Last updated: August 16, 2026
1. Local-First Architecture
The strongest security property Viridel offers is architectural: your personal finance data does not live on our servers by default. The free web app and the desktop and mobile apps store everything in local IndexedDB / localStorage or native SQLite. There is no Viridel server-side user database of personal finance records to exfiltrate when sync is off.
2. Account Access & Authentication
Viridel uses Google OAuth exclusively. There is no Viridel password database to phish, no password hashes to crack, and no password reset flow to hijack. After OAuth, Supabase issues short-lived JWT access tokens with refresh-token rotation; tokens live in secure storage and are never placed in URLs. There is no staff "login as user" impersonation feature in the product.
3. Database Security (Cloud Sync)
Every Supabase table with personal sync data has row-level security enabled, enforced inside PostgreSQL — not only an application-layer check. Supabase publishes SOC 2 Type II reports for its platform (provider certification — not a Viridel SOC 2 attestation). Data at rest is encrypted with AES-256 on AWS eu-central-1 (Frankfurt); backups are encrypted. At-rest encryption is provider-managed — not end-to-end encryption of ledger contents. We do not intentionally commit secrets to source control.
Privileged database access, if ever used, is limited to security incidents, abuse investigation, or legal process — not routine customer support snooping — and is expected to be logged by the platform.
4. Payment Security
Dodo Payments is the Merchant of Record. Viridel never receives, stores, or transmits your card number, CVV, or bank details — Dodo handles all of it and is PCI DSS compliant. Every Dodo webhook is verified by HMAC signature before processing, so forged or replayed payment confirmations are rejected. Viridel stores only an opaque customer ID and your subscription status.
5. Transport & Infrastructure
All traffic uses TLS 1.3 where negotiated by modern clients; older TLS is disabled at the edge where we control configuration. HSTS is enforced to prevent downgrade attacks. The web app ships with a Content Security Policy. Optional Plus sync data is stored in Supabase on AWS eu-central-1 (Frankfurt), encrypted at rest with AES-256 — provider-managed at-rest encryption, not end-to-end encryption of ledger contents. Transactional email, when configured, is sent via Resend (Ireland). The marketing site and web origin run on Vercel (Frankfurt). Cloudflare’s CDN may cache public assets from the United States (US-east and other PoPs); request logs may include IP and URL, not your finance-record content. Server-side logic runs in isolated Supabase Edge Functions with minimal permissions and short execution windows. Dependencies are reviewed for known vulnerabilities on an ongoing basis.
6. Desktop & Mobile App Security
The Electron desktop app enables context isolation and disables Node integration in every renderer; the preload script exposes only a minimal, whitelisted surface via contextBridge. On mobile, auth tokens are stored in the iOS Keychain and Android Keystore — hardware-backed secure stores not accessible to other apps. App data lives in a sandboxed native SQLite database. Where offered, home-screen widgets read only the finance keys the app bridges to the OS widget surface.
7. Data Handling
Viridel uses no analytics or tracking SDKs — no Google Analytics, no Meta Pixel, no session recording. It has no AI features, so your data is never sent to or used to train any model. You can export everything as JSON or CSV at any time, produced entirely locally. Deleting your account removes cloud data within 30 days; local data stays under your control until you clear it.
No server copy of local-only finance records. If you never enable Viridel Plus, your expenses, budgets, bills, subscriptions, income, savings goals, and similar content stay on your device. Account identity still exists if you signed in. Enabling Plus uploads the collections you sync.
8. Incident Response
If a personal-data breach affecting synced data is confirmed, we notify affected users without undue delay and within 72 hours where GDPR applies, describing what happened, what was affected, and what we are doing. Local-only users are unaffected by server-side incidents involving sync storage.
9. Responsible Disclosure
If you discover a vulnerability, please report it privately to security@viridel.app before public disclosure. Include reproduction steps, the component affected, and your assessment of impact.
- Acknowledgement within 2 business days.
- Triage and status update within 5 business days.
- Please don't publicly disclose before a fix, and don't access other users' data when testing.
- No paid bounty, but we credit researchers (with permission) in release notes for valid reports.
10. Security Contact
Security reports: security@viridel.app. Privacy: privacy@viridel.app. Related: Privacy · DPA · Terms · Refund.
Disclaimer & Updates
These pages describe how Viridel operates as a product. They are not legal advice. We may update them; for material changes we notify signed-in users by email and/or post a notice on the site or in the app. The date at the top of each page is authoritative.