFinancialEducation@gmail.com
• Use the subject line "Security Concern" for fastest routing

We commit to responding within 1 business day. If you discover a genuine vulnerability, we ask that you allow us a chance to fix it before public disclosure — responsible disclosure protects every user on the platform.