Security
Your financial data deserves care
Read-only access
Stripe connects with a restricted key limited to read permissions. OpenAI and Anthropic admin keys are used only to read usage and cost reports. AWS uses a cross-account IAM role with a unique external ID that can only call Cost Explorer — MarginMeter never stores AWS access keys.
Encrypted credentials
Provider secrets are encrypted with AWS KMS envelope encryption, bound to your workspace, connection and provider. They are decrypted only in memory inside background workers when a sync runs, are never returned by the API, and are never written to logs.
Tenant isolation
Every tenant-owned database table enforces PostgreSQL row-level security keyed on your workspace, and our application database roles cannot bypass it. Automated cross-tenant isolation tests block every release.
Infrastructure
MarginMeter runs on AWS in the Asia Pacific (Singapore) region with Supabase Postgres in the same region. Data is encrypted in transit with TLS and at rest. Raw provider payloads are stored in S3 under per-workspace prefixes with lifecycle expiry.
Accounts
Passwords are hashed with Argon2id and checked against known breaches. Sessions are stored server-side and can be revoked from your security settings. Sign-in supports Google and GitHub, with rate limiting and bot protection.
Your data, your control
Export your data as CSV at any time. Deleting a workspace revokes provider credentials, purges stored payloads and removes database rows in stages. Deleting your account removes your identity and memberships.
Deterministic numbers
Every financial figure is calculated by code from provider data with source labels. AI is never used to generate amounts, margins or forecasts.
See our subprocessors, privacy policy and security documentation.
See your real margin in five minutes.
Connect Stripe and your cost providers with read-only access. Free for two connections — no card required.