Security

Inctra holds a picture of your financial life, and we treat it that way. This page describes the security measures that are actually in place — written plainly, with no inflated claims. Where a technical detail matters, it's in the grey notes.

We never touch your bank login

Inctra has no connection to your bank. We never ask for your internet-banking username or password, and there is no bank-feed integration of any kind. You bring your own data — by typing it in or uploading a statement you downloaded yourself. The most sensitive credentials you have simply never pass through us, so they can't be lost by us.

Encrypted in transit

Every connection to Inctra is encrypted with HTTPS/TLS — the padlock in your browser. That covers the website, the mobile app, and every request between your device and our servers.

Technical note: inctra.co.nz is served by Vercel with automatically managed TLS certificates. Connections between our application and the database are also encrypted with TLS, as are calls to our payment, authentication, and AI providers.

Encrypted at rest

Your data lives in a PostgreSQL database hosted by Neon on AWS in Sydney, Australia, and is encrypted on disk.

Technical note: Neon encrypts data at rest with AES-256, with encryption keys managed through AWS KMS.

Sign-in security

Authentication is handled by Clerk, a dedicated identity provider — your password is stored and verified by their hardened infrastructure, never by our own code. You can also sign in with Google, in which case we never handle a password at all. Signing in from an unrecognised device requires a one-time code sent to your email.

Technical note: sessions are short-lived tokens that Clerk refreshes continuously and revokes on sign-out. Our servers verify every request's session before touching any data.

Payments we never see

Subscriptions are processed by Stripe, one of the world's largest payment providers. Your card details go directly from your browser to Stripe — they never reach or get stored on our servers. We hold only an anonymous customer reference.

Technical note: checkout happens on Stripe's hosted, PCI DSS-compliant payment page. Billing events reach us through cryptographically signed webhooks that we verify before acting on.

Your data is walled off to your account

Every piece of data in Inctra is tagged with the account that owns it, and every request must prove who it's from before anything is read or written. One user's data is never visible to another — there is no sharing, no public mode, and no cross-account access path.

Technical note: all data API routes require an authenticated session, and every database query is filtered by the authenticated user's ID. The only endpoint that doesn't require a session is the Stripe webhook, which is authenticated by signature verification instead.

AI processing

When you upload a statement (or use Ask AI), the content is sent over an encrypted connection to Anthropic, our AI provider, solely to extract transactions or answer your question — exactly as described in our Privacy Policy. Under Anthropic's commercial API terms this data is not used to train their models, and we don't keep your uploaded file after it has been processed.

Who can access your data

Honestly: Inctra is a small operation. Production access is limited to the founder who operates the service, and it's used only to run the app and help you when you ask for support. There is no outsourced support team, no analysts, and no one browsing your finances.

Found a security problem?

Tell us at support@inctra.co.nz and we'll respond as fast as we can. We don't run a formal bug-bounty programme, but we genuinely appreciate good-faith reports and will credit you if you'd like.